Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
173s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
09/01/2024, 18:40
Static task
static1
Behavioral task
behavioral1
Sample
rOrden00095746exe.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
rOrden00095746exe.exe
Resource
win10v2004-20231215-en
General
-
Target
rOrden00095746exe.exe
-
Size
1.1MB
-
MD5
aef03a204faf2cfa386c87b771f5af4b
-
SHA1
f83fae445c4bd160494438f5e04b5ad4ff426266
-
SHA256
f47c028b576f0510c5a5ecee522789eccef66ac59d3d60e7b4c91ef0841e9730
-
SHA512
bfa22f478952af5f43301620c9c3eac08ebd60b583e62a29d1f514d44ab55776a23b871e788a8b7eca3a7973ee38a2e05421f4879fb8b4fcf52cad29beca8dbc
-
SSDEEP
24576:8qDEvCTbMWu7rQYlBQcBiT6rprG8aEJT/UP58mv1Dw:8TvC/MTQYxsWR7aEJTYXv1
Malware Config
Extracted
agenttesla
Protocol: ftp- Host:
ftp://ftp.siscop.com.co - Port:
21 - Username:
[email protected] - Password:
+5s48Ia2&-(t
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 85 ip-api.com -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4472 set thread context of 4492 4472 rOrden00095746exe.exe 90 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4492 RegSvcs.exe 4492 RegSvcs.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 4472 rOrden00095746exe.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4492 RegSvcs.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 4472 wrote to memory of 4492 4472 rOrden00095746exe.exe 90 PID 4472 wrote to memory of 4492 4472 rOrden00095746exe.exe 90 PID 4472 wrote to memory of 4492 4472 rOrden00095746exe.exe 90 PID 4472 wrote to memory of 4492 4472 rOrden00095746exe.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\rOrden00095746exe.exe"C:\Users\Admin\AppData\Local\Temp\rOrden00095746exe.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\rOrden00095746exe.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4492
-