Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
111s -
max time network
118s -
platform
windows7_x64 -
resource
win7 -
submitted
08/07/2020, 05:10
Static task
static1
Behavioral task
behavioral1
Sample
Invoice PO.exe
Resource
win7
Behavioral task
behavioral2
Sample
Invoice PO.exe
Resource
win10v200430
General
-
Target
Invoice PO.exe
-
Size
834KB
-
MD5
4f4d4dc29e20746e35bd51f4b3e6886f
-
SHA1
7a8e5712eacddb066cbc14fd1834ed0572528a5d
-
SHA256
026b2de77cf868ad38f39009a567ded7d184a475bad49effb7bf0a8a92b6d965
-
SHA512
668871ae98326aa8e311136765c068cc53b50425690193a89e61ed5e2a6984ce400375685473008aafa4e75105685d3bc29bb4712f2f160b8c0311c8fd441733
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.yandex.ru - Port:
587 - Username:
[email protected] - Password:
kingmoney12345
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 4 IoCs
resource yara_rule behavioral1/memory/1488-0-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla behavioral1/memory/1488-1-0x0000000000446DDE-mapping.dmp family_agenttesla behavioral1/memory/1488-2-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla behavioral1/memory/1488-3-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 900 set thread context of 1488 900 Invoice PO.exe 25 -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 900 Invoice PO.exe 1488 Invoice PO.exe 1488 Invoice PO.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 900 Invoice PO.exe Token: SeDebugPrivilege 1488 Invoice PO.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1488 Invoice PO.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 900 wrote to memory of 316 900 Invoice PO.exe 24 PID 900 wrote to memory of 316 900 Invoice PO.exe 24 PID 900 wrote to memory of 316 900 Invoice PO.exe 24 PID 900 wrote to memory of 316 900 Invoice PO.exe 24 PID 900 wrote to memory of 1488 900 Invoice PO.exe 25 PID 900 wrote to memory of 1488 900 Invoice PO.exe 25 PID 900 wrote to memory of 1488 900 Invoice PO.exe 25 PID 900 wrote to memory of 1488 900 Invoice PO.exe 25 PID 900 wrote to memory of 1488 900 Invoice PO.exe 25 PID 900 wrote to memory of 1488 900 Invoice PO.exe 25 PID 900 wrote to memory of 1488 900 Invoice PO.exe 25 PID 900 wrote to memory of 1488 900 Invoice PO.exe 25 PID 900 wrote to memory of 1488 900 Invoice PO.exe 25
Processes
-
C:\Users\Admin\AppData\Local\Temp\Invoice PO.exe"C:\Users\Admin\AppData\Local\Temp\Invoice PO.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:900 -
C:\Users\Admin\AppData\Local\Temp\Invoice PO.exe"{path}"2⤵PID:316
-
-
C:\Users\Admin\AppData\Local\Temp\Invoice PO.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1488
-