Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
15-04-2024 14:40
Static task
static1
Behavioral task
behavioral1
Sample
COPIA DE PAGO SWIFT.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
COPIA DE PAGO SWIFT.exe
Resource
win10v2004-20240412-en
General
-
Target
COPIA DE PAGO SWIFT.exe
-
Size
650KB
-
MD5
59a4f850157ca5ce9e8229510552d433
-
SHA1
699d609cdc0b19fd1a83ae89ce5de8f01a853af8
-
SHA256
d42df773a5031e58adb497c874fcf6d5b723aaf6eadd29283a834a08d9cf712d
-
SHA512
669e3cfb38def3195307a496a3f5f998f9b4e04d6719b0c5f5ef5328169ff07e2bf9edec954bbd72a2e0ae8723167137a4d8daf1a45131e5c5794c3485d11680
-
SSDEEP
12288:DaAvgzT370vptqK3DNol90+VSNXKY79gcr+zgP8hTnWIzLaMV:pxFov2XK89gc+TWXM
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.olne.gr - Port:
587 - Username:
[email protected] - Password:
dia123A@ - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
COPIA DE PAGO SWIFT.exepowershell.exepid process 2852 COPIA DE PAGO SWIFT.exe 2520 powershell.exe 2852 COPIA DE PAGO SWIFT.exe 2852 COPIA DE PAGO SWIFT.exe 2852 COPIA DE PAGO SWIFT.exe 2852 COPIA DE PAGO SWIFT.exe 2852 COPIA DE PAGO SWIFT.exe 2852 COPIA DE PAGO SWIFT.exe 2852 COPIA DE PAGO SWIFT.exe 2852 COPIA DE PAGO SWIFT.exe 2852 COPIA DE PAGO SWIFT.exe 2852 COPIA DE PAGO SWIFT.exe 2852 COPIA DE PAGO SWIFT.exe 2852 COPIA DE PAGO SWIFT.exe 2852 COPIA DE PAGO SWIFT.exe 2852 COPIA DE PAGO SWIFT.exe 2852 COPIA DE PAGO SWIFT.exe 2852 COPIA DE PAGO SWIFT.exe 2852 COPIA DE PAGO SWIFT.exe 2852 COPIA DE PAGO SWIFT.exe 2852 COPIA DE PAGO SWIFT.exe 2852 COPIA DE PAGO SWIFT.exe 2852 COPIA DE PAGO SWIFT.exe 2852 COPIA DE PAGO SWIFT.exe 2852 COPIA DE PAGO SWIFT.exe 2852 COPIA DE PAGO SWIFT.exe 2852 COPIA DE PAGO SWIFT.exe 2852 COPIA DE PAGO SWIFT.exe 2852 COPIA DE PAGO SWIFT.exe 2852 COPIA DE PAGO SWIFT.exe 2852 COPIA DE PAGO SWIFT.exe 2852 COPIA DE PAGO SWIFT.exe 2852 COPIA DE PAGO SWIFT.exe 2852 COPIA DE PAGO SWIFT.exe 2852 COPIA DE PAGO SWIFT.exe 2852 COPIA DE PAGO SWIFT.exe 2852 COPIA DE PAGO SWIFT.exe 2852 COPIA DE PAGO SWIFT.exe 2852 COPIA DE PAGO SWIFT.exe 2852 COPIA DE PAGO SWIFT.exe 2852 COPIA DE PAGO SWIFT.exe 2852 COPIA DE PAGO SWIFT.exe 2852 COPIA DE PAGO SWIFT.exe 2852 COPIA DE PAGO SWIFT.exe 2852 COPIA DE PAGO SWIFT.exe 2852 COPIA DE PAGO SWIFT.exe 2852 COPIA DE PAGO SWIFT.exe 2852 COPIA DE PAGO SWIFT.exe 2852 COPIA DE PAGO SWIFT.exe 2852 COPIA DE PAGO SWIFT.exe 2852 COPIA DE PAGO SWIFT.exe 2852 COPIA DE PAGO SWIFT.exe 2852 COPIA DE PAGO SWIFT.exe 2852 COPIA DE PAGO SWIFT.exe 2852 COPIA DE PAGO SWIFT.exe 2852 COPIA DE PAGO SWIFT.exe 2852 COPIA DE PAGO SWIFT.exe 2852 COPIA DE PAGO SWIFT.exe 2852 COPIA DE PAGO SWIFT.exe 2852 COPIA DE PAGO SWIFT.exe 2852 COPIA DE PAGO SWIFT.exe 2852 COPIA DE PAGO SWIFT.exe 2852 COPIA DE PAGO SWIFT.exe 2852 COPIA DE PAGO SWIFT.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
COPIA DE PAGO SWIFT.exepowershell.exedescription pid process Token: SeDebugPrivilege 2852 COPIA DE PAGO SWIFT.exe Token: SeDebugPrivilege 2520 powershell.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
COPIA DE PAGO SWIFT.exedescription pid process target process PID 2852 wrote to memory of 2520 2852 COPIA DE PAGO SWIFT.exe powershell.exe PID 2852 wrote to memory of 2520 2852 COPIA DE PAGO SWIFT.exe powershell.exe PID 2852 wrote to memory of 2520 2852 COPIA DE PAGO SWIFT.exe powershell.exe PID 2852 wrote to memory of 2520 2852 COPIA DE PAGO SWIFT.exe powershell.exe PID 2852 wrote to memory of 2876 2852 COPIA DE PAGO SWIFT.exe COPIA DE PAGO SWIFT.exe PID 2852 wrote to memory of 2876 2852 COPIA DE PAGO SWIFT.exe COPIA DE PAGO SWIFT.exe PID 2852 wrote to memory of 2876 2852 COPIA DE PAGO SWIFT.exe COPIA DE PAGO SWIFT.exe PID 2852 wrote to memory of 2876 2852 COPIA DE PAGO SWIFT.exe COPIA DE PAGO SWIFT.exe PID 2852 wrote to memory of 2876 2852 COPIA DE PAGO SWIFT.exe COPIA DE PAGO SWIFT.exe PID 2852 wrote to memory of 2876 2852 COPIA DE PAGO SWIFT.exe COPIA DE PAGO SWIFT.exe PID 2852 wrote to memory of 2876 2852 COPIA DE PAGO SWIFT.exe COPIA DE PAGO SWIFT.exe PID 2852 wrote to memory of 2876 2852 COPIA DE PAGO SWIFT.exe COPIA DE PAGO SWIFT.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\COPIA DE PAGO SWIFT.exe"C:\Users\Admin\AppData\Local\Temp\COPIA DE PAGO SWIFT.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\COPIA DE PAGO SWIFT.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\COPIA DE PAGO SWIFT.exe"C:\Users\Admin\AppData\Local\Temp\COPIA DE PAGO SWIFT.exe"2⤵PID:2876