Analysis
-
max time kernel
134s -
max time network
51s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
14-10-2021 05:56
Static task
static1
Behavioral task
behavioral1
Sample
Payment_Swift,png.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
Payment_Swift,png.exe
Resource
win10-en-20210920
General
-
Target
Payment_Swift,png.exe
-
Size
275KB
-
MD5
f589816b35976438b88a621266d7d071
-
SHA1
1a845d22e5378b8771536806bb312f6ded7b1046
-
SHA256
e4c466fd6fb96b2ffc5682a75154df8501c8edb5234b14349ba5c01afc717b12
-
SHA512
c6a92f6520791f55b3603472451d09a7ab659cc93f5d66fabaece8293432889be07830a21da65cf8ee2b72d24890e7f571649e9a6f30ece48e7858549a349d67
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.alishair.rs - Port:
587 - Username:
info@alishair.rs - Password:
qR8JmTXtlKf0
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1988-62-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla behavioral1/memory/1988-63-0x000000000040188B-mapping.dmp family_agenttesla behavioral1/memory/1988-65-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla behavioral1/memory/1988-66-0x0000000001DC0000-0x0000000001DF7000-memory.dmp family_agenttesla -
Loads dropped DLL 1 IoCs
Processes:
Payment_Swift,png.exepid process 1208 Payment_Swift,png.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
Payment_Swift,png.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Payment_Swift,png.exe Key opened \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Payment_Swift,png.exe Key opened \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Payment_Swift,png.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Payment_Swift,png.exedescription pid process target process PID 1208 set thread context of 1988 1208 Payment_Swift,png.exe Payment_Swift,png.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
Payment_Swift,png.exepid process 1988 Payment_Swift,png.exe 1988 Payment_Swift,png.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
Payment_Swift,png.exepid process 1988 Payment_Swift,png.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Payment_Swift,png.exedescription pid process Token: SeDebugPrivilege 1988 Payment_Swift,png.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
Payment_Swift,png.exedescription pid process target process PID 1208 wrote to memory of 1988 1208 Payment_Swift,png.exe Payment_Swift,png.exe PID 1208 wrote to memory of 1988 1208 Payment_Swift,png.exe Payment_Swift,png.exe PID 1208 wrote to memory of 1988 1208 Payment_Swift,png.exe Payment_Swift,png.exe PID 1208 wrote to memory of 1988 1208 Payment_Swift,png.exe Payment_Swift,png.exe PID 1208 wrote to memory of 1988 1208 Payment_Swift,png.exe Payment_Swift,png.exe PID 1208 wrote to memory of 1988 1208 Payment_Swift,png.exe Payment_Swift,png.exe PID 1208 wrote to memory of 1988 1208 Payment_Swift,png.exe Payment_Swift,png.exe PID 1208 wrote to memory of 1988 1208 Payment_Swift,png.exe Payment_Swift,png.exe PID 1208 wrote to memory of 1988 1208 Payment_Swift,png.exe Payment_Swift,png.exe PID 1208 wrote to memory of 1988 1208 Payment_Swift,png.exe Payment_Swift,png.exe PID 1208 wrote to memory of 1988 1208 Payment_Swift,png.exe Payment_Swift,png.exe -
outlook_office_path 1 IoCs
Processes:
Payment_Swift,png.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Payment_Swift,png.exe -
outlook_win_path 1 IoCs
Processes:
Payment_Swift,png.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Payment_Swift,png.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Payment_Swift,png.exe"C:\Users\Admin\AppData\Local\Temp\Payment_Swift,png.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Payment_Swift,png.exe"C:\Users\Admin\AppData\Local\Temp\Payment_Swift,png.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\nsdE052.tmp\qxtkzfqfq.dllMD5
0a629d4790598a83061d053f4a3aa8aa
SHA1f1c78ca24c874e7fc6a7028703c17672bc91167b
SHA25607190acb0aed8a2899cd3edd16e08e1029c105c5808f7023f3320d3c6378833c
SHA5129f9af53ef9cfcf9d231a4922516483671043a552c06c9310a36a4bff631f8f8624b1abbcaa8d4083e7b2e1dea4aaac7960e25a90770dedc1c1ab106ce502a9d0
-
memory/1208-60-0x0000000075C71000-0x0000000075C73000-memory.dmpFilesize
8KB
-
memory/1988-62-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1988-63-0x000000000040188B-mapping.dmp
-
memory/1988-65-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1988-66-0x0000000001DC0000-0x0000000001DF7000-memory.dmpFilesize
220KB
-
memory/1988-69-0x0000000004722000-0x0000000004723000-memory.dmpFilesize
4KB
-
memory/1988-68-0x0000000004721000-0x0000000004722000-memory.dmpFilesize
4KB
-
memory/1988-70-0x0000000004723000-0x0000000004724000-memory.dmpFilesize
4KB
-
memory/1988-71-0x0000000004724000-0x0000000004725000-memory.dmpFilesize
4KB