Overview

overview

10

Static

static

1

Comprobant...789.7z

windows7-x64

10

Comprobant...789.7z

windows10-2004-x64

1

Analysis

  • max time kernel
    57s
  • max time network
    62s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    22-01-2025 22:32

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Comprobante_swift_9767864574756346523cc43546576ds8977564534253465789.7z

  • Size

    791KB

  • MD5

    eefe9cb1da2c5dc85184e4f47e5550bb

  • SHA1

    062563762fa1051449405812ae257dddb4c6694c

  • SHA256

    e446ae2fc3adac5f36700dc6c69efb421a569266cae84742e7027d6c980a0f6e

  • SHA512

    f085850f6402b957a7f048284131d7e4f3e696d5b6b4b4609bea1d93f61805af0451dc942fb24ee585b3e892c906284e13d5a95fc6097cb4253c2669f9bc3a44

  • SSDEEP

    12288:XpUqUQJx5t42kZqfYt6J5EquI6jDsjPeJA7hJDwN0Brp/Uga6ZRxzZ6ls6Gbpj:ZpUe5ePqfBjJj/hXZ9Uga6RxsGbpj

Score
10/10
agenttesladiscoverykeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     ftp
  • Host:
    ftp://ftp.controlfire.com.mx
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    0a4XlE=4t8mz

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla
  • Agenttesla family
    agenttesla
  • Executes dropped EXE 5 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 5 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 19 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of FindShellTrayWindow 6 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 60 IoCs

Processes

  • C:\Program Files\7-Zip\7zFM.exe
    "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Comprobante_swift_9767864574756346523cc43546576ds8977564534253465789.7z"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:1628
    • C:\Users\Admin\AppData\Local\Temp\7zOC56ABEF7\Comprobante_swift_9767864574756346523cc43546576ds8977564534253465789.exe
      "C:\Users\Admin\AppData\Local\Temp\7zOC56ABEF7\Comprobante_swift_9767864574756346523cc43546576ds8977564534253465789.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:584
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2524
    • C:\Users\Admin\AppData\Local\Temp\7zOC5625DF7\Comprobante_swift_9767864574756346523cc43546576ds8977564534253465789.exe
      "C:\Users\Admin\AppData\Local\Temp\7zOC5625DF7\Comprobante_swift_9767864574756346523cc43546576ds8977564534253465789.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3048
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2248
    • C:\Users\Admin\AppData\Local\Temp\7zOC5644308\Comprobante_swift_9767864574756346523cc43546576ds8977564534253465789.exe
      "C:\Users\Admin\AppData\Local\Temp\7zOC5644308\Comprobante_swift_9767864574756346523cc43546576ds8977564534253465789.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2860
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2408
    • C:\Users\Admin\AppData\Local\Temp\7zOC564C008\Comprobante_swift_9767864574756346523cc43546576ds8977564534253465789.exe
      "C:\Users\Admin\AppData\Local\Temp\7zOC564C008\Comprobante_swift_9767864574756346523cc43546576ds8977564534253465789.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:840
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2384
    • C:\Users\Admin\AppData\Local\Temp\7zOC5698448\Comprobante_swift_9767864574756346523cc43546576ds8977564534253465789.exe
      "C:\Users\Admin\AppData\Local\Temp\7zOC5698448\Comprobante_swift_9767864574756346523cc43546576ds8977564534253465789.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2544
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2056

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\7zOC56ABEF7\Comprobante_swift_9767864574756346523cc43546576ds8977564534253465789.exe
    Filesize

    2.5MB

    MD5

    70de418c59709a8703cb46deee36bde6

    SHA1

    69ca92a03fc7d986f686c0acafc51dcf515c2f7c

    SHA256

    9da74e41306059077f155debea5f44a5969e79297c9de44a4e355e4bb68b0536

    SHA512

    cbeedd7aa302b1db4de7608f8f0c35aec37c38421979b6ae43eb759e13129b1e5343e343ebe0910cb8290fb91200a91fd7796a61aaac9e09c271dbdc352ca315

    Download Submit

  • memory/2248-64-0x0000000000400000-0x0000000000447000-memory.dmp

    Filesize

    284KB

    Download

  • memory/2248-62-0x0000000000400000-0x0000000000447000-memory.dmp

    Filesize

    284KB

    Download

  • memory/2248-65-0x0000000000400000-0x0000000000447000-memory.dmp

    Filesize

    284KB

    Download

  • memory/2248-70-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

    Download