Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    94s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/01/2025, 01:06 UTC

General

  • Target

    orden de compra_765645343465789675764567845768795764.exe

  • Size

    2.4MB

  • MD5

    038582cff59bd7c92aa1d71b8ac632c7

  • SHA1

    ff4bfdc38ab995019c8685ea4bc63951e5f370ee

  • SHA256

    9b688c5929cea65ae3f69a22b3780fa3f45b434fce94a9ccd39392b8dc7003b5

  • SHA512

    6e72be1e887a305ae4636b063b9438a0c0cfe667387a235960f57b0853973a23e426508aeef9adc6891e6536a1c3bf2c41b00961f6aad32e0eb2f2b7d2f82a33

  • SSDEEP

    49152:dbdYAm4zEbdYAm4zXbdYAm4zKbdYAm4zFbdYAm4zB3An3AI3AJ3Aa:ddrWdrrdrAdr1drlA3AaAtAa

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    ftp
  • Host:
    ftp://ftp.fosna.net
  • Port:
    21
  • Username:
    madamweb@fosna.net
  • Password:
    =A+N^@~c]~#I

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Agenttesla family
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\orden de compra_765645343465789675764567845768795764.exe
    "C:\Users\Admin\AppData\Local\Temp\orden de compra_765645343465789675764567845768795764.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3044
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
      2⤵
        PID:2652
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4212

    Network

    • flag-us
      DNS
      8.8.8.8.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      8.8.8.8.in-addr.arpa
      IN PTR
      Response
      8.8.8.8.in-addr.arpa
      IN PTR
      dnsgoogle
    • flag-us
      DNS
      28.118.140.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      28.118.140.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      133.130.81.91.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      133.130.81.91.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      68.32.126.40.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      68.32.126.40.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      167.173.78.104.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      167.173.78.104.in-addr.arpa
      IN PTR
      Response
      167.173.78.104.in-addr.arpa
      IN PTR
      a104-78-173-167deploystaticakamaitechnologiescom
    • flag-us
      DNS
      ip-api.com
      regasm.exe
      Remote address:
      8.8.8.8:53
      Request
      ip-api.com
      IN A
      Response
      ip-api.com
      IN A
      208.95.112.1
    • flag-us
      GET
      http://ip-api.com/line/?fields=hosting
      regasm.exe
      Remote address:
      208.95.112.1:80
      Request
      GET /line/?fields=hosting HTTP/1.1
      Host: ip-api.com
      Connection: Keep-Alive
      Response
      HTTP/1.1 200 OK
      Date: Tue, 14 Jan 2025 01:06:28 GMT
      Content-Type: text/plain; charset=utf-8
      Content-Length: 6
      Access-Control-Allow-Origin: *
      X-Ttl: 60
      X-Rl: 44
    • flag-us
      DNS
      1.112.95.208.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      1.112.95.208.in-addr.arpa
      IN PTR
      Response
      1.112.95.208.in-addr.arpa
      IN PTR
      ip-apicom
    • flag-us
      DNS
      196.249.167.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      196.249.167.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      56.163.245.4.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      56.163.245.4.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      198.187.3.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      198.187.3.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      134.71.91.104.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      134.71.91.104.in-addr.arpa
      IN PTR
      Response
      134.71.91.104.in-addr.arpa
      IN PTR
      a104-91-71-134deploystaticakamaitechnologiescom
    • flag-us
      DNS
      8.153.16.2.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      8.153.16.2.in-addr.arpa
      IN PTR
      Response
      8.153.16.2.in-addr.arpa
      IN PTR
      a2-16-153-8deploystaticakamaitechnologiescom
    • flag-us
      DNS
      14.227.111.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      14.227.111.52.in-addr.arpa
      IN PTR
      Response
    • 208.95.112.1:80
      http://ip-api.com/line/?fields=hosting
      http
      regasm.exe
      310 B
      347 B
      5
      4

      HTTP Request

      GET http://ip-api.com/line/?fields=hosting

      HTTP Response

      200
    • 8.8.8.8:53
      8.8.8.8.in-addr.arpa
      dns
      66 B
      90 B
      1
      1

      DNS Request

      8.8.8.8.in-addr.arpa

    • 8.8.8.8:53
      28.118.140.52.in-addr.arpa
      dns
      72 B
      158 B
      1
      1

      DNS Request

      28.118.140.52.in-addr.arpa

    • 8.8.8.8:53
      133.130.81.91.in-addr.arpa
      dns
      72 B
      147 B
      1
      1

