Analysis
-
max time kernel
147s -
max time network
137s -
platform
windows10_x64 -
resource
win10v200430 -
submitted
07-07-2020 08:26
Static task
static1
Behavioral task
behavioral1
Sample
Remittance advice.exe
Resource
win7
Behavioral task
behavioral2
Sample
Remittance advice.exe
Resource
win10v200430
General
-
Target
Remittance advice.exe
-
Size
803KB
-
MD5
be9f6ec429298296531aef4e8813679c
-
SHA1
f46d168675ed61ded4d5030ad25b5107d5252efd
-
SHA256
c45cbf7de196d50a6eb860e3d8dbfdf8f3699c3e62df58f63bd1c6c176c9ead1
-
SHA512
8ee7421a05ac4c8f5b131ce57e2657d1128a8d0332be62ad42eb2850e04de85c9b177075f0dac51f5f308285843d534674f733d91a414bdfb43ecd6612db935a
Malware Config
Extracted
Protocol: smtp- Host:
smtp.bnb-spa.com - Port:
587 - Username:
[email protected] - Password:
hope2020
Signatures
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
Remittance advice.exedescription pid process target process PID 2532 wrote to memory of 2812 2532 Remittance advice.exe notepad.exe PID 2532 wrote to memory of 2812 2532 Remittance advice.exe notepad.exe PID 2532 wrote to memory of 2812 2532 Remittance advice.exe notepad.exe PID 2532 wrote to memory of 2812 2532 Remittance advice.exe notepad.exe PID 2532 wrote to memory of 2812 2532 Remittance advice.exe notepad.exe PID 2532 wrote to memory of 2876 2532 Remittance advice.exe Remittance advice.exe PID 2532 wrote to memory of 2876 2532 Remittance advice.exe Remittance advice.exe PID 2532 wrote to memory of 2876 2532 Remittance advice.exe Remittance advice.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
Processes:
resource yara_rule behavioral2/memory/2876-1-0x0000000000400000-0x00000000004B1000-memory.dmp upx behavioral2/memory/2876-3-0x0000000000400000-0x00000000004B1000-memory.dmp upx behavioral2/memory/2876-4-0x0000000000400000-0x00000000004B1000-memory.dmp upx -
Drops startup file 1 IoCs
Processes:
notepad.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bv.vbs notepad.exe -
Adds Run entry to start application 2 TTPs 1 IoCs
Processes:
Remittance advice.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\Run\Mymp4 = "C:\\Users\\Admin\\AppData\\Roaming\\Mymp4\\Mymp4.exe" Remittance advice.exe -
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
Remittance advice.exeRemittance advice.exepid process 2532 Remittance advice.exe 2532 Remittance advice.exe 2876 Remittance advice.exe 2876 Remittance advice.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
Remittance advice.exepid process 2532 Remittance advice.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Remittance advice.exedescription pid process target process PID 2532 set thread context of 2876 2532 Remittance advice.exe Remittance advice.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Remittance advice.exedescription pid process Token: SeDebugPrivilege 2876 Remittance advice.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Remittance advice.exe"C:\Users\Admin\AppData\Local\Temp\Remittance advice.exe"1⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"2⤵
- Drops startup file
-
C:\Users\Admin\AppData\Local\Temp\Remittance advice.exe"C:\Users\Admin\AppData\Local\Temp\Remittance advice.exe"2⤵
- Adds Run entry to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2812-0-0x0000000000000000-mapping.dmp
-
memory/2876-1-0x0000000000400000-0x00000000004B1000-memory.dmpFilesize
708KB
-
memory/2876-2-0x00000000004AEEF0-mapping.dmp
-
memory/2876-3-0x0000000000400000-0x00000000004B1000-memory.dmpFilesize
708KB
-
memory/2876-4-0x0000000000400000-0x00000000004B1000-memory.dmpFilesize
708KB
-
memory/2876-5-0x0000000000A10000-0x0000000000A62000-memory.dmpFilesize
328KB
-
memory/2876-6-0x0000000000AD2000-0x0000000000AD3000-memory.dmpFilesize
4KB