Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
26-02-2021 11:34
Static task
static1
Behavioral task
behavioral1
Sample
PROFORMA INVOICE.exe
Resource
win7v20201028
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
PROFORMA INVOICE.exe
Resource
win10v20201028
0 signatures
0 seconds
General
-
Target
PROFORMA INVOICE.exe
Score
10/10
Malware Config
Extracted
Family
agenttesla
Credentials
Protocol: smtp- Host:
mail.hybridgroupco.com - Port:
587 - Username:
[email protected] - Password:
Obinna123@@@
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/2304-13-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla behavioral2/memory/2304-14-0x00000000004375EE-mapping.dmp family_agenttesla -
Suspicious use of SetThreadContext 1 IoCs
Processes:
PROFORMA INVOICE.exedescription pid process target process PID 3636 set thread context of 2304 3636 PROFORMA INVOICE.exe PROFORMA INVOICE.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
PROFORMA INVOICE.exepid process 2304 PROFORMA INVOICE.exe 2304 PROFORMA INVOICE.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
PROFORMA INVOICE.exedescription pid process Token: SeDebugPrivilege 2304 PROFORMA INVOICE.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
PROFORMA INVOICE.exedescription pid process target process PID 3636 wrote to memory of 2304 3636 PROFORMA INVOICE.exe PROFORMA INVOICE.exe PID 3636 wrote to memory of 2304 3636 PROFORMA INVOICE.exe PROFORMA INVOICE.exe PID 3636 wrote to memory of 2304 3636 PROFORMA INVOICE.exe PROFORMA INVOICE.exe PID 3636 wrote to memory of 2304 3636 PROFORMA INVOICE.exe PROFORMA INVOICE.exe PID 3636 wrote to memory of 2304 3636 PROFORMA INVOICE.exe PROFORMA INVOICE.exe PID 3636 wrote to memory of 2304 3636 PROFORMA INVOICE.exe PROFORMA INVOICE.exe PID 3636 wrote to memory of 2304 3636 PROFORMA INVOICE.exe PROFORMA INVOICE.exe PID 3636 wrote to memory of 2304 3636 PROFORMA INVOICE.exe PROFORMA INVOICE.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PROFORMA INVOICE.exe"C:\Users\Admin\AppData\Local\Temp\PROFORMA INVOICE.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PROFORMA INVOICE.exe"C:\Users\Admin\AppData\Local\Temp\PROFORMA INVOICE.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PROFORMA INVOICE.exe.logMD5
90acfd72f14a512712b1a7380c0faf60
SHA140ba4accb8faa75887e84fb8e38d598dc8cf0f12
SHA25620806822f0c130b340504132c1461b589261fbbc518e468f4f90733ab514cb86
SHA51229dbf85e14e60868574cb4dc9bda83d3c229fb956733d8d2557f2475ee0e690ac9c2e72f31e02284996da6906ba2dbfa382a29b04c15a2406571d8ee19ad16b9
-
memory/2304-13-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/2304-23-0x0000000005C10000-0x0000000005C11000-memory.dmpFilesize
4KB
-
memory/2304-22-0x0000000002A80000-0x0000000002A81000-memory.dmpFilesize
4KB
-
memory/2304-21-0x0000000004FA0000-0x0000000004FA1000-memory.dmpFilesize
4KB
-
memory/2304-16-0x0000000073900000-0x0000000073FEE000-memory.dmpFilesize
6.9MB
-
memory/2304-14-0x00000000004375EE-mapping.dmp
-
memory/3636-7-0x0000000005890000-0x0000000005891000-memory.dmpFilesize
4KB
-
memory/3636-11-0x0000000003340000-0x0000000003343000-memory.dmpFilesize
12KB
-
memory/3636-12-0x00000000063F0000-0x000000000644C000-memory.dmpFilesize
368KB
-
memory/3636-10-0x0000000005A70000-0x0000000005A71000-memory.dmpFilesize
4KB
-
memory/3636-9-0x0000000003320000-0x0000000003321000-memory.dmpFilesize
4KB
-
memory/3636-8-0x0000000005A00000-0x0000000005A01000-memory.dmpFilesize
4KB
-
memory/3636-2-0x0000000073900000-0x0000000073FEE000-memory.dmpFilesize
6.9MB
-
memory/3636-6-0x0000000005D90000-0x0000000005D91000-memory.dmpFilesize
4KB
-
memory/3636-5-0x00000000057B0000-0x00000000057B1000-memory.dmpFilesize
4KB
-
memory/3636-3-0x0000000000E90000-0x0000000000E91000-memory.dmpFilesize
4KB