Analysis
-
max time kernel
144s -
max time network
135s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
20-04-2021 05:41
Static task
static1
Behavioral task
behavioral1
Sample
PAYMENT COPY.exe
Resource
win7v20210408
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
PAYMENT COPY.exe
Resource
win10v20210410
0 signatures
0 seconds
General
-
Target
PAYMENT COPY.exe
-
Size
750KB
-
MD5
b7648b741ec8f6d9f882464f521a8aed
-
SHA1
78d4c91a87bf51c0495899a4ed4f3b89b3e6ba13
-
SHA256
f7f3e9fbe1bff8f404b8b150d016d2e1757f27756b4664da9ac4dcf7e9a6a09f
-
SHA512
2eb26d6e1e91f7547f8940a6082267768dd3222af7f8ebe25b69292e80692cde46daf913df6070e448352911498d2d582a1cfc9a974a49e25f938a2fa86914ac
Malware Config
Extracted
Family
agenttesla
Credentials
Protocol: smtp- Host:
a2plcpnl0347.prod.iad2.secureserver.net - Port:
587 - Username:
[email protected] - Password:
Admin_123
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/3616-126-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla behavioral2/memory/3616-127-0x000000000043762E-mapping.dmp family_agenttesla behavioral2/memory/3616-132-0x00000000057D0000-0x0000000005CCE000-memory.dmp family_agenttesla -
Drops file in Drivers directory 1 IoCs
Processes:
RegSvcs.exedescription ioc process File opened for modification C:\Windows\system32\drivers\etc\hosts RegSvcs.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
RegSvcs.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\AvrzbM = "C:\\Users\\Admin\\AppData\\Roaming\\AvrzbM\\AvrzbM.exe" RegSvcs.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
PAYMENT COPY.exedescription pid process target process PID 2256 set thread context of 3616 2256 PAYMENT COPY.exe RegSvcs.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
PAYMENT COPY.exeRegSvcs.exepid process 2256 PAYMENT COPY.exe 2256 PAYMENT COPY.exe 2256 PAYMENT COPY.exe 2256 PAYMENT COPY.exe 3616 RegSvcs.exe 3616 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
PAYMENT COPY.exeRegSvcs.exedescription pid process Token: SeDebugPrivilege 2256 PAYMENT COPY.exe Token: SeDebugPrivilege 3616 RegSvcs.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
PAYMENT COPY.exedescription pid process target process PID 2256 wrote to memory of 3616 2256 PAYMENT COPY.exe RegSvcs.exe PID 2256 wrote to memory of 3616 2256 PAYMENT COPY.exe RegSvcs.exe PID 2256 wrote to memory of 3616 2256 PAYMENT COPY.exe RegSvcs.exe PID 2256 wrote to memory of 3616 2256 PAYMENT COPY.exe RegSvcs.exe PID 2256 wrote to memory of 3616 2256 PAYMENT COPY.exe RegSvcs.exe PID 2256 wrote to memory of 3616 2256 PAYMENT COPY.exe RegSvcs.exe PID 2256 wrote to memory of 3616 2256 PAYMENT COPY.exe RegSvcs.exe PID 2256 wrote to memory of 3616 2256 PAYMENT COPY.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PAYMENT COPY.exe"C:\Users\Admin\AppData\Local\Temp\PAYMENT COPY.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2256-114-0x0000000000B90000-0x0000000000B91000-memory.dmpFilesize
4KB
-
memory/2256-116-0x00000000054B0000-0x00000000054B1000-memory.dmpFilesize
4KB
-
memory/2256-117-0x0000000005AF0000-0x0000000005AF1000-memory.dmpFilesize
4KB
-
memory/2256-118-0x00000000055F0000-0x00000000055F1000-memory.dmpFilesize
4KB
-
memory/2256-119-0x0000000005460000-0x0000000005461000-memory.dmpFilesize
4KB
-
memory/2256-120-0x0000000005690000-0x0000000005691000-memory.dmpFilesize
4KB
-
memory/2256-121-0x0000000006230000-0x0000000006239000-memory.dmpFilesize
36KB
-
memory/2256-123-0x000000007F1E0000-0x000000007F1E1000-memory.dmpFilesize
4KB
-
memory/2256-122-0x00000000055F0000-0x0000000005AEE000-memory.dmpFilesize
5.0MB
-
memory/2256-124-0x00000000064C0000-0x0000000006544000-memory.dmpFilesize
528KB
-
memory/2256-125-0x0000000001570000-0x00000000015B9000-memory.dmpFilesize
292KB
-
memory/3616-126-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/3616-127-0x000000000043762E-mapping.dmp
-
memory/3616-132-0x00000000057D0000-0x0000000005CCE000-memory.dmpFilesize
5.0MB
-
memory/3616-133-0x0000000005CB0000-0x0000000005CB1000-memory.dmpFilesize
4KB
-
memory/3616-134-0x0000000006470000-0x0000000006471000-memory.dmpFilesize
4KB