Analysis
-
max time kernel
138s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
29-03-2024 20:24
Static task
static1
Behavioral task
behavioral1
Sample
Solicitud de cotizacion_pdf_________.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Solicitud de cotizacion_pdf_________.exe
Resource
win10v2004-20240226-en
General
-
Target
Solicitud de cotizacion_pdf_________.exe
-
Size
394KB
-
MD5
5f3f19691d29c2c4156201bf69360ffc
-
SHA1
feccb1a852a0f2afc530ddc7ce7f8a3b7d91202f
-
SHA256
604a76b9285b05a4da8b3a7e75d7169b248c33dea66cc01b7d9819e0629dfbc0
-
SHA512
84d0c99d399ae3ccd4b6658dc212115c82c7f03a26b16b3199b2599c7ca75d8ea8c3885f191421b39e5e96463041133f3220408678bc561e509ac3df1d1f1c9d
-
SSDEEP
12288:tKMUHp7F5w7+HYRzQW8HuuxUiHyhq+DJ:PUD8+HtL5UiShq+N
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.ofilsysterns.com - Port:
587 - Username:
[email protected] - Password:
@o^M)K*1
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/3828-11-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Solicitud de cotizacion_pdf_________.exedescription pid process target process PID 4196 set thread context of 3828 4196 Solicitud de cotizacion_pdf_________.exe Solicitud de cotizacion_pdf_________.exe -
Suspicious behavior: EnumeratesProcesses 13 IoCs
Processes:
Solicitud de cotizacion_pdf_________.exeSolicitud de cotizacion_pdf_________.exepid process 4196 Solicitud de cotizacion_pdf_________.exe 4196 Solicitud de cotizacion_pdf_________.exe 4196 Solicitud de cotizacion_pdf_________.exe 4196 Solicitud de cotizacion_pdf_________.exe 4196 Solicitud de cotizacion_pdf_________.exe 4196 Solicitud de cotizacion_pdf_________.exe 4196 Solicitud de cotizacion_pdf_________.exe 4196 Solicitud de cotizacion_pdf_________.exe 4196 Solicitud de cotizacion_pdf_________.exe 4196 Solicitud de cotizacion_pdf_________.exe 3828 Solicitud de cotizacion_pdf_________.exe 3828 Solicitud de cotizacion_pdf_________.exe 3828 Solicitud de cotizacion_pdf_________.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Solicitud de cotizacion_pdf_________.exeSolicitud de cotizacion_pdf_________.exedescription pid process Token: SeDebugPrivilege 4196 Solicitud de cotizacion_pdf_________.exe Token: SeDebugPrivilege 3828 Solicitud de cotizacion_pdf_________.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
Solicitud de cotizacion_pdf_________.exedescription pid process target process PID 4196 wrote to memory of 3828 4196 Solicitud de cotizacion_pdf_________.exe Solicitud de cotizacion_pdf_________.exe PID 4196 wrote to memory of 3828 4196 Solicitud de cotizacion_pdf_________.exe Solicitud de cotizacion_pdf_________.exe PID 4196 wrote to memory of 3828 4196 Solicitud de cotizacion_pdf_________.exe Solicitud de cotizacion_pdf_________.exe PID 4196 wrote to memory of 3828 4196 Solicitud de cotizacion_pdf_________.exe Solicitud de cotizacion_pdf_________.exe PID 4196 wrote to memory of 3828 4196 Solicitud de cotizacion_pdf_________.exe Solicitud de cotizacion_pdf_________.exe PID 4196 wrote to memory of 3828 4196 Solicitud de cotizacion_pdf_________.exe Solicitud de cotizacion_pdf_________.exe PID 4196 wrote to memory of 3828 4196 Solicitud de cotizacion_pdf_________.exe Solicitud de cotizacion_pdf_________.exe PID 4196 wrote to memory of 3828 4196 Solicitud de cotizacion_pdf_________.exe Solicitud de cotizacion_pdf_________.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Solicitud de cotizacion_pdf_________.exe"C:\Users\Admin\AppData\Local\Temp\Solicitud de cotizacion_pdf_________.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Solicitud de cotizacion_pdf_________.exe"C:\Users\Admin\AppData\Local\Temp\Solicitud de cotizacion_pdf_________.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4160 --field-trial-handle=3084,i,4016110471176367543,14287608422419064331,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Solicitud de cotizacion_pdf_________.exe.logFilesize
1KB
MD58ec831f3e3a3f77e4a7b9cd32b48384c
SHA1d83f09fd87c5bd86e045873c231c14836e76a05c
SHA2567667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982
SHA51226bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3
-
memory/3828-11-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/3828-20-0x00000000053B0000-0x00000000053C0000-memory.dmpFilesize
64KB
-
memory/3828-19-0x0000000074CB0000-0x0000000075460000-memory.dmpFilesize
7.7MB
-
memory/3828-18-0x0000000005940000-0x00000000059A6000-memory.dmpFilesize
408KB
-
memory/3828-17-0x00000000053D0000-0x00000000053E8000-memory.dmpFilesize
96KB
-
memory/3828-16-0x00000000053B0000-0x00000000053C0000-memory.dmpFilesize
64KB
-
memory/3828-15-0x0000000074CB0000-0x0000000075460000-memory.dmpFilesize
7.7MB
-
memory/4196-5-0x0000000003270000-0x000000000327A000-memory.dmpFilesize
40KB
-
memory/4196-9-0x0000000008150000-0x00000000081EC000-memory.dmpFilesize
624KB
-
memory/4196-10-0x00000000082A0000-0x0000000008300000-memory.dmpFilesize
384KB
-
memory/4196-8-0x0000000005990000-0x00000000059A0000-memory.dmpFilesize
64KB
-
memory/4196-7-0x0000000074CB0000-0x0000000075460000-memory.dmpFilesize
7.7MB
-
memory/4196-14-0x0000000074CB0000-0x0000000075460000-memory.dmpFilesize
7.7MB
-
memory/4196-6-0x0000000005960000-0x000000000596E000-memory.dmpFilesize
56KB
-
memory/4196-0-0x0000000074CB0000-0x0000000075460000-memory.dmpFilesize
7.7MB
-
memory/4196-4-0x0000000005990000-0x00000000059A0000-memory.dmpFilesize
64KB
-
memory/4196-3-0x0000000005720000-0x00000000057B2000-memory.dmpFilesize
584KB
-
memory/4196-2-0x0000000005CD0000-0x0000000006274000-memory.dmpFilesize
5.6MB
-
memory/4196-1-0x0000000000C50000-0x0000000000CB8000-memory.dmpFilesize
416KB