      DNS Request

      133.130.81.91.in-addr.arpa

    • 8.8.8.8:53
      68.32.126.40.in-addr.arpa
      dns
      71 B
      157 B
      1
      1

      DNS Request

      68.32.126.40.in-addr.arpa

    • 8.8.8.8:53
      167.173.78.104.in-addr.arpa
      dns
      73 B
      139 B
      1
      1

      DNS Request

      167.173.78.104.in-addr.arpa

    • 8.8.8.8:53
      ip-api.com
      dns
      regasm.exe
      56 B
      72 B
      1
      1

      DNS Request

      ip-api.com

      DNS Response

      208.95.112.1

    • 8.8.8.8:53
      1.112.95.208.in-addr.arpa
      dns
      71 B
      95 B
      1
      1

      DNS Request

      1.112.95.208.in-addr.arpa

    • 8.8.8.8:53
      196.249.167.52.in-addr.arpa
      dns
      73 B
      147 B
      1
      1

      DNS Request

      196.249.167.52.in-addr.arpa

    • 8.8.8.8:53
      56.163.245.4.in-addr.arpa
      dns
      71 B
      157 B
      1
      1

      DNS Request

      56.163.245.4.in-addr.arpa

    • 8.8.8.8:53
      198.187.3.20.in-addr.arpa
      dns
      71 B
      157 B
      1
      1

      DNS Request

      198.187.3.20.in-addr.arpa

    • 8.8.8.8:53
      134.71.91.104.in-addr.arpa
      dns
      72 B
      137 B
      1
      1

      DNS Request

      134.71.91.104.in-addr.arpa

    • 8.8.8.8:53
      8.153.16.2.in-addr.arpa
      dns
      69 B
      131 B
      1
      1

      DNS Request

      8.153.16.2.in-addr.arpa

    • 8.8.8.8:53
      14.227.111.52.in-addr.arpa
      dns
      72 B
      158 B
      1
      1

      DNS Request

      14.227.111.52.in-addr.arpa

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/3044-43-0x0000000002BF0000-0x0000000002BF8000-memory.dmp

      Filesize

      32KB

    • memory/3044-3-0x0000000002260000-0x0000000002261000-memory.dmp

      Filesize

      4KB

    • memory/3044-8-0x0000000000460000-0x0000000000560000-memory.dmp

      Filesize

      1024KB

    • memory/3044-9-0x0000000075681000-0x0000000075682000-memory.dmp

      Filesize

      4KB

    • memory/3044-10-0x0000000075650000-0x00000000757AD000-memory.dmp

      Filesize

      1.4MB

    • memory/3044-47-0x0000000075650000-0x00000000757AD000-memory.dmp

      Filesize

      1.4MB

    • memory/3044-2-0x0000000077A02000-0x0000000077A03000-memory.dmp

      Filesize

      4KB

    • memory/3044-39-0x0000000075650000-0x00000000757AD000-memory.dmp

      Filesize

      1.4MB

    • memory/4212-44-0x00000000747CE000-0x00000000747CF000-memory.dmp

      Filesize

      4KB

    • memory/4212-42-0x0000000001270000-0x0000000001271000-memory.dmp

      Filesize

      4KB

    • memory/4212-40-0x0000000000400000-0x0000000000447000-memory.dmp

      Filesize

      284KB

    • memory/4212-45-0x0000000000400000-0x0000000000442000-memory.dmp

      Filesize

      264KB

    • memory/4212-46-0x0000000005EE0000-0x0000000006484000-memory.dmp

      Filesize

      5.6MB

    • memory/4212-41-0x0000000077A02000-0x0000000077A03000-memory.dmp

      Filesize

      4KB

    • memory/4212-48-0x0000000005930000-0x0000000005996000-memory.dmp

      Filesize

      408KB

    • memory/4212-49-0x00000000747C0000-0x0000000074F70000-memory.dmp

      Filesize

      7.7MB

    • memory/4212-50-0x0000000006BA0000-0x0000000006BF0000-memory.dmp

      Filesize

      320KB

    • memory/4212-51-0x0000000006C90000-0x0000000006D22000-memory.dmp

      Filesize

      584KB

    • memory/4212-52-0x0000000006C30000-0x0000000006C3A000-memory.dmp

      Filesize

      40KB

    • memory/4212-53-0x00000000747CE000-0x00000000747CF000-memory.dmp

      Filesize

      4KB

    • memory/4212-54-0x00000000747C0000-0x0000000074F70000-memory.dmp

      Filesize

      7.7MB

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.