Analysis
-
max time kernel
63s -
max time network
40s -
platform
windows7_x64 -
resource
win7 -
submitted
10-07-2020 11:05
Static task
static1
Behavioral task
behavioral1
Sample
Account Statement.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Account Statement.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
-
Target
Account Statement.exe
-
Size
844KB
-
MD5
a2f9c14de88078d748c2381622889b1a
-
SHA1
42308b65b36ff7c547220eb7befc313e57329091
-
SHA256
9c38ee8e0a3c1c135ec3c4dd93b8ea67c0a39a83f1f4960c219eeb6e12ea66ce
-
SHA512
c6fd85e84e266055c47d0ff81fda38c1de7963533b68241e83b0ccb937b0056f4299fde5cd5089aebc21fc85efaa7e78b7f5dc767daff28d6f4d75cb22e8ef72
Score
10/10
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Suspicious behavior: EnumeratesProcesses 116 IoCs
pid Process 1068 Account Statement.exe 608 Account Statement.exe 608 Account Statement.exe 608 Account Statement.exe 608 Account Statement.exe 608 Account Statement.exe 608 Account Statement.exe 608 Account Statement.exe 608 Account Statement.exe 608 Account Statement.exe 608 Account Statement.exe 608 Account Statement.exe 608 Account Statement.exe 608 Account Statement.exe 608 Account Statement.exe 608 Account Statement.exe 608 Account Statement.exe 608 Account Statement.exe 608 Account Statement.exe 608 Account Statement.exe 608 Account Statement.exe 608 Account Statement.exe 608 Account Statement.exe 608 Account Statement.exe 608 Account Statement.exe 608 Account Statement.exe 608 Account Statement.exe 608 Account Statement.exe 608 Account Statement.exe 608 Account Statement.exe 608 Account Statement.exe 608 Account Statement.exe 608 Account Statement.exe 608 Account Statement.exe 608 Account Statement.exe 608 Account Statement.exe 608 Account Statement.exe 608 Account Statement.exe 608 Account Statement.exe 608 Account Statement.exe 608 Account Statement.exe 608 Account Statement.exe 608 Account Statement.exe 608 Account Statement.exe 608 Account Statement.exe 608 Account Statement.exe 608 Account Statement.exe 608 Account Statement.exe 608 Account Statement.exe 608 Account Statement.exe 608 Account Statement.exe 608 Account Statement.exe 608 Account Statement.exe 608 Account Statement.exe 608 Account Statement.exe 608 Account Statement.exe 608 Account Statement.exe 608 Account Statement.exe 608 Account Statement.exe 608 Account Statement.exe 608 Account Statement.exe 608 Account Statement.exe 608 Account Statement.exe 608 Account Statement.exe 608 Account Statement.exe 608 Account Statement.exe 608 Account Statement.exe 608 Account Statement.exe 608 Account Statement.exe 608 Account Statement.exe 608 Account Statement.exe 608 Account Statement.exe 608 Account Statement.exe 608 Account Statement.exe 608 Account Statement.exe 608 Account Statement.exe 608 Account Statement.exe 608 Account Statement.exe 608 Account Statement.exe 608 Account Statement.exe 608 Account Statement.exe 608 Account Statement.exe 608 Account Statement.exe 608 Account Statement.exe 608 Account Statement.exe 608 Account Statement.exe 608 Account Statement.exe 608 Account Statement.exe 608 Account Statement.exe 608 Account Statement.exe 608 Account Statement.exe 608 Account Statement.exe 608 Account Statement.exe 608 Account Statement.exe 608 Account Statement.exe 608 Account Statement.exe 608 Account Statement.exe 608 Account Statement.exe 608 Account Statement.exe 608 Account Statement.exe 608 Account Statement.exe 608 Account Statement.exe 608 Account Statement.exe 608 Account Statement.exe 608 Account Statement.exe 608 Account Statement.exe 608 Account Statement.exe 608 Account Statement.exe 608 Account Statement.exe 608 Account Statement.exe 608 Account Statement.exe 608 Account Statement.exe 608 Account Statement.exe 1292 Account Statement.exe 1292 Account Statement.exe 608 Account Statement.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1068 Account Statement.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1068 set thread context of 1292 1068 Account Statement.exe 24 -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1068 wrote to memory of 1292 1068 Account Statement.exe 24 PID 1068 wrote to memory of 1292 1068 Account Statement.exe 24 PID 1068 wrote to memory of 1292 1068 Account Statement.exe 24 PID 1068 wrote to memory of 1292 1068 Account Statement.exe 24 PID 1068 wrote to memory of 608 1068 Account Statement.exe 25 PID 1068 wrote to memory of 608 1068 Account Statement.exe 25 PID 1068 wrote to memory of 608 1068 Account Statement.exe 25 PID 1068 wrote to memory of 608 1068 Account Statement.exe 25 -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1292 Account Statement.exe -
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
resource yara_rule behavioral1/memory/1292-0-0x0000000000400000-0x00000000004A4000-memory.dmp upx behavioral1/memory/1292-2-0x0000000000400000-0x00000000004A4000-memory.dmp upx behavioral1/memory/1292-4-0x0000000000400000-0x00000000004A4000-memory.dmp upx
Processes
-
C:\Users\Admin\AppData\Local\Temp\Account Statement.exe"C:\Users\Admin\AppData\Local\Temp\Account Statement.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1068 -
C:\Users\Admin\AppData\Local\Temp\Account Statement.exe"C:\Users\Admin\AppData\Local\Temp\Account Statement.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1292
-
-
C:\Users\Admin\AppData\Local\Temp\Account Statement.exe"C:\Users\Admin\AppData\Local\Temp\Account Statement.exe" 2 1292 629772⤵
- Suspicious behavior: EnumeratesProcesses
PID:608
-