Analysis
-
max time kernel
109s -
max time network
132s -
platform
windows10_x64 -
resource
win10v200430 -
submitted
07-07-2020 21:50
Static task
static1
Behavioral task
behavioral1
Sample
Payment Advice.exe
Resource
win7
Behavioral task
behavioral2
Sample
Payment Advice.exe
Resource
win10v200430
General
-
Target
Payment Advice.exe
-
Size
827KB
-
MD5
6846e1d5a6d02a9b967ca1bd18ef6ba8
-
SHA1
7d645454a187ba2914e5cab6bb83db0a20615fa5
-
SHA256
528f29b705ad29a6e607a93fe7f16ddd4725f19f0e9d32cbc505f14d20a52787
-
SHA512
53696492fe9a25d7f07e208b489c14235b1180e830282ab52da54ced3322b78c6ae10025404965f271c902669545fd1df4e226652e72670330dcf98bf992ae6f
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.yandex.ru - Port:
587 - Username:
[email protected] - Password:
Blessing123
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/2648-1-0x0000000000446FBE-mapping.dmp family_agenttesla behavioral2/memory/2648-0-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
Payment Advice.exedescription pid process target process PID 2416 set thread context of 2648 2416 Payment Advice.exe Payment Advice.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
Payment Advice.exepid process 2648 Payment Advice.exe 2648 Payment Advice.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Payment Advice.exedescription pid process Token: SeDebugPrivilege 2648 Payment Advice.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Payment Advice.exepid process 2648 Payment Advice.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
Payment Advice.exedescription pid process target process PID 2416 wrote to memory of 2648 2416 Payment Advice.exe Payment Advice.exe PID 2416 wrote to memory of 2648 2416 Payment Advice.exe Payment Advice.exe PID 2416 wrote to memory of 2648 2416 Payment Advice.exe Payment Advice.exe PID 2416 wrote to memory of 2648 2416 Payment Advice.exe Payment Advice.exe PID 2416 wrote to memory of 2648 2416 Payment Advice.exe Payment Advice.exe PID 2416 wrote to memory of 2648 2416 Payment Advice.exe Payment Advice.exe PID 2416 wrote to memory of 2648 2416 Payment Advice.exe Payment Advice.exe PID 2416 wrote to memory of 2648 2416 Payment Advice.exe Payment Advice.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Payment Advice.exe"C:\Users\Admin\AppData\Local\Temp\Payment Advice.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\Payment Advice.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2648
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
ef140ef600b2463c9e7dbf064a104046
SHA1c08fd1853877be95575ea2e860dd8cafef31f54c
SHA256ad8ae97fdeb174b20f02c7ddf9466981856d77d51133599b5954f48f78a1b616
SHA512bf16df0994080bdc832cb39a312e0095de57608256fcf0d04d589e0bdf3283f918fb0d6ec86ea28a4b1af6db12813c52a724028f02330ebc3a9d32a4fcda706c