Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
17-09-2024 08:40
Static task
static1
Behavioral task
behavioral1
Sample
Estado de cuenta.pdf.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
Estado de cuenta.pdf.exe
Resource
win10v2004-20240802-en
General
-
Target
Estado de cuenta.pdf.exe
-
Size
1.3MB
-
MD5
92fe200abe5cd92b7766757b6d9fff86
-
SHA1
29837c6390325443c30227df4fbe3f28618dff77
-
SHA256
58672267ca553d53165e5f5318bf7c492d5378730a0857547543e8efe42c110e
-
SHA512
05355588a91e64b5833ea92c8cdd5845e42a45dd3cebc506dfc793b6e4b7b5078628835720c9af8527f8308c383c0aa46b7129a35ebfa1f12bf14f4691f25800
-
SSDEEP
24576:uRmJkcoQricOIQxiZY1iaCKY9/wsSku5KHAUzkNYG9uiyVEs4bF:7JZoQrbTFZY1iaCcdkwcyNYG9uTVp4bF
Malware Config
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 5 api.ipify.org 4 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2528 set thread context of 1956 2528 Estado de cuenta.pdf.exe 32 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Estado de cuenta.pdf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Estado de cuenta.pdf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegSvcs.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1956 RegSvcs.exe 1956 RegSvcs.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 1732 Estado de cuenta.pdf.exe 2528 Estado de cuenta.pdf.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1956 RegSvcs.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 1732 Estado de cuenta.pdf.exe 1732 Estado de cuenta.pdf.exe 2528 Estado de cuenta.pdf.exe 2528 Estado de cuenta.pdf.exe -
Suspicious use of SendNotifyMessage 4 IoCs
pid Process 1732 Estado de cuenta.pdf.exe 1732 Estado de cuenta.pdf.exe 2528 Estado de cuenta.pdf.exe 2528 Estado de cuenta.pdf.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1956 RegSvcs.exe -
Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 1732 wrote to memory of 1448 1732 Estado de cuenta.pdf.exe 30 PID 1732 wrote to memory of 1448 1732 Estado de cuenta.pdf.exe 30 PID 1732 wrote to memory of 1448 1732 Estado de cuenta.pdf.exe 30 PID 1732 wrote to memory of 1448 1732 Estado de cuenta.pdf.exe 30 PID 1732 wrote to memory of 1448 1732 Estado de cuenta.pdf.exe 30 PID 1732 wrote to memory of 1448 1732 Estado de cuenta.pdf.exe 30 PID 1732 wrote to memory of 1448 1732 Estado de cuenta.pdf.exe 30 PID 1732 wrote to memory of 2528 1732 Estado de cuenta.pdf.exe 31 PID 1732 wrote to memory of 2528 1732 Estado de cuenta.pdf.exe 31 PID 1732 wrote to memory of 2528 1732 Estado de cuenta.pdf.exe 31 PID 1732 wrote to memory of 2528 1732 Estado de cuenta.pdf.exe 31 PID 2528 wrote to memory of 1956 2528 Estado de cuenta.pdf.exe 32 PID 2528 wrote to memory of 1956 2528 Estado de cuenta.pdf.exe 32 PID 2528 wrote to memory of 1956 2528 Estado de cuenta.pdf.exe 32 PID 2528 wrote to memory of 1956 2528 Estado de cuenta.pdf.exe 32 PID 2528 wrote to memory of 1956 2528 Estado de cuenta.pdf.exe 32 PID 2528 wrote to memory of 1956 2528 Estado de cuenta.pdf.exe 32 PID 2528 wrote to memory of 1956 2528 Estado de cuenta.pdf.exe 32 PID 2528 wrote to memory of 1956 2528 Estado de cuenta.pdf.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\Estado de cuenta.pdf.exe"C:\Users\Admin\AppData\Local\Temp\Estado de cuenta.pdf.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\Estado de cuenta.pdf.exe"2⤵PID:1448
-
-
C:\Users\Admin\AppData\Local\Temp\Estado de cuenta.pdf.exe"C:\Users\Admin\AppData\Local\Temp\Estado de cuenta.pdf.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\Estado de cuenta.pdf.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1956
-
-