Overview
overview
10Static
static
8BANK RECEIPT.exe
windows7_x64
10BANK RECEIPT.exe
windows10_x64
10BOL.xlsm
windows7_x64
10BOL.xlsm
windows10_x64
10Inv_399139_86191.xlsm
windows7_x64
10Inv_399139_86191.xlsm
windows10_x64
10Ordine 400...xs.exe
windows7_x64
10Ordine 400...xs.exe
windows10_x64
10PO.exe
windows7_x64
10PO.exe
windows10_x64
10STATEMENT ...NT.exe
windows7_x64
10STATEMENT ...NT.exe
windows10_x64
10SWIFT-MT10...df.exe
windows7_x64
10SWIFT-MT10...df.exe
windows10_x64
10inquiries ...B .exe
windows7_x64
10inquiries ...B .exe
windows10_x64
10Analysis
-
max time kernel
119s -
max time network
117s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
06-05-2021 22:02
Static task
static1
Behavioral task
behavioral1
Sample
BANK RECEIPT.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
BANK RECEIPT.exe
Resource
win10v20210410
Behavioral task
behavioral3
Sample
BOL.xlsm
Resource
win7v20210408
Behavioral task
behavioral4
Sample
BOL.xlsm
Resource
win10v20210410
Behavioral task
behavioral5
Sample
Inv_399139_86191.xlsm
Resource
win7v20210408
Behavioral task
behavioral6
Sample
Inv_399139_86191.xlsm
Resource
win10v20210410
Behavioral task
behavioral7
Sample
Ordine 400225.xlxs.exe
Resource
win7v20210410
Behavioral task
behavioral8
Sample
Ordine 400225.xlxs.exe
Resource
win10v20210408
Behavioral task
behavioral9
Sample
PO.exe
Resource
win7v20210410
Behavioral task
behavioral10
Sample
PO.exe
Resource
win10v20210408
Behavioral task
behavioral11
Sample
STATEMENT OF ACCOUNT.exe
Resource
win7v20210410
Behavioral task
behavioral12
Sample
STATEMENT OF ACCOUNT.exe
Resource
win10v20210408
Behavioral task
behavioral13
Sample
SWIFT-MT103_10262020.pdf.exe
Resource
win7v20210410
Behavioral task
behavioral14
Sample
SWIFT-MT103_10262020.pdf.exe
Resource
win10v20210410
Behavioral task
behavioral15
Sample
inquiries for WCB .exe
Resource
win7v20210408
General
-
Target
STATEMENT OF ACCOUNT.exe
-
Size
387KB
-
MD5
5932bd9d5a231f2dce386609a1c80ba9
-
SHA1
94b257813d301d75895d0fee69a8acc224cca82e
-
SHA256
14e48e373fee4fafef99517fba97e5ea5727f764a0b92509b307f9387679dd64
-
SHA512
c10ca6caa068086aef9e36aab1ec8ae9f83367a30fa213d54fcfd5c77f0115e1b4017ddb77cf28bae3761d75ee0118241eb413613cecf4431820d526a7ba967c
Malware Config
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 1 IoCs
Processes:
resource yara_rule behavioral11/memory/2004-64-0x0000000000400000-0x000000000044B000-memory.dmp family_agenttesla -
Loads dropped DLL 1 IoCs
Processes:
STATEMENT OF ACCOUNT.exepid process 1048 STATEMENT OF ACCOUNT.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
STATEMENT OF ACCOUNT.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\riaagitukgs = "C:\\Users\\Admin\\AppData\\Roaming\\ptdrpxuyhk\\siusbbxdxbkm.exe" STATEMENT OF ACCOUNT.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
STATEMENT OF ACCOUNT.exedescription pid process target process PID 1048 set thread context of 2004 1048 STATEMENT OF ACCOUNT.exe STATEMENT OF ACCOUNT.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
STATEMENT OF ACCOUNT.exepid process 2004 STATEMENT OF ACCOUNT.exe 2004 STATEMENT OF ACCOUNT.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
dw20.exepid process 1264 dw20.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
STATEMENT OF ACCOUNT.exepid process 1048 STATEMENT OF ACCOUNT.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
STATEMENT OF ACCOUNT.exedescription pid process Token: SeDebugPrivilege 2004 STATEMENT OF ACCOUNT.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
STATEMENT OF ACCOUNT.exeSTATEMENT OF ACCOUNT.exedescription pid process target process PID 1048 wrote to memory of 2004 1048 STATEMENT OF ACCOUNT.exe STATEMENT OF ACCOUNT.exe PID 1048 wrote to memory of 2004 1048 STATEMENT OF ACCOUNT.exe STATEMENT OF ACCOUNT.exe PID 1048 wrote to memory of 2004 1048 STATEMENT OF ACCOUNT.exe STATEMENT OF ACCOUNT.exe PID 1048 wrote to memory of 2004 1048 STATEMENT OF ACCOUNT.exe STATEMENT OF ACCOUNT.exe PID 1048 wrote to memory of 2004 1048 STATEMENT OF ACCOUNT.exe STATEMENT OF ACCOUNT.exe PID 2004 wrote to memory of 1264 2004 STATEMENT OF ACCOUNT.exe dw20.exe PID 2004 wrote to memory of 1264 2004 STATEMENT OF ACCOUNT.exe dw20.exe PID 2004 wrote to memory of 1264 2004 STATEMENT OF ACCOUNT.exe dw20.exe PID 2004 wrote to memory of 1264 2004 STATEMENT OF ACCOUNT.exe dw20.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\STATEMENT OF ACCOUNT.exe"C:\Users\Admin\AppData\Local\Temp\STATEMENT OF ACCOUNT.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\STATEMENT OF ACCOUNT.exe"C:\Users\Admin\AppData\Local\Temp\STATEMENT OF ACCOUNT.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 5083⤵
- Suspicious behavior: GetForegroundWindowSpam
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\nsn1344.tmp\wfonpw4.dllMD5
2352a10c7c964ab3ab072f17a78cb77f
SHA1a41c5d247420909bb3a3565dd552990258904f02
SHA256271f00c08e8dbf27f0b36e27df2aa07be3e4492940118ae3e43758a812d7e370
SHA51214634bebdd077a674b02bb9548588868ca56145e497fea67be211bd2887bec65b02c75f7edafdbff0d976ff9a424f8acc1ba0ab4244a1b86ebeb640ceb8c41d4
-
memory/1048-59-0x0000000075721000-0x0000000075723000-memory.dmpFilesize
8KB
-
memory/1048-61-0x00000000003D0000-0x00000000003D3000-memory.dmpFilesize
12KB
-
memory/1264-70-0x0000000000000000-mapping.dmp
-
memory/1264-72-0x0000000001E50000-0x0000000001E51000-memory.dmpFilesize
4KB
-
memory/2004-62-0x000000000040188B-mapping.dmp
-
memory/2004-65-0x0000000000330000-0x0000000000331000-memory.dmpFilesize
4KB
-
memory/2004-64-0x0000000000400000-0x000000000044B000-memory.dmpFilesize
300KB
-
memory/2004-66-0x0000000000331000-0x0000000000332000-memory.dmpFilesize
4KB
-
memory/2004-67-0x0000000000332000-0x0000000000334000-memory.dmpFilesize
8KB
-
memory/2004-68-0x0000000000337000-0x0000000000338000-memory.dmpFilesize
4KB
-
memory/2004-69-0x0000000000338000-0x0000000000339000-memory.dmpFilesize
4KB