Overview
overview
10Static
static
8BANK RECEIPT.exe
windows7_x64
10BANK RECEIPT.exe
windows10_x64
10BOL.xlsm
windows7_x64
10BOL.xlsm
windows10_x64
10Inv_399139_86191.xlsm
windows7_x64
10Inv_399139_86191.xlsm
windows10_x64
10Ordine 400...xs.exe
windows7_x64
10Ordine 400...xs.exe
windows10_x64
10PO.exe
windows7_x64
10PO.exe
windows10_x64
10STATEMENT ...NT.exe
windows7_x64
10STATEMENT ...NT.exe
windows10_x64
10SWIFT-MT10...df.exe
windows7_x64
10SWIFT-MT10...df.exe
windows10_x64
10inquiries ...B .exe
windows7_x64
10inquiries ...B .exe
windows10_x64
10Analysis
-
max time kernel
62s -
max time network
10s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
06-05-2021 22:02
Static task
static1
Behavioral task
behavioral1
Sample
BANK RECEIPT.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
BANK RECEIPT.exe
Resource
win10v20210410
Behavioral task
behavioral3
Sample
BOL.xlsm
Resource
win7v20210408
Behavioral task
behavioral4
Sample
BOL.xlsm
Resource
win10v20210410
Behavioral task
behavioral5
Sample
Inv_399139_86191.xlsm
Resource
win7v20210408
Behavioral task
behavioral6
Sample
Inv_399139_86191.xlsm
Resource
win10v20210410
Behavioral task
behavioral7
Sample
Ordine 400225.xlxs.exe
Resource
win7v20210410
Behavioral task
behavioral8
Sample
Ordine 400225.xlxs.exe
Resource
win10v20210408
Behavioral task
behavioral9
Sample
PO.exe
Resource
win7v20210410
Behavioral task
behavioral10
Sample
PO.exe
Resource
win10v20210408
Behavioral task
behavioral11
Sample
STATEMENT OF ACCOUNT.exe
Resource
win7v20210410
Behavioral task
behavioral12
Sample
STATEMENT OF ACCOUNT.exe
Resource
win10v20210408
Behavioral task
behavioral13
Sample
SWIFT-MT103_10262020.pdf.exe
Resource
win7v20210410
Behavioral task
behavioral14
Sample
SWIFT-MT103_10262020.pdf.exe
Resource
win10v20210410
Behavioral task
behavioral15
Sample
inquiries for WCB .exe
Resource
win7v20210408
General
-
Target
SWIFT-MT103_10262020.pdf.exe
-
Size
962KB
-
MD5
d45ea472e02716273a88ec6093443db5
-
SHA1
bfccdf852c01557bf54eb5dd018c34f28f4c9df4
-
SHA256
02eca93ecccb20370063ee84fc8b50f70bdc84ced1c5e09016ea7c06e7946a51
-
SHA512
bcee0231d25468be11ebf6ad07f62c1e147e5a0a5c009f4d931b878ea6d494b39700bf0bc0b3a566ae8a556ef9b234cdbc7f2285182515fe533c2fdadd05a161
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.abr.rs - Port:
587 - Username:
finansije@abr.rs - Password:
Royal-1111
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 2 IoCs
Processes:
resource yara_rule behavioral13/memory/532-63-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla behavioral13/memory/532-64-0x000000000043752E-mapping.dmp family_agenttesla -
Suspicious use of SetThreadContext 1 IoCs
Processes:
SWIFT-MT103_10262020.pdf.exedescription pid process target process PID 1880 set thread context of 532 1880 SWIFT-MT103_10262020.pdf.exe SWIFT-MT103_10262020.pdf.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
SWIFT-MT103_10262020.pdf.exepid process 532 SWIFT-MT103_10262020.pdf.exe 532 SWIFT-MT103_10262020.pdf.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
SWIFT-MT103_10262020.pdf.exedescription pid process Token: SeDebugPrivilege 532 SWIFT-MT103_10262020.pdf.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
SWIFT-MT103_10262020.pdf.exeSWIFT-MT103_10262020.pdf.exedescription pid process target process PID 1880 wrote to memory of 532 1880 SWIFT-MT103_10262020.pdf.exe SWIFT-MT103_10262020.pdf.exe PID 1880 wrote to memory of 532 1880 SWIFT-MT103_10262020.pdf.exe SWIFT-MT103_10262020.pdf.exe PID 1880 wrote to memory of 532 1880 SWIFT-MT103_10262020.pdf.exe SWIFT-MT103_10262020.pdf.exe PID 1880 wrote to memory of 532 1880 SWIFT-MT103_10262020.pdf.exe SWIFT-MT103_10262020.pdf.exe PID 1880 wrote to memory of 532 1880 SWIFT-MT103_10262020.pdf.exe SWIFT-MT103_10262020.pdf.exe PID 1880 wrote to memory of 532 1880 SWIFT-MT103_10262020.pdf.exe SWIFT-MT103_10262020.pdf.exe PID 1880 wrote to memory of 532 1880 SWIFT-MT103_10262020.pdf.exe SWIFT-MT103_10262020.pdf.exe PID 1880 wrote to memory of 532 1880 SWIFT-MT103_10262020.pdf.exe SWIFT-MT103_10262020.pdf.exe PID 1880 wrote to memory of 532 1880 SWIFT-MT103_10262020.pdf.exe SWIFT-MT103_10262020.pdf.exe PID 532 wrote to memory of 1812 532 SWIFT-MT103_10262020.pdf.exe dw20.exe PID 532 wrote to memory of 1812 532 SWIFT-MT103_10262020.pdf.exe dw20.exe PID 532 wrote to memory of 1812 532 SWIFT-MT103_10262020.pdf.exe dw20.exe PID 532 wrote to memory of 1812 532 SWIFT-MT103_10262020.pdf.exe dw20.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SWIFT-MT103_10262020.pdf.exe"C:\Users\Admin\AppData\Local\Temp\SWIFT-MT103_10262020.pdf.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SWIFT-MT103_10262020.pdf.exe"C:\Users\Admin\AppData\Local\Temp\SWIFT-MT103_10262020.pdf.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 5203⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/532-63-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/532-64-0x000000000043752E-mapping.dmp
-
memory/532-66-0x00000000008C0000-0x00000000008C1000-memory.dmpFilesize
4KB
-
memory/1812-67-0x0000000000000000-mapping.dmp
-
memory/1812-69-0x0000000000670000-0x0000000000671000-memory.dmpFilesize
4KB
-
memory/1880-60-0x0000000075631000-0x0000000075633000-memory.dmpFilesize
8KB
-
memory/1880-61-0x00000000020A0000-0x00000000020A1000-memory.dmpFilesize
4KB
-
memory/1880-62-0x00000000020A1000-0x00000000020A2000-memory.dmpFilesize
4KB