Analysis
-
max time kernel
72s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
18/05/2024, 14:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
PO N°202415-0004 LUZNAGRA-INDUSTRIA_pdf.exe
Resource
win7-20240221-en
9 signatures
1800 seconds
General
-
Target
PO N°202415-0004 LUZNAGRA-INDUSTRIA_pdf.exe
-
Size
2.8MB
-
MD5
b3fbe1df64a3b21ff35bbfb01ef4561e
-
SHA1
ca5e6f05a85f66351f026780ad3573d5091252d3
-
SHA256
ad80cfe6158ea0c7864c42bcef96848c395f12094c6eecdc15f32ae0cf0a82af
-
SHA512
849d1e2f0098b92f2d418603f15300219fde31bf760c1d04b3f3efb4684eb8d9e9c1938dd4dfc74eb1ef6a87027c7540778d95580c56fc68904204605cd8cbf4
-
SSDEEP
49152:V5fMuz4nO1XaaAx5pHQ+O1SFZQkyH68+3:nBE7ZQkCH+3
Score
10/10
Malware Config
Extracted
Family
agenttesla
Credentials
Protocol: smtp- Host:
mail.temikan.com.tr - Port:
587 - Username:
[email protected] - Password:
temikan63 - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 api.ipify.org 5 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1440 set thread context of 2112 1440 PO N°202415-0004 LUZNAGRA-INDUSTRIA_pdf.exe 29 -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2112 installutil.exe 2112 installutil.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2936 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2112 installutil.exe Token: SeDebugPrivilege 2936 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe -
Suspicious use of SendNotifyMessage 45 IoCs
pid Process 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1440 wrote to memory of 2112 1440 PO N°202415-0004 LUZNAGRA-INDUSTRIA_pdf.exe 29 PID 1440 wrote to memory of 2112 1440 PO N°202415-0004 LUZNAGRA-INDUSTRIA_pdf.exe 29 PID 1440 wrote to memory of 2112 1440 PO N°202415-0004 LUZNAGRA-INDUSTRIA_pdf.exe 29 PID 1440 wrote to memory of 2112 1440 PO N°202415-0004 LUZNAGRA-INDUSTRIA_pdf.exe 29 PID 1440 wrote to memory of 2112 1440 PO N°202415-0004 LUZNAGRA-INDUSTRIA_pdf.exe 29 PID 1440 wrote to memory of 2112 1440 PO N°202415-0004 LUZNAGRA-INDUSTRIA_pdf.exe 29 PID 1440 wrote to memory of 2112 1440 PO N°202415-0004 LUZNAGRA-INDUSTRIA_pdf.exe 29 PID 1440 wrote to memory of 2112 1440 PO N°202415-0004 LUZNAGRA-INDUSTRIA_pdf.exe 29 PID 1440 wrote to memory of 2112 1440 PO N°202415-0004 LUZNAGRA-INDUSTRIA_pdf.exe 29 PID 1440 wrote to memory of 2112 1440 PO N°202415-0004 LUZNAGRA-INDUSTRIA_pdf.exe 29 PID 1440 wrote to memory of 2112 1440 PO N°202415-0004 LUZNAGRA-INDUSTRIA_pdf.exe 29 PID 1440 wrote to memory of 2112 1440 PO N°202415-0004 LUZNAGRA-INDUSTRIA_pdf.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\PO N°202415-0004 LUZNAGRA-INDUSTRIA_pdf.exe"C:\Users\Admin\AppData\Local\Temp\PO N°202415-0004 LUZNAGRA-INDUSTRIA_pdf.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1440 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2112
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2936