Analysis
-
max time kernel
117s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
18-01-2025 01:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jli.dll
Resource
win7-20240903-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
jli.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral3
Sample
ordine OF000531.exe
Resource
win7-20240903-en
windows7-x64
8 signatures
150 seconds
General
-
Target
ordine OF000531.exe
-
Size
33KB
-
MD5
351e2c2351d416773e2c27f0729cea64
-
SHA1
b4341e0440415b236f96c59888caaf006c37d6ef
-
SHA256
f7ee2ce039911db34567db0eda4471a5414831959f0d047e422ee7f3a5370a72
-
SHA512
55cf4e7d1f2840e97c96615cfda684780fa4501643817b72b51cd9b95478f0e4806230c7e53bcf2ef3e4ef0358248c26cc5476ec33ec823142576e664c619b7b
-
SSDEEP
384:e8fXF1QjKF5WE4C5AqxPOUkpqmAM+o/8E9VF0NycyztxPOUYXaxWvAM+o/8E9VFf:91lFc7C53MamAMxkEttMcyAMxkElGO
Malware Config
Extracted
Family
agenttesla
Credentials
Protocol: ftp- Host:
ftp://ftp.transotraval.cl - Port:
21 - Username:
[email protected] - Password:
vIZ2P]dt&a!d
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Agenttesla family
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 5 ip-api.com 6 ip-api.com -
Suspicious use of SetThreadContext 5 IoCs
description pid Process procid_target PID 2252 set thread context of 2092 2252 ordine OF000531.exe 32 PID 2252 set thread context of 2372 2252 ordine OF000531.exe 33 PID 2252 set thread context of 2844 2252 ordine OF000531.exe 35 PID 2252 set thread context of 2660 2252 ordine OF000531.exe 36 PID 2252 set thread context of 784 2252 ordine OF000531.exe 37 -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AddInProcess32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AddInProcess32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language installutil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AddInProcess32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AddInProcess32.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 784 AddInProcess32.exe 2092 AddInProcess32.exe 2844 installutil.exe 2372 AddInProcess32.exe 784 AddInProcess32.exe 2092 AddInProcess32.exe 2844 installutil.exe 2372 AddInProcess32.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 784 AddInProcess32.exe Token: SeDebugPrivilege 2092 AddInProcess32.exe Token: SeDebugPrivilege 2844 installutil.exe Token: SeDebugPrivilege 2372 AddInProcess32.exe Token: SeDebugPrivilege 2660 AddInProcess32.exe -
Suspicious use of WriteProcessMemory 52 IoCs
description pid Process procid_target PID 2252 wrote to memory of 2092 2252 ordine OF000531.exe 32 PID 2252 wrote to memory of 2092 2252 ordine OF000531.exe 32 PID 2252 wrote to memory of 2092 2252 ordine OF000531.exe 32 PID 2252 wrote to memory of 2092 2252 ordine OF000531.exe 32 PID 2252 wrote to memory of 2092 2252 ordine OF000531.exe 32 PID 2252 wrote to memory of 2092 2252 ordine OF000531.exe 32 PID 2252 wrote to memory of 2092 2252 ordine OF000531.exe 32 PID 2252 wrote to memory of 2092 2252 ordine OF000531.exe 32 PID 2252 wrote to memory of 2092 2252 ordine OF000531.exe 32 PID 2252 wrote to memory of 2372 2252 ordine OF000531.exe 33 PID 2252 wrote to memory of 2372 2252 ordine OF000531.exe 33 PID 2252 wrote to memory of 2372 2252 ordine OF000531.exe 33 PID 2252 wrote to memory of 2372 2252 ordine OF000531.exe 33 PID 2252 wrote to memory of 2372 2252 ordine OF000531.exe 33 PID 2252 wrote to memory of 2372 2252 ordine OF000531.exe 33 PID 2252 wrote to memory of 2372 2252 ordine OF000531.exe 33 PID 2252 wrote to memory of 2372 2252 ordine OF000531.exe 33 PID 2252 wrote to memory of 2372 2252 ordine OF000531.exe 33 PID 2252 wrote to memory of 1764 2252 ordine OF000531.exe 34 PID 2252 wrote to memory of 1764 2252 ordine OF000531.exe 34 PID 2252 wrote to memory of 1764 2252 ordine OF000531.exe 34 PID 2252 wrote to memory of 1764 2252 ordine OF000531.exe 34 PID 2252 wrote to memory of 2844 2252 ordine OF000531.exe 35 PID 2252 wrote to memory of 2844 2252 ordine OF000531.exe 35 PID 2252 wrote to memory of 2844 2252 ordine OF000531.exe 35 PID 2252 wrote to memory of 2844 2252 ordine OF000531.exe 35 PID 2252 wrote to memory of 2844 2252 ordine OF000531.exe 35 PID 2252 wrote to memory of 2844 2252 ordine OF000531.exe 35 PID 2252 wrote to memory of 2844 2252 ordine OF000531.exe 35 PID 2252 wrote to memory of 2844 2252 ordine OF000531.exe 35 PID 2252 wrote to memory of 2844 2252 ordine OF000531.exe 35 PID 2252 wrote to memory of 2844 2252 ordine OF000531.exe 35 PID 2252 wrote to memory of 2844 2252 ordine OF000531.exe 35 PID 2252 wrote to memory of 2844 2252 ordine OF000531.exe 35 PID 2252 wrote to memory of 2660 2252 ordine OF000531.exe 36 PID 2252 wrote to memory of 2660 2252 ordine OF000531.exe 36 PID 2252 wrote to memory of 2660 2252 ordine OF000531.exe 36 PID 2252 wrote to memory of 2660 2252 ordine OF000531.exe 36 PID 2252 wrote to memory of 2660 2252 ordine OF000531.exe 36 PID 2252 wrote to memory of 2660 2252 ordine OF000531.exe 36 PID 2252 wrote to memory of 2660 2252 ordine OF000531.exe 36 PID 2252 wrote to memory of 2660 2252 ordine OF000531.exe 36 PID 2252 wrote to memory of 2660 2252 ordine OF000531.exe 36 PID 2252 wrote to memory of 784 2252 ordine OF000531.exe 37 PID 2252 wrote to memory of 784 2252 ordine OF000531.exe 37 PID 2252 wrote to memory of 784 2252 ordine OF000531.exe 37 PID 2252 wrote to memory of 784 2252 ordine OF000531.exe 37 PID 2252 wrote to memory of 784 2252 ordine OF000531.exe 37 PID 2252 wrote to memory of 784 2252 ordine OF000531.exe 37 PID 2252 wrote to memory of 784 2252 ordine OF000531.exe 37 PID 2252 wrote to memory of 784 2252 ordine OF000531.exe 37 PID 2252 wrote to memory of 784 2252 ordine OF000531.exe 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\ordine OF000531.exe"C:\Users\Admin\AppData\Local\Temp\ordine OF000531.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2092
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2372
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"2⤵PID:1764
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2844
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2660
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:784
-