Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
166s -
max time network
173s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
07/03/2024, 15:27
Static task
static1
Behavioral task
behavioral1
Sample
Pago Transferencias 897877667.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Pago Transferencias 897877667.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240226-en
General
-
Target
Pago Transferencias 897877667.exe
-
Size
812KB
-
MD5
fb8b15d6bd446628322c1b99b8fa8fd6
-
SHA1
d78c815199c63a24d0b290ed4ef641ea2a301a94
-
SHA256
4e9b3f914eaa619fc41ec582d09594b67cf581d38d8c0d4ff911b2d2d37f7846
-
SHA512
8cb436beced7910dc2d82687d413389b450a22ed6fd731752852cb6e313161189130524190b310acf447a1799ac1580e35cf6552c8b27c899dee21df97f9be9f
-
SSDEEP
12288:mgOiqjF+Wf8BHOLjv6T+lPs9szHc0DcBqQvzorzKfbV6pBp5unRO:mgYF+xVP4U9sbmXorCV6rp5uRO
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.ardsmmm.com - Port:
587 - Username:
[email protected] - Password:
Ard2015** - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Loads dropped DLL 1 IoCs
pid Process 220 Pago Transferencias 897877667.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 60 drive.google.com 61 drive.google.com -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\Proenzym.ini Pago Transferencias 897877667.exe -
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
pid Process 2916 Pago Transferencias 897877667.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 220 Pago Transferencias 897877667.exe 2916 Pago Transferencias 897877667.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 220 set thread context of 2916 220 Pago Transferencias 897877667.exe 108 -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\resources\sequoia.ini Pago Transferencias 897877667.exe File opened for modification C:\Windows\staalhaardt\stejlepladsers.kam Pago Transferencias 897877667.exe File created C:\Windows\fljetoners\monochrome.lnk Pago Transferencias 897877667.exe File opened for modification C:\Windows\resources\sjapper\Tolvtedel.for Pago Transferencias 897877667.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2916 Pago Transferencias 897877667.exe 2916 Pago Transferencias 897877667.exe 2916 Pago Transferencias 897877667.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 220 Pago Transferencias 897877667.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2916 Pago Transferencias 897877667.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 220 wrote to memory of 2916 220 Pago Transferencias 897877667.exe 108 PID 220 wrote to memory of 2916 220 Pago Transferencias 897877667.exe 108 PID 220 wrote to memory of 2916 220 Pago Transferencias 897877667.exe 108 PID 220 wrote to memory of 2916 220 Pago Transferencias 897877667.exe 108 PID 220 wrote to memory of 2916 220 Pago Transferencias 897877667.exe 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\Pago Transferencias 897877667.exe"C:\Users\Admin\AppData\Local\Temp\Pago Transferencias 897877667.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:220 -
C:\Users\Admin\AppData\Local\Temp\Pago Transferencias 897877667.exe"C:\Users\Admin\AppData\Local\Temp\Pago Transferencias 897877667.exe"2⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2916
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=2392 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:81⤵PID:1744
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5055df554a7743ac647504ef92c7533a3
SHA1c91dd0b0b417a699b4e7e2a989340641b0bdc443
SHA256afcf6dc345748919e446fc94a70930b44e3d03bf0973acdd97d7050255641044
SHA512532a672595aca5badd1e36ab0c8b59509cf9e6a9b91b7293a438685390b293da1955618c4100f2a21790395dd8b16cbf566aa5839bf930c3636997807cd9542d
-
Filesize
12KB
MD50d7ad4f45dc6f5aa87f606d0331c6901
SHA148df0911f0484cbe2a8cdd5362140b63c41ee457
SHA2563eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
SHA512c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9