Analysis
-
max time kernel
94s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
17-09-2024 08:40
Static task
static1
Behavioral task
behavioral1
Sample
Estado de cuenta.pdf.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
Estado de cuenta.pdf.exe
Resource
win10v2004-20240802-en
General
-
Target
Estado de cuenta.pdf.exe
-
Size
1.3MB
-
MD5
92fe200abe5cd92b7766757b6d9fff86
-
SHA1
29837c6390325443c30227df4fbe3f28618dff77
-
SHA256
58672267ca553d53165e5f5318bf7c492d5378730a0857547543e8efe42c110e
-
SHA512
05355588a91e64b5833ea92c8cdd5845e42a45dd3cebc506dfc793b6e4b7b5078628835720c9af8527f8308c383c0aa46b7129a35ebfa1f12bf14f4691f25800
-
SSDEEP
24576:uRmJkcoQricOIQxiZY1iaCKY9/wsSku5KHAUzkNYG9uiyVEs4bF:7JZoQrbTFZY1iaCcdkwcyNYG9uTVp4bF
Malware Config
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 13 api.ipify.org 14 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 684 set thread context of 1620 684 Estado de cuenta.pdf.exe 82 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Estado de cuenta.pdf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegSvcs.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1620 RegSvcs.exe 1620 RegSvcs.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 684 Estado de cuenta.pdf.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1620 RegSvcs.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 684 Estado de cuenta.pdf.exe 684 Estado de cuenta.pdf.exe -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 684 Estado de cuenta.pdf.exe 684 Estado de cuenta.pdf.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 684 wrote to memory of 1620 684 Estado de cuenta.pdf.exe 82 PID 684 wrote to memory of 1620 684 Estado de cuenta.pdf.exe 82 PID 684 wrote to memory of 1620 684 Estado de cuenta.pdf.exe 82 PID 684 wrote to memory of 1620 684 Estado de cuenta.pdf.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\Estado de cuenta.pdf.exe"C:\Users\Admin\AppData\Local\Temp\Estado de cuenta.pdf.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:684 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\Estado de cuenta.pdf.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1620
-