19df1aeb47dc9b5b9d0b8ac496ea88c16db750b0d1be708b25249f9441cf5986

General

Target
puente-agent-windows-x64/puente-agent.exe
Size 10.5MB
Sample260909-epbtwabl2y
SHA256 19df1aeb47dc9b5b9d0b8ac496ea88c16db750b0d1be708b25249f9441cf5986
MD5 07cb71c0a439bae8684afad6a716e1d6
SHA1 21fc5d3484f15c5030214d31b1df26eb25b0b6ef
SHA512 72cfd7859be2b2c0ea83c52430023709dfe19e2f808d0a6c7954d8a98df3e878b175af130c6014e79265db4d7a07ba612000ddc25c0694036d9598e9cf56550a
SSDEEP 98304:LDZ7RkFW8LqZxnY9ZGJPWnNc8SQBeTQYAxJomVhloTZLWez6s+sfLjuEKU8VCw:LDZmGcBLh2L6ssJ
TLSH
T1EDB63916BA5B98ACD19AC870834A8A775E2130DB1B36B9FF40C445393FA9BF05B3D714
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 2 IoCs

pid	Process
2684	puente-agent.exe
4372	puente-agent.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
5048	icacls.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Discovers running processes 1 TTPs 1 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
4728	tasklist.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Puente\puente-agent.exe	puente-agent.exe
File opened for modification	C:\Program Files\Puente\puente-agent.exe	puente-agent.exe

Launches sc.exe 8 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1356	sc.exe
2088	sc.exe
4272	sc.exe
2116	sc.exe
3184	sc.exe
5088	sc.exe
1200	sc.exe
2064	sc.exe

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT	puente-agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	puente-agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	puente-agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	puente-agent.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4728	tasklist.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4176 wrote to memory of 5048	4176	puente-agent.exe	86
PID 4176 wrote to memory of 1356	4176	puente-agent.exe	87
PID 4176 wrote to memory of 2088	4176	puente-agent.exe	88
PID 4176 wrote to memory of 4272	4176	puente-agent.exe	89
PID 4176 wrote to memory of 2116	4176	puente-agent.exe	90
PID 4176 wrote to memory of 3184	4176	puente-agent.exe	91
PID 4176 wrote to memory of 5088	4176	puente-agent.exe	92
PID 4176 wrote to memory of 1200	4176	puente-agent.exe	93
PID 2684 wrote to memory of 4372	2684	puente-agent.exe	95
PID 4176 wrote to memory of 2064	4176	puente-agent.exe	97
PID 4176 wrote to memory of 4728	4176	puente-agent.exe	99

C:\Users\Admin\AppData\Local\Temp\puente-agent-windows-x64\puente-agent.exe
"C:\Users\Admin\AppData\Local\Temp\puente-agent-windows-x64\puente-agent.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4176
- C:\Windows\system32\icacls.exe
  "icacls" C:\ProgramData\Puente /inheritance:r /grant:r *S-1-5-18:(OI)(CI)F /grant:r *S-1-5-32-544:(OI)(CI)F
  2⤵
  - Modifies file permissions
  PID:5048
- C:\Windows\system32\sc.exe
  "sc" stop Puente
  2⤵
  - Launches sc.exe
  PID:1356
- C:\Windows\system32\sc.exe
  "sc" delete Puente
  2⤵
  - Launches sc.exe
  PID:2088
- C:\Windows\system32\sc.exe
  "sc" create Puente binPath= "\"C:\Program Files\Puente\puente-agent.exe\" --servicio --signal \"wss://signal.sinbuque.online/ws\" --data-dir \"C:\ProgramData\Puente\" --actualizaciones \"https://sinbuque.online/puente-agent.exe.manifiesto.json\"" start= auto type= own obj= LocalSystem DisplayName= "Puente - acceso remoto"
  2⤵
  - Launches sc.exe
  PID:4272
- C:\Windows\system32\sc.exe
  "sc" description Puente "Mantiene el equipo accesible para soporte. En reposo no captura ni transmite nada."
  2⤵
  - Launches sc.exe
  PID:2116
- C:\Windows\system32\sc.exe
  "sc" failure Puente reset= 86400 actions= restart/5000/restart/10000/restart/30000
  2⤵
  - Launches sc.exe
  PID:3184
- C:\Windows\system32\sc.exe
  "sc" failureflag Puente 1
  2⤵
  - Launches sc.exe
  PID:5088
- C:\Windows\system32\sc.exe
  "sc" start Puente
  2⤵
  - Launches sc.exe
  PID:1200
- C:\Windows\system32\sc.exe
  "sc" query Puente
  2⤵
  - Launches sc.exe
  PID:2064
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq puente-agent.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4728

