Analysis
-
max time kernel
140s -
max time network
146s -
platform
windows7_x64 -
resource
win7 -
submitted
07-07-2020 21:51
Static task
static1
Behavioral task
behavioral1
Sample
Payment Advice.exe
Resource
win7
Behavioral task
behavioral2
Sample
Payment Advice.exe
Resource
win10v200430
General
-
Target
Payment Advice.exe
-
Size
827KB
-
MD5
6846e1d5a6d02a9b967ca1bd18ef6ba8
-
SHA1
7d645454a187ba2914e5cab6bb83db0a20615fa5
-
SHA256
528f29b705ad29a6e607a93fe7f16ddd4725f19f0e9d32cbc505f14d20a52787
-
SHA512
53696492fe9a25d7f07e208b489c14235b1180e830282ab52da54ced3322b78c6ae10025404965f271c902669545fd1df4e226652e72670330dcf98bf992ae6f
Malware Config
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
Payment Advice.exedescription pid process target process PID 1044 set thread context of 1324 1044 Payment Advice.exe Payment Advice.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
Payment Advice.exePayment Advice.exepid process 1044 Payment Advice.exe 1324 Payment Advice.exe 1324 Payment Advice.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Payment Advice.exepid process 1324 Payment Advice.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
Payment Advice.exedescription pid process target process PID 1044 wrote to memory of 620 1044 Payment Advice.exe Payment Advice.exe PID 1044 wrote to memory of 620 1044 Payment Advice.exe Payment Advice.exe PID 1044 wrote to memory of 620 1044 Payment Advice.exe Payment Advice.exe PID 1044 wrote to memory of 620 1044 Payment Advice.exe Payment Advice.exe PID 1044 wrote to memory of 1324 1044 Payment Advice.exe Payment Advice.exe PID 1044 wrote to memory of 1324 1044 Payment Advice.exe Payment Advice.exe PID 1044 wrote to memory of 1324 1044 Payment Advice.exe Payment Advice.exe PID 1044 wrote to memory of 1324 1044 Payment Advice.exe Payment Advice.exe PID 1044 wrote to memory of 1324 1044 Payment Advice.exe Payment Advice.exe PID 1044 wrote to memory of 1324 1044 Payment Advice.exe Payment Advice.exe PID 1044 wrote to memory of 1324 1044 Payment Advice.exe Payment Advice.exe PID 1044 wrote to memory of 1324 1044 Payment Advice.exe Payment Advice.exe PID 1044 wrote to memory of 1324 1044 Payment Advice.exe Payment Advice.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Payment Advice.exePayment Advice.exedescription pid process Token: SeDebugPrivilege 1044 Payment Advice.exe Token: SeDebugPrivilege 1324 Payment Advice.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Payment Advice.exe"C:\Users\Admin\AppData\Local\Temp\Payment Advice.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\Payment Advice.exe"{path}"2⤵PID:620
-
C:\Users\Admin\AppData\Local\Temp\Payment Advice.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of AdjustPrivilegeToken
PID:1324