Analysis
-
max time kernel
144s -
max time network
47s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
27-07-2021 13:13
Static task
static1
Behavioral task
behavioral1
Sample
Payment Slip.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
Payment Slip.exe
Resource
win10v20210410
General
-
Target
Payment Slip.exe
-
Size
647KB
-
MD5
d6f96e4a411bb243bea36c8aa5ec4ab0
-
SHA1
7be11b1519176590b7ed4326933fd0e08325b588
-
SHA256
b915e46bfe27a03870fb223223ff2af61c15226a650031317d2acf558c55a3a9
-
SHA512
7618fd4596bbabdd28ffbc7d81573c71b93667539abecdf55f40c28b62a8fed0c935d23281f0417c0413e63ac972ef3dfa3640c97cd210b3ebd79177a6a0bcc8
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
uscentral50.myserverhosts.com - Port:
587 - Username:
sales@radheatwaters.com - Password:
waters@789
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/688-66-0x000000000043763E-mapping.dmp family_agenttesla behavioral1/memory/688-65-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla behavioral1/memory/688-67-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla -
CustAttr .NET packer 1 IoCs
Detects CustAttr .NET packer in memory.
Processes:
resource yara_rule behavioral1/memory/1072-62-0x0000000000440000-0x000000000044B000-memory.dmp CustAttr -
Drops file in Drivers directory 1 IoCs
Processes:
RegSvcs.exedescription ioc process File opened for modification C:\Windows\system32\drivers\etc\hosts RegSvcs.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
RegSvcs.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\NXLun = "C:\\Users\\Admin\\AppData\\Roaming\\NXLun\\NXLun.exe" RegSvcs.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Payment Slip.exedescription pid process target process PID 1072 set thread context of 688 1072 Payment Slip.exe RegSvcs.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
Payment Slip.exeRegSvcs.exepid process 1072 Payment Slip.exe 688 RegSvcs.exe 688 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Payment Slip.exeRegSvcs.exedescription pid process Token: SeDebugPrivilege 1072 Payment Slip.exe Token: SeDebugPrivilege 688 RegSvcs.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
Payment Slip.exedescription pid process target process PID 1072 wrote to memory of 688 1072 Payment Slip.exe RegSvcs.exe PID 1072 wrote to memory of 688 1072 Payment Slip.exe RegSvcs.exe PID 1072 wrote to memory of 688 1072 Payment Slip.exe RegSvcs.exe PID 1072 wrote to memory of 688 1072 Payment Slip.exe RegSvcs.exe PID 1072 wrote to memory of 688 1072 Payment Slip.exe RegSvcs.exe PID 1072 wrote to memory of 688 1072 Payment Slip.exe RegSvcs.exe PID 1072 wrote to memory of 688 1072 Payment Slip.exe RegSvcs.exe PID 1072 wrote to memory of 688 1072 Payment Slip.exe RegSvcs.exe PID 1072 wrote to memory of 688 1072 Payment Slip.exe RegSvcs.exe PID 1072 wrote to memory of 688 1072 Payment Slip.exe RegSvcs.exe PID 1072 wrote to memory of 688 1072 Payment Slip.exe RegSvcs.exe PID 1072 wrote to memory of 688 1072 Payment Slip.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Payment Slip.exe"C:\Users\Admin\AppData\Local\Temp\Payment Slip.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/688-66-0x000000000043763E-mapping.dmp
-
memory/688-65-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/688-67-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/688-69-0x0000000004AF0000-0x0000000004AF1000-memory.dmpFilesize
4KB
-
memory/688-70-0x0000000004AF1000-0x0000000004AF2000-memory.dmpFilesize
4KB
-
memory/1072-59-0x0000000000CE0000-0x0000000000CE1000-memory.dmpFilesize
4KB
-
memory/1072-61-0x0000000004C60000-0x0000000004C61000-memory.dmpFilesize
4KB
-
memory/1072-62-0x0000000000440000-0x000000000044B000-memory.dmpFilesize
44KB
-
memory/1072-63-0x0000000005360000-0x00000000053DC000-memory.dmpFilesize
496KB
-
memory/1072-64-0x00000000007B0000-0x00000000007EE000-memory.dmpFilesize
248KB