agenttesla | afb3133b41e483edcab5987c4a98047cddcec5daf4a3b42d02e402a3af27c977

Analysis

max time kernel
140s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
19/06/2024, 02:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
afb3133b41e483edcab5987c4a98047cddcec5daf4a3b42d02e402a3af27c977.exe
Size 1.2MB
Sample240619-cxtzbasckh
SHA256 afb3133b41e483edcab5987c4a98047cddcec5daf4a3b42d02e402a3af27c977
MD5 f58362efd1e0550977db29a3ff4bed49
SHA1 bd239b22805c2d9ead09712ab9060e4869564326
SHA512 c14399acb2ee2efbe9487f3f3e18e28b2f97e3c7df0a77c124be12629c1646a21f75749168bdf13b1365756e80a91a77cde4443dd7611353115c7578d62c71b7
SSDEEP 12288:/Vqi8tTaU9nxYoWo51/QZtAAm5WzgNYTpuXA1OV8nQwh6DYcN8Ezs/mO0Wh1Q2:CbnKoWt6AzqQNnhsYcN8j0Whx
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

agenttesla keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.toyotasialkot.com
Port
587
Username
[email protected]
Password
nXx0bu%7ymS81Jdgt
Email to
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	vexpoob.exe

Executes dropped EXE 1 IoCs

pid	Process
1428	vexpoob.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vexpob = "C:\\Users\\Admin\\AppData\\Roaming\\vexpoob.exe"	reg.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1428 set thread context of 5024	1428	vexpoob.exe	111

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings	vexpoob.exe

Runs ping.exe 1 TTPs 3 IoCs

Remote System Discovery

T1018

pid	Process
3904	PING.EXE
1156	PING.EXE
2668	PING.EXE

Suspicious behavior: EnumeratesProcesses 27 IoCs

pid	Process
956	afb3133b41e483edcab5987c4a98047cddcec5daf4a3b42d02e402a3af27c977.exe
956	afb3133b41e483edcab5987c4a98047cddcec5daf4a3b42d02e402a3af27c977.exe
956	afb3133b41e483edcab5987c4a98047cddcec5daf4a3b42d02e402a3af27c977.exe
956	afb3133b41e483edcab5987c4a98047cddcec5daf4a3b42d02e402a3af27c977.exe
956	afb3133b41e483edcab5987c4a98047cddcec5daf4a3b42d02e402a3af27c977.exe
956	afb3133b41e483edcab5987c4a98047cddcec5daf4a3b42d02e402a3af27c977.exe
956	afb3133b41e483edcab5987c4a98047cddcec5daf4a3b42d02e402a3af27c977.exe
956	afb3133b41e483edcab5987c4a98047cddcec5daf4a3b42d02e402a3af27c977.exe
956	afb3133b41e483edcab5987c4a98047cddcec5daf4a3b42d02e402a3af27c977.exe
956	afb3133b41e483edcab5987c4a98047cddcec5daf4a3b42d02e402a3af27c977.exe
956	afb3133b41e483edcab5987c4a98047cddcec5daf4a3b42d02e402a3af27c977.exe
956	afb3133b41e483edcab5987c4a98047cddcec5daf4a3b42d02e402a3af27c977.exe
956	afb3133b41e483edcab5987c4a98047cddcec5daf4a3b42d02e402a3af27c977.exe
956	afb3133b41e483edcab5987c4a98047cddcec5daf4a3b42d02e402a3af27c977.exe
956	afb3133b41e483edcab5987c4a98047cddcec5daf4a3b42d02e402a3af27c977.exe
956	afb3133b41e483edcab5987c4a98047cddcec5daf4a3b42d02e402a3af27c977.exe
956	afb3133b41e483edcab5987c4a98047cddcec5daf4a3b42d02e402a3af27c977.exe
956	afb3133b41e483edcab5987c4a98047cddcec5daf4a3b42d02e402a3af27c977.exe
956	afb3133b41e483edcab5987c4a98047cddcec5daf4a3b42d02e402a3af27c977.exe
956	afb3133b41e483edcab5987c4a98047cddcec5daf4a3b42d02e402a3af27c977.exe
956	afb3133b41e483edcab5987c4a98047cddcec5daf4a3b42d02e402a3af27c977.exe
956	afb3133b41e483edcab5987c4a98047cddcec5daf4a3b42d02e402a3af27c977.exe
956	afb3133b41e483edcab5987c4a98047cddcec5daf4a3b42d02e402a3af27c977.exe
1428	vexpoob.exe
1428	vexpoob.exe
5024	InstallUtil.exe
5024	InstallUtil.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	956	afb3133b41e483edcab5987c4a98047cddcec5daf4a3b42d02e402a3af27c977.exe
Token: SeDebugPrivilege	1428	vexpoob.exe
Token: SeDebugPrivilege	5024	InstallUtil.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3768	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3768	AcroRd32.exe
3768	AcroRd32.exe
3768	AcroRd32.exe
3768	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 956 wrote to memory of 4636	956	afb3133b41e483edcab5987c4a98047cddcec5daf4a3b42d02e402a3af27c977.exe	88
PID 956 wrote to memory of 4636	956	afb3133b41e483edcab5987c4a98047cddcec5daf4a3b42d02e402a3af27c977.exe	88
PID 956 wrote to memory of 4636	956	afb3133b41e483edcab5987c4a98047cddcec5daf4a3b42d02e402a3af27c977.exe	88
PID 4636 wrote to memory of 3904	4636	cmd.exe	90
PID 4636 wrote to memory of 3904	4636	cmd.exe	90
PID 4636 wrote to memory of 3904	4636	cmd.exe	90
PID 956 wrote to memory of 3208	956	afb3133b41e483edcab5987c4a98047cddcec5daf4a3b42d02e402a3af27c977.exe	94
PID 956 wrote to memory of 3208	956	afb3133b41e483edcab5987c4a98047cddcec5daf4a3b42d02e402a3af27c977.exe	94
PID 956 wrote to memory of 3208	956	afb3133b41e483edcab5987c4a98047cddcec5daf4a3b42d02e402a3af27c977.exe	94
PID 3208 wrote to memory of 1156	3208	cmd.exe	96
PID 3208 wrote to memory of 1156	3208	cmd.exe	96
PID 3208 wrote to memory of 1156	3208	cmd.exe	96
PID 4636 wrote to memory of 2288	4636	cmd.exe	98
PID 4636 wrote to memory of 2288	4636	cmd.exe	98
PID 4636 wrote to memory of 2288	4636	cmd.exe	98
PID 3208 wrote to memory of 2668	3208	cmd.exe	100
PID 3208 wrote to memory of 2668	3208	cmd.exe	100
PID 3208 wrote to memory of 2668	3208	cmd.exe	100
PID 3208 wrote to memory of 1428	3208	cmd.exe	101
PID 3208 wrote to memory of 1428	3208	cmd.exe	101
PID 3208 wrote to memory of 1428	3208	cmd.exe	101
PID 1428 wrote to memory of 3768	1428	vexpoob.exe	102
PID 1428 wrote to memory of 3768	1428	vexpoob.exe	102
PID 1428 wrote to memory of 3768	1428	vexpoob.exe	102
PID 3768 wrote to memory of 4992	3768	AcroRd32.exe	103
PID 3768 wrote to memory of 4992	3768	AcroRd32.exe	103
PID 3768 wrote to memory of 4992	3768	AcroRd32.exe	103
PID 4992 wrote to memory of 4192	4992	RdrCEF.exe	104
PID 4992 wrote to memory of 4192	4992	RdrCEF.exe	104
PID 4992 wrote to memory of 4192	4992	RdrCEF.exe	104
PID 4992 wrote to memory of 4192	4992	RdrCEF.exe	104
PID 4992 wrote to memory of 4192	4992	RdrCEF.exe	104
PID 4992 wrote to memory of 4192	4992	RdrCEF.exe	104
PID 4992 wrote to memory of 4192	4992	RdrCEF.exe	104
PID 4992 wrote to memory of 4192	4992	RdrCEF.exe	104
PID 4992 wrote to memory of 4192	4992	RdrCEF.exe	104
PID 4992 wrote to memory of 4192	4992	RdrCEF.exe	104
PID 4992 wrote to memory of 4192	4992	RdrCEF.exe	104
PID 4992 wrote to memory of 4192	4992	RdrCEF.exe	104
PID 4992 wrote to memory of 4192	4992	RdrCEF.exe	104
PID 4992 wrote to memory of 4192	4992	RdrCEF.exe	104
PID 4992 wrote to memory of 4192	4992	RdrCEF.exe	104
PID 4992 wrote to memory of 4192	4992	RdrCEF.exe	104
PID 4992 wrote to memory of 4192	4992	RdrCEF.exe	104
PID 4992 wrote to memory of 4192	4992	RdrCEF.exe	104
PID 4992 wrote to memory of 4192	4992	RdrCEF.exe	104
PID 4992 wrote to memory of 4192	4992	RdrCEF.exe	104
PID 4992 wrote to memory of 4192	4992	RdrCEF.exe	104
PID 4992 wrote to memory of 4192	4992	RdrCEF.exe	104
PID 4992 wrote to memory of 4192	4992	RdrCEF.exe	104
PID 4992 wrote to memory of 4192	4992	RdrCEF.exe	104
PID 4992 wrote to memory of 4192	4992	RdrCEF.exe	104
PID 4992 wrote to memory of 4192	4992	RdrCEF.exe	104
PID 4992 wrote to memory of 4192	4992	RdrCEF.exe	104
PID 4992 wrote to memory of 4192	4992	RdrCEF.exe	104
PID 4992 wrote to memory of 4192	4992	RdrCEF.exe	104
PID 4992 wrote to memory of 4192	4992	RdrCEF.exe	104
PID 4992 wrote to memory of 4192	4992	RdrCEF.exe	104
PID 4992 wrote to memory of 4192	4992	RdrCEF.exe	104
PID 4992 wrote to memory of 4192	4992	RdrCEF.exe	104
PID 4992 wrote to memory of 4192	4992	RdrCEF.exe	104
PID 4992 wrote to memory of 4192	4992	RdrCEF.exe	104
PID 4992 wrote to memory of 4192	4992	RdrCEF.exe	104
PID 4992 wrote to memory of 4192	4992	RdrCEF.exe	104

C:\Users\Admin\AppData\Local\Temp\afb3133b41e483edcab5987c4a98047cddcec5daf4a3b42d02e402a3af27c977.exe
"C:\Users\Admin\AppData\Local\Temp\afb3133b41e483edcab5987c4a98047cddcec5daf4a3b42d02e402a3af27c977.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:956
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /c ping 127.0.0.1 -n 25 > nul && REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "vexpob" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\vexpoob.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4636
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 25
    3⤵
    - Runs ping.exe
    PID:3904
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "vexpob" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\vexpoob.exe"
    3⤵
    - Adds Run key to start application
    PID:2288
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /c ping 127.0.0.1 -n 28 > nul && copy "C:\Users\Admin\AppData\Local\Temp\afb3133b41e483edcab5987c4a98047cddcec5daf4a3b42d02e402a3af27c977.exe" "C:\Users\Admin\AppData\Roaming\vexpoob.exe" && ping 127.0.0.1 -n 28 > nul && "C:\Users\Admin\AppData\Roaming\vexpoob.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3208
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 28
    3⤵
    - Runs ping.exe
    PID:1156
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 28
    3⤵
    - Runs ping.exe
    PID:2668
- - C:\Users\Admin\AppData\Roaming\vexpoob.exe
    "C:\Users\Admin\AppData\Roaming\vexpoob.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1428
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Roaming\PABILOS MOTORES #5 Y 6.pdf"
      4⤵
      Checks processor information in registry
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3768
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4992
      - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=D40147BDA1B4856EE607B35CE655D501 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        6⤵
        
        PID:4192
      - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=956FF7B4AF13419ABEF53A8774224FA8 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=956FF7B4AF13419ABEF53A8774224FA8 --renderer-client-id=2 --mojo-platform-channel-handle=1756 --allow-no-sandbox-job /prefetch:1
        6⤵
        
        PID:1808
      - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=5C52BC4CB6E2B213BAF6B3C7A460ECA3 --mojo-platform-channel-handle=2308 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        6⤵
        
        PID:2864
      - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=52D2BF6F64FE258D64C18CB21AA5EF9A --mojo-platform-channel-handle=1888 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        6⤵
        
        PID:3248
      - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=2287113520F63A245452952863880A59 --mojo-platform-channel-handle=2108 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        6⤵
        
        PID:3204
      - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=F167F04BF5CA45589BDB1156A25E9F02 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=F167F04BF5CA45589BDB1156A25E9F02 --renderer-client-id=7 --mojo-platform-channel-handle=2312 --allow-no-sandbox-job /prefetch:1
        6⤵
        
        PID:3564
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5024

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 64KB
SHA256 61d17b311afae60a9e10c9026e98105c0db437220e124f554912da555ed12e5e
MD5 5669ae6ee0561175e161554b43ef3f38
SHA1 8464b7b86eff0ddd5ef84731540b5dd001724da2
SHA512 0ce033b5ef90cfe8ec0f74ebf0ef2d124540210fda87031d7211224cb74483173817c7c337812db97c1cc3936ba476c6df0590e82ab127f51c2ca0388366bd0d
SSDEEP 384:yeLdThPOtELJ8SWvDTGJCesZsLglKhubvGZsLRZh+vS4:jO+elZsLQCZsL3hUS4
MD5 SHA1 SHA512 SSDEEP

