Analysis
-
max time kernel
135s -
max time network
136s -
platform
windows10_x64 -
resource
win10 -
submitted
30-06-2020 08:58
Static task
static1
Behavioral task
behavioral1
Sample
invoice - OP234156.exe
Resource
win7v200430
Behavioral task
behavioral2
Sample
invoice - OP234156.exe
Resource
win10
General
-
Target
invoice - OP234156.exe
-
Size
1.0MB
-
MD5
7dd09efa0dbec9e5859058990bae29be
-
SHA1
799c2be5ff5774803b13b3aebaaa292f4cb53e01
-
SHA256
5de19be53ca23befa21883db456fb708b1a47bd399aa93ab5794d6a2ef9aede3
-
SHA512
357436e8139492f1d2cf4429730ce22ce067cf6c031f1c3814f168c4e59e5fdcea3a665395c0116ab52c3e234dcedcf260318d77f952b5dab4d966555e966b28
Malware Config
Extracted
Protocol: smtp- Host:
smtp.yandex.com - Port:
587 - Username:
john5on.muller@yandex.com - Password:
41k2c4yfVG
Signatures
-
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
invoice - OP234156.exeRegSvcs.exeRegSvcs.exepid process 3748 invoice - OP234156.exe 3748 invoice - OP234156.exe 3748 invoice - OP234156.exe 3748 invoice - OP234156.exe 3748 invoice - OP234156.exe 3748 invoice - OP234156.exe 3748 invoice - OP234156.exe 3748 invoice - OP234156.exe 3992 RegSvcs.exe 3992 RegSvcs.exe 1412 RegSvcs.exe 1412 RegSvcs.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 3836 schtasks.exe 1044 schtasks.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Suspicious use of WriteProcessMemory 37 IoCs
Processes:
invoice - OP234156.exeRegSvcs.exedescription pid process target process PID 3748 wrote to memory of 3836 3748 invoice - OP234156.exe schtasks.exe PID 3748 wrote to memory of 3836 3748 invoice - OP234156.exe schtasks.exe PID 3748 wrote to memory of 3836 3748 invoice - OP234156.exe schtasks.exe PID 3748 wrote to memory of 3928 3748 invoice - OP234156.exe RegSvcs.exe PID 3748 wrote to memory of 3928 3748 invoice - OP234156.exe RegSvcs.exe PID 3748 wrote to memory of 3928 3748 invoice - OP234156.exe RegSvcs.exe PID 3748 wrote to memory of 4016 3748 invoice - OP234156.exe RegSvcs.exe PID 3748 wrote to memory of 4016 3748 invoice - OP234156.exe RegSvcs.exe PID 3748 wrote to memory of 4016 3748 invoice - OP234156.exe RegSvcs.exe PID 3748 wrote to memory of 3800 3748 invoice - OP234156.exe RegSvcs.exe PID 3748 wrote to memory of 3800 3748 invoice - OP234156.exe RegSvcs.exe PID 3748 wrote to memory of 3800 3748 invoice - OP234156.exe RegSvcs.exe PID 3748 wrote to memory of 1880 3748 invoice - OP234156.exe RegSvcs.exe PID 3748 wrote to memory of 1880 3748 invoice - OP234156.exe RegSvcs.exe PID 3748 wrote to memory of 1880 3748 invoice - OP234156.exe RegSvcs.exe PID 3748 wrote to memory of 3992 3748 invoice - OP234156.exe RegSvcs.exe PID 3748 wrote to memory of 3992 3748 invoice - OP234156.exe RegSvcs.exe PID 3748 wrote to memory of 3992 3748 invoice - OP234156.exe RegSvcs.exe PID 3748 wrote to memory of 3992 3748 invoice - OP234156.exe RegSvcs.exe PID 3748 wrote to memory of 3992 3748 invoice - OP234156.exe RegSvcs.exe PID 3748 wrote to memory of 3992 3748 invoice - OP234156.exe RegSvcs.exe PID 3748 wrote to memory of 3992 3748 invoice - OP234156.exe RegSvcs.exe PID 3748 wrote to memory of 3992 3748 invoice - OP234156.exe RegSvcs.exe PID 3992 wrote to memory of 1044 3992 RegSvcs.exe schtasks.exe PID 3992 wrote to memory of 1044 3992 RegSvcs.exe schtasks.exe PID 3992 wrote to memory of 1044 3992 RegSvcs.exe schtasks.exe PID 3992 wrote to memory of 1360 3992 RegSvcs.exe RegSvcs.exe PID 3992 wrote to memory of 1360 3992 RegSvcs.exe RegSvcs.exe PID 3992 wrote to memory of 1360 3992 RegSvcs.exe RegSvcs.exe PID 3992 wrote to memory of 1412 3992 RegSvcs.exe RegSvcs.exe PID 3992 wrote to memory of 1412 3992 RegSvcs.exe RegSvcs.exe PID 3992 wrote to memory of 1412 3992 RegSvcs.exe RegSvcs.exe PID 3992 wrote to memory of 1412 3992 RegSvcs.exe RegSvcs.exe PID 3992 wrote to memory of 1412 3992 RegSvcs.exe RegSvcs.exe PID 3992 wrote to memory of 1412 3992 RegSvcs.exe RegSvcs.exe PID 3992 wrote to memory of 1412 3992 RegSvcs.exe RegSvcs.exe PID 3992 wrote to memory of 1412 3992 RegSvcs.exe RegSvcs.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
invoice - OP234156.exeRegSvcs.exedescription pid process target process PID 3748 set thread context of 3992 3748 invoice - OP234156.exe RegSvcs.exe PID 3992 set thread context of 1412 3992 RegSvcs.exe RegSvcs.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
invoice - OP234156.exeRegSvcs.exeRegSvcs.exedescription pid process Token: SeDebugPrivilege 3748 invoice - OP234156.exe Token: SeDebugPrivilege 3992 RegSvcs.exe Token: SeDebugPrivilege 1412 RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\invoice - OP234156.exe"C:\Users\Admin\AppData\Local\Temp\invoice - OP234156.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\wUhohFkzV" /XML "C:\Users\Admin\AppData\Local\Temp\tmp7AF7.tmp"2⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"{path}"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"{path}"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"{path}"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"{path}"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TrbHIOAUntKXQ" /XML "C:\Users\Admin\AppData\Local\Temp\tmp19C.tmp"3⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"{path}"3⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"{path}"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\RegSvcs.exe.log
-
C:\Users\Admin\AppData\Local\Temp\tmp19C.tmp
-
C:\Users\Admin\AppData\Local\Temp\tmp7AF7.tmp
-
memory/1044-4-0x0000000000000000-mapping.dmp
-
memory/1412-6-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1412-7-0x0000000000446A5E-mapping.dmp
-
memory/3836-0-0x0000000000000000-mapping.dmp
-
memory/3992-2-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/3992-3-0x0000000000476A32-mapping.dmp