Analysis
-
max time kernel
139s -
max time network
31s -
platform
windows7_x64 -
resource
win7v200430 -
submitted
12-07-2020 08:16
Static task
static1
Behavioral task
behavioral1
Sample
Invoice.exe
Resource
win7v200430
Behavioral task
behavioral2
Sample
Invoice.exe
Resource
win10
General
-
Target
Invoice.exe
-
Size
402KB
-
MD5
da4e69129661f06319d09a815b0b98d7
-
SHA1
f6bd5cd6f1e8c8217bb062ab378e53da423c1843
-
SHA256
f6fc22ec88e5653d35064b62baba0b24d9a66391412f21488053e6df37b87c98
-
SHA512
76ab018e3236b5533fc13b308d9dfe54b14b5f861b212f9cdbcfa0a4f76ca7ecbd9a3755b4db6c1a06233f7e6726e0f132b9e92fc05b20d2577bdc68c055f4a7
Malware Config
Extracted
agenttesla
Protocol: ftp- Host:
ftp://asnbanknl.com/ - Port:
21 - Username:
smartpips - Password:
3mPf4$l2
Protocol: ftp- Host:
ftp://asnbanknl.com/ - Port:
21 - Username:
smartpips - Password:
3mPf4$l2
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1844-4-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla behavioral1/memory/1844-5-0x0000000000446A1E-mapping.dmp family_agenttesla behavioral1/memory/1844-6-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla behavioral1/memory/1844-7-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
Invoice.exedescription pid process target process PID 1312 set thread context of 1844 1312 Invoice.exe Invoice.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
Invoice.exepid process 1844 Invoice.exe 1844 Invoice.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Invoice.exedescription pid process Token: SeDebugPrivilege 1844 Invoice.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Invoice.exepid process 1844 Invoice.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
Invoice.exedescription pid process target process PID 1312 wrote to memory of 1808 1312 Invoice.exe schtasks.exe PID 1312 wrote to memory of 1808 1312 Invoice.exe schtasks.exe PID 1312 wrote to memory of 1808 1312 Invoice.exe schtasks.exe PID 1312 wrote to memory of 1808 1312 Invoice.exe schtasks.exe PID 1312 wrote to memory of 1844 1312 Invoice.exe Invoice.exe PID 1312 wrote to memory of 1844 1312 Invoice.exe Invoice.exe PID 1312 wrote to memory of 1844 1312 Invoice.exe Invoice.exe PID 1312 wrote to memory of 1844 1312 Invoice.exe Invoice.exe PID 1312 wrote to memory of 1844 1312 Invoice.exe Invoice.exe PID 1312 wrote to memory of 1844 1312 Invoice.exe Invoice.exe PID 1312 wrote to memory of 1844 1312 Invoice.exe Invoice.exe PID 1312 wrote to memory of 1844 1312 Invoice.exe Invoice.exe PID 1312 wrote to memory of 1844 1312 Invoice.exe Invoice.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Invoice.exe"C:\Users\Admin\AppData\Local\Temp\Invoice.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\RnxGjClOcsOYp" /XML "C:\Users\Admin\AppData\Local\Temp\tmp47A9.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\Invoice.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp47A9.tmpMD5
6aa5c4cac9e4bc4dc04a92438b94156c
SHA1a40dc87a70cc0630988223a1521acdda8a4707df
SHA256a36b66d5b494bbd306b9a9f5490767d86fb5a368c210d58421554092c3f1d46e
SHA51245d9ba3e1ac586c6b16cc367042a4e67339c03029c0190b7f566339cba6d5afa552f0ba756103428847f5a9ec0c129eff347e8c419df7a535157badd4f97d29e
-
memory/1312-1-0x0000000000000000-0x0000000000000000-disk.dmp
-
memory/1808-2-0x0000000000000000-mapping.dmp
-
memory/1844-4-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1844-5-0x0000000000446A1E-mapping.dmp
-
memory/1844-6-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1844-7-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB