Analysis
- max time kernel
152s - max time network
139s - platform
windows10_x64 - resource
win10v20201028 - submitted
09/11/2020, 20:31
Static task
static1
Behavioral task
behavioral1
Sample
INVOICE INVOICE DRAFT COPY_SCAN555688.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
INVOICE INVOICE DRAFT COPY_SCAN555688.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target INVOICE INVOICE DRAFT COPY_SCAN555688.exe
- Size 1.4MB
- Sample201109-q8txvcc97a
- SHA256 027c5324e6066d9ffdf84ca77ea0502139d0ffdadcdb033c3adc7e3f870e835b
- MD5 520b0100121b401f84d7f863f0494727
- SHA1 bbfab68a27f3f01faf58c6ca521ed341e03524dc
- SHA512 11f467656502552afc1f25ef3d7bb61aad519286409a7091ff45e330db5338e3183d5771be5c894469392791d61884c115fd6a2797bbc004212dba357326ce48
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- AgentTesla Payload 14 IoCs
resource yara_rule behavioral2/memory/484-0-0x0000000000400000-0x0000000000452000-memory.dmp family_agenttesla behavioral2/memory/484-1-0x000000000044C93E-mapping.dmp family_agenttesla behavioral2/memory/484-15-0x000000000044C93E-mapping.dmp family_agenttesla behavioral2/memory/484-14-0x000000000044C93E-mapping.dmp family_agenttesla behavioral2/memory/484-16-0x000000000044C93E-mapping.dmp family_agenttesla behavioral2/memory/484-18-0x000000000044C93E-mapping.dmp family_agenttesla behavioral2/memory/484-25-0x000000000044C93E-mapping.dmp family_agenttesla behavioral2/memory/484-24-0x000000000044C93E-mapping.dmp family_agenttesla behavioral2/memory/484-23-0x000000000044C93E-mapping.dmp family_agenttesla behavioral2/memory/484-22-0x000000000044C93E-mapping.dmp family_agenttesla behavioral2/memory/484-21-0x000000000044C93E-mapping.dmp family_agenttesla behavioral2/memory/484-20-0x000000000044C93E-mapping.dmp family_agenttesla behavioral2/memory/484-19-0x000000000044C93E-mapping.dmp family_agenttesla behavioral2/memory/484-17-0x000000000044C93E-mapping.dmp family_agenttesla - Drops startup file 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\grpconv.url INVOICE INVOICE DRAFT COPY_SCAN555688.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 744 set thread context of 484 744 INVOICE INVOICE DRAFT COPY_SCAN555688.exe 75 - Program crash 1 IoCs
pid pid_target Process procid_target 1412 484 WerFault.exe 75 - Suspicious behavior: EnumeratesProcesses 40 IoCs
pid Process 484 MSBuild.exe 484 MSBuild.exe 744 INVOICE INVOICE DRAFT COPY_SCAN555688.exe 744 INVOICE INVOICE DRAFT COPY_SCAN555688.exe 744 INVOICE INVOICE DRAFT COPY_SCAN555688.exe 744 INVOICE INVOICE DRAFT COPY_SCAN555688.exe 744 INVOICE INVOICE DRAFT COPY_SCAN555688.exe 744 INVOICE INVOICE DRAFT COPY_SCAN555688.exe 744 INVOICE INVOICE DRAFT COPY_SCAN555688.exe 744 INVOICE INVOICE DRAFT COPY_SCAN555688.exe 744 INVOICE INVOICE DRAFT COPY_SCAN555688.exe 744 INVOICE INVOICE DRAFT COPY_SCAN555688.exe 1412 WerFault.exe 1412 WerFault.exe 1412 WerFault.exe 1412 WerFault.exe 1412 WerFault.exe 1412 WerFault.exe 1412 WerFault.exe 1412 WerFault.exe 1412 WerFault.exe 1412 WerFault.exe 1412 WerFault.exe 1412 WerFault.exe 1412 WerFault.exe 1412 WerFault.exe 744 INVOICE INVOICE DRAFT COPY_SCAN555688.exe 744 INVOICE INVOICE DRAFT COPY_SCAN555688.exe 744 INVOICE INVOICE DRAFT COPY_SCAN555688.exe 744 INVOICE INVOICE DRAFT COPY_SCAN555688.exe 744 INVOICE INVOICE DRAFT COPY_SCAN555688.exe 744 INVOICE INVOICE DRAFT COPY_SCAN555688.exe 744 INVOICE INVOICE DRAFT COPY_SCAN555688.exe 744 INVOICE INVOICE DRAFT COPY_SCAN555688.exe 744 INVOICE INVOICE DRAFT COPY_SCAN555688.exe 744 INVOICE INVOICE DRAFT COPY_SCAN555688.exe 744 INVOICE INVOICE DRAFT COPY_SCAN555688.exe 744 INVOICE INVOICE DRAFT COPY_SCAN555688.exe 744 INVOICE INVOICE DRAFT COPY_SCAN555688.exe 744 INVOICE INVOICE DRAFT COPY_SCAN555688.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 484 MSBuild.exe Token: SeRestorePrivilege 1412 WerFault.exe Token: SeBackupPrivilege 1412 WerFault.exe Token: SeDebugPrivilege 1412 WerFault.exe - Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 744 INVOICE INVOICE DRAFT COPY_SCAN555688.exe 744 INVOICE INVOICE DRAFT COPY_SCAN555688.exe 744 INVOICE INVOICE DRAFT COPY_SCAN555688.exe - Suspicious use of SendNotifyMessage 3 IoCs
pid Process 744 INVOICE INVOICE DRAFT COPY_SCAN555688.exe 744 INVOICE INVOICE DRAFT COPY_SCAN555688.exe 744 INVOICE INVOICE DRAFT COPY_SCAN555688.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 744 wrote to memory of 484 744 INVOICE INVOICE DRAFT COPY_SCAN555688.exe 75 PID 744 wrote to memory of 484 744 INVOICE INVOICE DRAFT COPY_SCAN555688.exe 75 PID 744 wrote to memory of 484 744 INVOICE INVOICE DRAFT COPY_SCAN555688.exe 75 PID 744 wrote to memory of 484 744 INVOICE INVOICE DRAFT COPY_SCAN555688.exe 75 PID 744 wrote to memory of 484 744 INVOICE INVOICE DRAFT COPY_SCAN555688.exe 75 PID 484 wrote to memory of 4068 484 MSBuild.exe 81 PID 484 wrote to memory of 4068 484 MSBuild.exe 81 PID 484 wrote to memory of 4068 484 MSBuild.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\INVOICE INVOICE DRAFT COPY_SCAN555688.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE INVOICE DRAFT COPY_SCAN555688.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:744 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\\\\Windows\\\\Microsoft.NET\\\\Framework\\\\v4.0.30319\\\\MSBuild.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:484 -
C:\Windows\SysWOW64\netsh.exe"netsh" wlan show profile3⤵PID:4068
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 484 -s 15003⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1412
-
-