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 64KB
SHA256 ab0113b73f0e77b78dd4e35dafdcb76cf1c017572ec3df0f392159bb607f5950
MD5 c1de0b86cc88b46daa83f593f3d953d0
SHA1 2752bb6d8822f5abc9b2ec8fa7df5be7c435ac9c
SHA512 4cd6786214fbff95f013ab7434e783d3db8941151c9c23dbd1a5cc81b2ec108fc22db38fb90ff7c41a3a0cc7fb60d877c02c48e7fdeefc390c94b64f7df1b81c
SSDEEP 384:iefdThPOtELJ8SWvDTGJCesZsLglKhubvGZsLRZh+vS4:vO+elZsLQCZsL3hUS4
MD5 SHA1 SHA512 SSDEEP

Submit Download

PABILOS MOTORES #5 Y 6.pdf

Path C:\Users\Admin\AppData\Roaming\PABILOS MOTORES #5 Y 6.pdf
Size 25KB
SHA256 6b1411273cc92be9697db4c28034c98802e947563849fd441d71e6c768cc72c3
MD5 9cf473b9b836b8811841bef458bd5474
SHA1 f46e568c480c692f218f28c5066472d9affda54d
SHA512 8b2d4f7515f9f28c30c83d0bcc4ba119f2cc7f3f9c203e0e69fa3c1bf0e105cf0b36f6895917a0385174efb659780211c620268e5cbec59c36dd51d468ecf68b
SSDEEP 768:MOjgqbD1EAw5Sa7OJOo8gxraB21BiqKIA+hF:MagoD1EAuSumGgxraQe+X
MD5 SHA1 SHA512 SSDEEP

Submit Download

vexpoob.exe

Path C:\Users\Admin\AppData\Roaming\vexpoob.exe
Size 1.2MB
SHA256 afb3133b41e483edcab5987c4a98047cddcec5daf4a3b42d02e402a3af27c977
MD5 f58362efd1e0550977db29a3ff4bed49
SHA1 bd239b22805c2d9ead09712ab9060e4869564326
SHA512 c14399acb2ee2efbe9487f3f3e18e28b2f97e3c7df0a77c124be12629c1646a21f75749168bdf13b1365756e80a91a77cde4443dd7611353115c7578d62c71b7
SSDEEP 12288:/Vqi8tTaU9nxYoWo51/QZtAAm5WzgNYTpuXA1OV8nQwh6DYcN8Ezs/mO0Wh1Q2:CbnKoWt6AzqQNnhsYcN8j0Whx
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/956-3-0x0000000005C00000-0x00000000061A4000-memory.dmp

Download

memory/956-5-0x0000000075030000-0x00000000757E0000-memory.dmp

Download

memory/956-6-0x00000000067B0000-0x00000000067F4000-memory.dmp

Download

memory/956-7-0x0000000006A90000-0x0000000006A9A000-memory.dmp

Download

memory/956-8-0x0000000075030000-0x00000000757E0000-memory.dmp

Download

memory/956-9-0x000000007503E000-0x000000007503F000-memory.dmp

Download

memory/956-10-0x0000000075030000-0x00000000757E0000-memory.dmp

Download

memory/956-12-0x0000000075030000-0x00000000757E0000-memory.dmp

Download

memory/956-0-0x000000007503E000-0x000000007503F000-memory.dmp

Download

memory/956-1-0x00000000000F0000-0x0000000000222000-memory.dmp

Download

memory/956-4-0x0000000005650000-0x00000000056E2000-memory.dmp

Download

memory/956-2-0x00000000055B0000-0x000000000564C000-memory.dmp

Download

memory/1428-19-0x0000000000040000-0x0000000000172000-memory.dmp

Download

memory/1428-20-0x0000000075000000-0x00000000757B0000-memory.dmp

Download

memory/1428-18-0x0000000075000000-0x00000000757B0000-memory.dmp

Download

memory/1428-110-0x0000000075000000-0x00000000757B0000-memory.dmp

Download

memory/1428-111-0x0000000006030000-0x000000000604A000-memory.dmp

Download

memory/1428-112-0x0000000075000000-0x00000000757B0000-memory.dmp

Download

memory/1428-113-0x0000000006050000-0x0000000006056000-memory.dmp

Download

memory/1428-116-0x0000000075000000-0x00000000757B0000-memory.dmp

Download

memory/5024-114-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/5024-117-0x0000000005220000-0x0000000005286000-memory.dmp

Download

memory/5024-118-0x00000000060D0000-0x0000000006120000-memory.dmp

Download