Analysis
-
max time kernel
67s -
max time network
54s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
28-04-2024 01:27
Static task
static1
Behavioral task
behavioral1
Sample
Payment details.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Payment details.exe
Resource
win10v2004-20240419-en
General
-
Target
Payment details.exe
-
Size
706KB
-
MD5
d88a9970ec7a11ade4a6dfc3d8150496
-
SHA1
90e72afbb1eed4c0f20fbc8a7ef5e3069ece0eef
-
SHA256
c159014c79f8dc4d7888b0c092286f9b47fb2b1497dfbfa7c0620d78257127e2
-
SHA512
54596967f17980e34528c20a2b284edcd03c02dd105d904600cb4e48816b560c201371b2f202db962a1df37dca310dd4a82ed08ab12683ccde74dd404d0a1af2
-
SSDEEP
12288:GTn3D0uf8+u0wrXN/HoX18jyU0rOcKdIXxIlmQockPZS+/I6YtMl0:Az0uf8+1wriF8grBkIhIlmQocz+/TmM
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.teddyjnr.com - Port:
587 - Username:
cs2@teddyjnr.com - Password:
Lisa#2022! - Email To:
successbright053@gmail.com
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 7 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Payment details.exedescription pid process target process PID 4872 set thread context of 1608 4872 Payment details.exe Payment details.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
Payment details.exePayment details.exepid process 4872 Payment details.exe 4872 Payment details.exe 4872 Payment details.exe 4872 Payment details.exe 4872 Payment details.exe 1608 Payment details.exe 1608 Payment details.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Payment details.exePayment details.exedescription pid process Token: SeDebugPrivilege 4872 Payment details.exe Token: SeDebugPrivilege 1608 Payment details.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
Payment details.exedescription pid process target process PID 4872 wrote to memory of 3264 4872 Payment details.exe Payment details.exe PID 4872 wrote to memory of 3264 4872 Payment details.exe Payment details.exe PID 4872 wrote to memory of 3264 4872 Payment details.exe Payment details.exe PID 4872 wrote to memory of 1608 4872 Payment details.exe Payment details.exe PID 4872 wrote to memory of 1608 4872 Payment details.exe Payment details.exe PID 4872 wrote to memory of 1608 4872 Payment details.exe Payment details.exe PID 4872 wrote to memory of 1608 4872 Payment details.exe Payment details.exe PID 4872 wrote to memory of 1608 4872 Payment details.exe Payment details.exe PID 4872 wrote to memory of 1608 4872 Payment details.exe Payment details.exe PID 4872 wrote to memory of 1608 4872 Payment details.exe Payment details.exe PID 4872 wrote to memory of 1608 4872 Payment details.exe Payment details.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Payment details.exe"C:\Users\Admin\AppData\Local\Temp\Payment details.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Payment details.exe"C:\Users\Admin\AppData\Local\Temp\Payment details.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Payment details.exe"C:\Users\Admin\AppData\Local\Temp\Payment details.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Payment details.exe.logFilesize
1KB
MD58ec831f3e3a3f77e4a7b9cd32b48384c
SHA1d83f09fd87c5bd86e045873c231c14836e76a05c
SHA2567667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982
SHA51226bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3
-
memory/1608-12-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/1608-21-0x0000000005910000-0x0000000005920000-memory.dmpFilesize
64KB
-
memory/1608-20-0x00000000746F0000-0x0000000074EA0000-memory.dmpFilesize
7.7MB
-
memory/1608-19-0x0000000007100000-0x0000000007150000-memory.dmpFilesize
320KB
-
memory/1608-17-0x0000000005A60000-0x0000000005AC6000-memory.dmpFilesize
408KB
-
memory/1608-15-0x00000000746F0000-0x0000000074EA0000-memory.dmpFilesize
7.7MB
-
memory/1608-16-0x0000000005910000-0x0000000005920000-memory.dmpFilesize
64KB
-
memory/4872-5-0x0000000004DD0000-0x0000000004DDA000-memory.dmpFilesize
40KB
-
memory/4872-9-0x0000000005390000-0x00000000053A4000-memory.dmpFilesize
80KB
-
memory/4872-10-0x0000000009DE0000-0x0000000009E62000-memory.dmpFilesize
520KB
-
memory/4872-11-0x000000000CF00000-0x000000000CF9C000-memory.dmpFilesize
624KB
-
memory/4872-8-0x0000000005000000-0x000000000500E000-memory.dmpFilesize
56KB
-
memory/4872-7-0x0000000004FB0000-0x0000000004FC8000-memory.dmpFilesize
96KB
-
memory/4872-6-0x0000000005F50000-0x0000000005FEE000-memory.dmpFilesize
632KB
-
memory/4872-0-0x0000000000270000-0x0000000000326000-memory.dmpFilesize
728KB
-
memory/4872-4-0x0000000004D00000-0x0000000004D10000-memory.dmpFilesize
64KB
-
memory/4872-18-0x00000000746F0000-0x0000000074EA0000-memory.dmpFilesize
7.7MB
-
memory/4872-3-0x0000000004D20000-0x0000000004DB2000-memory.dmpFilesize
584KB
-
memory/4872-2-0x00000000053A0000-0x0000000005944000-memory.dmpFilesize
5.6MB
-
memory/4872-1-0x00000000746F0000-0x0000000074EA0000-memory.dmpFilesize
7.7MB