C:\Program Files\Puente\puente-agent.exe
"C:\Program Files\Puente\puente-agent.exe" --servicio --signal "wss://signal.sinbuque.online/ws" --data-dir "C:\ProgramData\Puente" --actualizaciones "https://sinbuque.online/puente-agent.exe.manifiesto.json"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684
- C:\Program Files\Puente\puente-agent.exe
  "C:\Program Files\Puente\puente-agent.exe" --worker --signal "wss://signal.sinbuque.online/ws" --data-dir "C:\ProgramData\Puente" --actualizaciones "https://sinbuque.online/puente-agent.exe.manifiesto.json"
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  PID:4372

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

2

T1569

Service Execution

2

T1569.002

Persistence

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Privilege Escalation

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Defense Evasion

File and Directory Permissions Modification

Impair Defenses

Credential Access

Discovery

Process Discovery

1

T1057

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

1

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

puente-agent.exe

Path C:\Program Files\Puente\puente-agent.exe
Size 10.5MB
SHA256 19df1aeb47dc9b5b9d0b8ac496ea88c16db750b0d1be708b25249f9441cf5986
MD5 07cb71c0a439bae8684afad6a716e1d6
SHA1 21fc5d3484f15c5030214d31b1df26eb25b0b6ef
SHA512 72cfd7859be2b2c0ea83c52430023709dfe19e2f808d0a6c7954d8a98df3e878b175af130c6014e79265db4d7a07ba612000ddc25c0694036d9598e9cf56550a
SSDEEP 98304:LDZ7RkFW8LqZxnY9ZGJPWnNc8SQBeTQYAxJomVhloTZLWez6s+sfLjuEKU8VCw:LDZmGcBLh2L6ssJ
TLSH
T1EDB63916BA5B98ACD19AC870834A8A775E2130DB1B36B9FF40C445393FA9BF05B3D714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

device.key

Path C:\ProgramData\Puente\device.key
Size 32B
SHA256 1d05b63771eefdfeb248b4b3bec7eb8ca6662f1210bcea94e3ba755d0e1a2d6c
MD5 258b33a946a52e813c9233bb3a38fcac
SHA1 5b12b104bce7ec5309c3f892eba5df192537b5ba
SHA512 64741b159c525ca6f585e55015edc92cfe48d31942cf08b921ddc393982655e6abd583f963b7aaabe7c8e289a31700122af9ef6cd4e36d94c1ce7bcff44b5f82
MD5 SHA1 SHA512

Submit Download

device_id

Path C:\ProgramData\Puente\device_id
Size 9B
SHA256 6d4943937d47db7738f9384caf92dff580b1bb5d371c79ad732bb8d06896cd20
MD5 215013caa899ff97906f96629a307115
SHA1 b259cfdc336d71880d4e9439a3cae1f76e0d6f19
SHA512 4537c67cf8d8864fac1dd7f269ab0707d89c20021ede9aa250e90c3ff67cfc6407e2b0ada76db925a8d7a8e529922ec72035432cbea631203c47fa09ce190886
MD5 SHA1 SHA512

Submit Download

unattended.phc

Path C:\ProgramData\Puente\unattended.phc
Size 104B
SHA256 61e26b671924e2043b162dd563e525c1af763e75268299e63f153cab1e7e662b
MD5 aa6162dffbc5aaf2f35f77aec92ad68f
SHA1 1154d49ec7e7ec75af1d95626a0f9a4386fbcc7e
SHA512 870828eb1c387b9a493028f437c7e0eec98b4798d87db7c811d251d4b117f2fe2801862c0596394a435d5ea873bc7f1679ed701b0afa640be7cc29cb1cb68d78
TLSH
T1AEB01278291248B4C46E7181BD058D1B0A549B61070E1DE141E2942A5D14E56E3643CD
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads