Analysis
- max time kernel
88s - max time network
143s - platform
windows10_x64 - resource
win10 - submitted
10/07/2020, 11:05
Static task
static1
Behavioral task
behavioral1
Sample
Account Statement.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Account Statement.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
- Target Account Statement.exe
- Size 844KB
- Sample200710-7wdjvfflwe
- SHA256 9c38ee8e0a3c1c135ec3c4dd93b8ea67c0a39a83f1f4960c219eeb6e12ea66ce
- MD5 a2f9c14de88078d748c2381622889b1a
- SHA1 42308b65b36ff7c547220eb7befc313e57329091
- SHA512 c6fd85e84e266055c47d0ff81fda38c1de7963533b68241e83b0ccb937b0056f4299fde5cd5089aebc21fc85efaa7e78b7f5dc767daff28d6f4d75cb22e8ef72
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Credentials
-
Protocol
smtp
-
Host
smtp.rezuit.pro
-
Port
587
-
Username
-
Password
chukwuma22
Signatures
- Suspicious behavior: EnumeratesProcesses 226 IoCs
pid Process 4092 Account Statement.exe 4092 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3832 Account Statement.exe 3172 Account Statement.exe 3172 Account Statement.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4092 set thread context of 3172 4092 Account Statement.exe 67 - Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4092 wrote to memory of 3172 4092 Account Statement.exe 67 PID 4092 wrote to memory of 3172 4092 Account Statement.exe 67 PID 4092 wrote to memory of 3172 4092 Account Statement.exe 67 PID 4092 wrote to memory of 3832 4092 Account Statement.exe 68 PID 4092 wrote to memory of 3832 4092 Account Statement.exe 68 PID 4092 wrote to memory of 3832 4092 Account Statement.exe 68 - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 4092 Account Statement.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3172 Account Statement.exe - UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
resource yara_rule behavioral2/memory/3172-0-0x0000000000400000-0x00000000004A4000-memory.dmp upx behavioral2/memory/3172-3-0x0000000000400000-0x00000000004A4000-memory.dmp upx behavioral2/memory/3172-4-0x0000000000400000-0x00000000004A4000-memory.dmp upx
Processes
-
C:\Users\Admin\AppData\Local\Temp\Account Statement.exe"C:\Users\Admin\AppData\Local\Temp\Account Statement.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
PID:4092 -
C:\Users\Admin\AppData\Local\Temp\Account Statement.exe"C:\Users\Admin\AppData\Local\Temp\Account Statement.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3172
-
-
C:\Users\Admin\AppData\Local\Temp\Account Statement.exe"C:\Users\Admin\AppData\Local\Temp\Account Statement.exe" 2 3172 692812⤵
- Suspicious behavior: EnumeratesProcesses
PID:3832
-