Resubmissions
28-03-2024 06:31
240328-hacz6scd94 1028-03-2024 06:30
240328-g9qvmscd85 328-03-2024 06:29
240328-g9d6vacd79 3Analysis
-
max time kernel
107s -
max time network
112s -
platform
windows10-1703_x64 -
resource
win10-20240221-en -
resource tags
arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system -
submitted
28-03-2024 06:31
Static task
static1
General
-
Target
Facturas Marzo.exe
-
Size
746KB
-
MD5
2ab9c5d43df277601578f57b0667dfba
-
SHA1
253ab90ac289518e17786676a2786a31d7148e13
-
SHA256
808b3770297bd70c5d9026b4c7d727dc124769f10726645d56869cc48ae32960
-
SHA512
6521c55d01ef052ff3a9881c0f34e4385eff41c203e348d6c4a67ec867a684fd5696989465a9455cadb8e9c8a6152e6689f434881a3d12d216a6a2d1dfa13064
-
SSDEEP
12288:Jd8sIDs7OHMLuo2+vVB7uDcmcZ6Ub/Icjrqvnpm4wPtxhIfARPZXKC7NkU0cwsDf:Jd8sIDrMJ20QbcZxb/Icjsc48JIQh1B/
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot7189076260:AAHEL9QuHqQcKXN8kPXNO5BpYSd3XtQOqFg/
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Processes:
Facturas Marzo.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Facturas Marzo.exe -
Processes:
Facturas Marzo.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Facturas Marzo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Facturas Marzo.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 6 api.ipify.org 7 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Facturas Marzo.exedescription pid process target process PID 4800 set thread context of 1212 4800 Facturas Marzo.exe installutil.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 36 IoCs
Processes:
Facturas Marzo.exepowershell.exeinstallutil.exepid process 4800 Facturas Marzo.exe 4800 Facturas Marzo.exe 4800 Facturas Marzo.exe 4800 Facturas Marzo.exe 4800 Facturas Marzo.exe 4800 Facturas Marzo.exe 4800 Facturas Marzo.exe 4800 Facturas Marzo.exe 4800 Facturas Marzo.exe 4800 Facturas Marzo.exe 4800 Facturas Marzo.exe 4800 Facturas Marzo.exe 4800 Facturas Marzo.exe 4800 Facturas Marzo.exe 4800 Facturas Marzo.exe 4800 Facturas Marzo.exe 4800 Facturas Marzo.exe 4800 Facturas Marzo.exe 4800 Facturas Marzo.exe 4800 Facturas Marzo.exe 4800 Facturas Marzo.exe 4800 Facturas Marzo.exe 4800 Facturas Marzo.exe 4800 Facturas Marzo.exe 4800 Facturas Marzo.exe 4800 Facturas Marzo.exe 4800 Facturas Marzo.exe 4800 Facturas Marzo.exe 4800 Facturas Marzo.exe 4800 Facturas Marzo.exe 4800 Facturas Marzo.exe 4796 powershell.exe 1212 installutil.exe 1212 installutil.exe 4796 powershell.exe 4796 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
Facturas Marzo.exepowershell.exeinstallutil.exedescription pid process Token: SeDebugPrivilege 4800 Facturas Marzo.exe Token: SeDebugPrivilege 4796 powershell.exe Token: SeDebugPrivilege 1212 installutil.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
installutil.exepid process 1212 installutil.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
Facturas Marzo.exedescription pid process target process PID 4800 wrote to memory of 4796 4800 Facturas Marzo.exe powershell.exe PID 4800 wrote to memory of 4796 4800 Facturas Marzo.exe powershell.exe PID 4800 wrote to memory of 1212 4800 Facturas Marzo.exe installutil.exe PID 4800 wrote to memory of 1212 4800 Facturas Marzo.exe installutil.exe PID 4800 wrote to memory of 1212 4800 Facturas Marzo.exe installutil.exe PID 4800 wrote to memory of 1212 4800 Facturas Marzo.exe installutil.exe PID 4800 wrote to memory of 1212 4800 Facturas Marzo.exe installutil.exe PID 4800 wrote to memory of 1212 4800 Facturas Marzo.exe installutil.exe PID 4800 wrote to memory of 1212 4800 Facturas Marzo.exe installutil.exe PID 4800 wrote to memory of 1212 4800 Facturas Marzo.exe installutil.exe PID 4800 wrote to memory of 4048 4800 Facturas Marzo.exe installutil.exe PID 4800 wrote to memory of 4048 4800 Facturas Marzo.exe installutil.exe PID 4800 wrote to memory of 4048 4800 Facturas Marzo.exe installutil.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
Facturas Marzo.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Facturas Marzo.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Facturas Marzo.exe"C:\Users\Admin\AppData\Local\Temp\Facturas Marzo.exe"1⤵
- UAC bypass
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Facturas Marzo.exe" -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"2⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_uw3vr3o1.1k1.ps1Filesize
1B
MD5c4ca4238a0b923820dcc509a6f75849b
SHA1356a192b7913b04c54574d18c28d46e6395428ab
SHA2566b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA5124dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
-
memory/1212-68-0x0000000005450000-0x0000000005460000-memory.dmpFilesize
64KB
-
memory/1212-67-0x0000000073460000-0x0000000073B4E000-memory.dmpFilesize
6.9MB
-
memory/1212-65-0x0000000006710000-0x000000000671A000-memory.dmpFilesize
40KB
-
memory/1212-4-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/1212-64-0x0000000006660000-0x00000000066F2000-memory.dmpFilesize
584KB
-
memory/1212-10-0x00000000057A0000-0x0000000005C9E000-memory.dmpFilesize
5.0MB
-
memory/1212-11-0x0000000073460000-0x0000000073B4E000-memory.dmpFilesize
6.9MB
-
memory/1212-13-0x0000000005450000-0x0000000005460000-memory.dmpFilesize
64KB
-
memory/1212-15-0x0000000002B70000-0x0000000002BD6000-memory.dmpFilesize
408KB
-
memory/1212-63-0x00000000064B0000-0x0000000006500000-memory.dmpFilesize
320KB
-
memory/4796-14-0x000002A9511A0000-0x000002A9511C2000-memory.dmpFilesize
136KB
-
memory/4796-18-0x000002A969A80000-0x000002A969AF6000-memory.dmpFilesize
472KB
-
memory/4796-31-0x000002A969790000-0x000002A9697A0000-memory.dmpFilesize
64KB
-
memory/4796-58-0x000002A969790000-0x000002A9697A0000-memory.dmpFilesize
64KB
-
memory/4796-62-0x00007FFAB9A70000-0x00007FFABA45C000-memory.dmpFilesize
9.9MB
-
memory/4796-8-0x00007FFAB9A70000-0x00007FFABA45C000-memory.dmpFilesize
9.9MB
-
memory/4800-0-0x0000025C20050000-0x0000025C2007E000-memory.dmpFilesize
184KB
-
memory/4800-3-0x0000025C3A7E0000-0x0000025C3A876000-memory.dmpFilesize
600KB
-
memory/4800-66-0x00007FFAB9A70000-0x00007FFABA45C000-memory.dmpFilesize
9.9MB
-
memory/4800-2-0x0000025C21E90000-0x0000025C21EA0000-memory.dmpFilesize
64KB
-
memory/4800-1-0x00007FFAB9A70000-0x00007FFABA45C000-memory.dmpFilesize
9.9MB