Analysis
-
max time kernel
150s -
max time network
110s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
26-02-2021 16:45
Static task
static1
Behavioral task
behavioral1
Sample
PROFORMA INVOICE.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
PROFORMA INVOICE.exe
Resource
win10v20201028
General
-
Target
PROFORMA INVOICE.exe
-
Size
774KB
-
MD5
b58d742577f386edbf58075fff9ffacc
-
SHA1
a2b677224dc4fd241018dc05d0bf788df090cf01
-
SHA256
ed5aeb58bb7327270d75e75505bc2322bb62e5764b4245dba88d5a91c40ebe8b
-
SHA512
19dfc707c7dc31ba73cf20b3f986ed956d076b88781ca50b7e5409d877788bddfcdc14a9a7dc7ed12baa407a62d72f9622c8740d7e4d8f5b9a5244f09d7d28d4
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.hybridgroupco.com - Port:
587 - Username:
[email protected] - Password:
Obinna123@@@
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/1976-13-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla behavioral2/memory/1976-14-0x00000000004375EE-mapping.dmp family_agenttesla -
Suspicious use of SetThreadContext 1 IoCs
Processes:
PROFORMA INVOICE.exedescription pid process target process PID 816 set thread context of 1976 816 PROFORMA INVOICE.exe PROFORMA INVOICE.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
PROFORMA INVOICE.exePROFORMA INVOICE.exepid process 816 PROFORMA INVOICE.exe 816 PROFORMA INVOICE.exe 1976 PROFORMA INVOICE.exe 1976 PROFORMA INVOICE.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
PROFORMA INVOICE.exePROFORMA INVOICE.exedescription pid process Token: SeDebugPrivilege 816 PROFORMA INVOICE.exe Token: SeDebugPrivilege 1976 PROFORMA INVOICE.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
PROFORMA INVOICE.exedescription pid process target process PID 816 wrote to memory of 3024 816 PROFORMA INVOICE.exe PROFORMA INVOICE.exe PID 816 wrote to memory of 3024 816 PROFORMA INVOICE.exe PROFORMA INVOICE.exe PID 816 wrote to memory of 3024 816 PROFORMA INVOICE.exe PROFORMA INVOICE.exe PID 816 wrote to memory of 1976 816 PROFORMA INVOICE.exe PROFORMA INVOICE.exe PID 816 wrote to memory of 1976 816 PROFORMA INVOICE.exe PROFORMA INVOICE.exe PID 816 wrote to memory of 1976 816 PROFORMA INVOICE.exe PROFORMA INVOICE.exe PID 816 wrote to memory of 1976 816 PROFORMA INVOICE.exe PROFORMA INVOICE.exe PID 816 wrote to memory of 1976 816 PROFORMA INVOICE.exe PROFORMA INVOICE.exe PID 816 wrote to memory of 1976 816 PROFORMA INVOICE.exe PROFORMA INVOICE.exe PID 816 wrote to memory of 1976 816 PROFORMA INVOICE.exe PROFORMA INVOICE.exe PID 816 wrote to memory of 1976 816 PROFORMA INVOICE.exe PROFORMA INVOICE.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PROFORMA INVOICE.exe"C:\Users\Admin\AppData\Local\Temp\PROFORMA INVOICE.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:816 -
C:\Users\Admin\AppData\Local\Temp\PROFORMA INVOICE.exe"C:\Users\Admin\AppData\Local\Temp\PROFORMA INVOICE.exe"2⤵PID:3024
-
C:\Users\Admin\AppData\Local\Temp\PROFORMA INVOICE.exe"C:\Users\Admin\AppData\Local\Temp\PROFORMA INVOICE.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1976
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PROFORMA INVOICE.exe.logMD5
90acfd72f14a512712b1a7380c0faf60
SHA140ba4accb8faa75887e84fb8e38d598dc8cf0f12
SHA25620806822f0c130b340504132c1461b589261fbbc518e468f4f90733ab514cb86
SHA51229dbf85e14e60868574cb4dc9bda83d3c229fb956733d8d2557f2475ee0e690ac9c2e72f31e02284996da6906ba2dbfa382a29b04c15a2406571d8ee19ad16b9
-
memory/816-7-0x0000000005540000-0x0000000005541000-memory.dmpFilesize
4KB
-
memory/816-10-0x00000000056A0000-0x00000000056A1000-memory.dmpFilesize
4KB
-
memory/816-6-0x00000000059A0000-0x00000000059A1000-memory.dmpFilesize
4KB
-
memory/816-2-0x0000000074070000-0x000000007475E000-memory.dmpFilesize
6.9MB
-
memory/816-12-0x0000000006040000-0x000000000609C000-memory.dmpFilesize
368KB
-
memory/816-9-0x00000000053E0000-0x00000000053E1000-memory.dmpFilesize
4KB
-
memory/816-5-0x0000000005400000-0x0000000005401000-memory.dmpFilesize
4KB
-
memory/816-11-0x00000000054A0000-0x00000000054A3000-memory.dmpFilesize
12KB
-
memory/816-8-0x0000000005750000-0x0000000005751000-memory.dmpFilesize
4KB
-
memory/816-3-0x0000000000B00000-0x0000000000B01000-memory.dmpFilesize
4KB
-
memory/1976-14-0x00000000004375EE-mapping.dmp
-
memory/1976-13-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1976-16-0x0000000074070000-0x000000007475E000-memory.dmpFilesize
6.9MB
-
memory/1976-21-0x0000000005A70000-0x0000000005A71000-memory.dmpFilesize
4KB
-
memory/1976-22-0x0000000005910000-0x0000000005911000-memory.dmpFilesize
4KB
-
memory/1976-23-0x0000000006480000-0x0000000006481000-memory.dmpFilesize
4KB