Analysis
-
max time kernel
144s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
04-12-2023 12:00
Static task
static1
Behavioral task
behavioral1
Sample
0089789Nuevo orden.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
0089789Nuevo orden.exe
Resource
win10v2004-20231130-en
General
-
Target
0089789Nuevo orden.exe
-
Size
849KB
-
MD5
1177200ba703d00a87eb6114e68972c8
-
SHA1
98a40d14dc7d3962cc7aae7e98af7f8f8aa5ea2f
-
SHA256
62af6b2f03773a1f7e3c92cfec408e2068adbd89d4e083ebe0ae90f8ed432c07
-
SHA512
e53e16233458b2f2bd1fc2018143a32922a83df16a19a944988103d42871ef95063a8c5bd0a891bdc1a5fe1daf46b36209a0583c771e4bdfe6202e4fab0babc6
-
SSDEEP
24576:1WNiEg7cFdwi2uzqVQRUGN6GlwjtAfXbgypW:6yYgQRUGwGyjtA/9pW
Malware Config
Extracted
agenttesla
Protocol: ftp- Host:
ftp://ftp.siscop.com.co - Port:
21 - Username:
[email protected] - Password:
+5s48Ia2&-(t
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Loads dropped DLL 1 IoCs
Processes:
0089789Nuevo orden.exepid process 3052 0089789Nuevo orden.exe -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
msbuild.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 msbuild.exe Key opened \REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 msbuild.exe Key opened \REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 msbuild.exe -
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
Processes:
msbuild.exepid process 1648 msbuild.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
0089789Nuevo orden.exemsbuild.exepid process 3052 0089789Nuevo orden.exe 1648 msbuild.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
0089789Nuevo orden.exedescription pid process target process PID 3052 set thread context of 1648 3052 0089789Nuevo orden.exe msbuild.exe -
Drops file in Program Files directory 1 IoCs
Processes:
0089789Nuevo orden.exedescription ioc process File opened for modification C:\Program Files (x86)\victorianerne\censorial\statuetternes\indgrebskriterium\sljfningers.ini 0089789Nuevo orden.exe -
Drops file in Windows directory 1 IoCs
Processes:
0089789Nuevo orden.exedescription ioc process File opened for modification C:\Windows\Fonts\megarhyssa\Bromometry\allerpopulreste\Croissanter.ini 0089789Nuevo orden.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
msbuild.exepid process 1648 msbuild.exe 1648 msbuild.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
0089789Nuevo orden.exepid process 3052 0089789Nuevo orden.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
msbuild.exedescription pid process Token: SeDebugPrivilege 1648 msbuild.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
0089789Nuevo orden.exedescription pid process target process PID 3052 wrote to memory of 1648 3052 0089789Nuevo orden.exe msbuild.exe PID 3052 wrote to memory of 1648 3052 0089789Nuevo orden.exe msbuild.exe PID 3052 wrote to memory of 1648 3052 0089789Nuevo orden.exe msbuild.exe PID 3052 wrote to memory of 1648 3052 0089789Nuevo orden.exe msbuild.exe PID 3052 wrote to memory of 1648 3052 0089789Nuevo orden.exe msbuild.exe PID 3052 wrote to memory of 1648 3052 0089789Nuevo orden.exe msbuild.exe -
outlook_office_path 1 IoCs
Processes:
msbuild.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 msbuild.exe -
outlook_win_path 1 IoCs
Processes:
msbuild.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 msbuild.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0089789Nuevo orden.exe"C:\Users\Admin\AppData\Local\Temp\0089789Nuevo orden.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"C:\Users\Admin\AppData\Local\Temp\0089789Nuevo orden.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:1648
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD575ed96254fbf894e42058062b4b4f0d1
SHA1996503f1383b49021eb3427bc28d13b5bbd11977
SHA256a632d74332b3f08f834c732a103dafeb09a540823a2217ca7f49159755e8f1d7
SHA51258174896db81d481947b8745dafe3a02c150f3938bb4543256e8cce1145154e016d481df9fe68dac6d48407c62cbe20753320ebd5fe5e84806d07ce78e0eb0c4