Analysis
- max time kernel
159s - max time network
172s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
08/02/2022, 02:00
Static task
static1
Behavioral task
behavioral1
Sample
STATEMENT OF ACCOUNT February 6, 2022..exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
STATEMENT OF ACCOUNT February 6, 2022..exe
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
General
- Target STATEMENT OF ACCOUNT February 6, 2022..exe
- Size 598KB
- Sample220208-ce2anscaa8
- SHA256 0ecdaed3a2f731cdf1a09bb7aa353d3c9dabb5898409e249edb3dbda64569cbb
- MD5 f3f7a3916f709a22a51cde0483274999
- SHA1 c45462ff355257070d83d1e777e2535405337fe8
- SHA512 0706d2f89df40a51738dd064f248b71d8691e05ccdcb99831552fc0983586aebf2f8d828818124443d6b612b9a960ba9653b86606cfeb6d2d31f7b77106e4eee
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Family
-
agenttesla
Credentials
-
Protocol
smtp
-
Host
us2.smtp.mailhostbox.com
-
Port
587
-
Username
-
Password
BkKMmzZ1
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- AgentTesla Payload 1 IoCs
resource yara_rule behavioral2/memory/4132-150-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3240 set thread context of 4132 3240 STATEMENT OF ACCOUNT February 6, 2022..exe 98 - Drops file in Windows directory 8 IoCs
description ioc Process File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log svchost.exe File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe File opened for modification C:\Windows\WinSxS\pending.xml TiWorker.exe File opened for modification C:\Windows\WindowsUpdate.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm svchost.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3240 STATEMENT OF ACCOUNT February 6, 2022..exe 3240 STATEMENT OF ACCOUNT February 6, 2022..exe 3240 STATEMENT OF ACCOUNT February 6, 2022..exe 3240 STATEMENT OF ACCOUNT February 6, 2022..exe 4132 STATEMENT OF ACCOUNT February 6, 2022..exe 4132 STATEMENT OF ACCOUNT February 6, 2022..exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3136 svchost.exe Token: SeCreatePagefilePrivilege 3136 svchost.exe Token: SeShutdownPrivilege 3136 svchost.exe Token: SeCreatePagefilePrivilege 3136 svchost.exe Token: SeShutdownPrivilege 3136 svchost.exe Token: SeCreatePagefilePrivilege 3136 svchost.exe Token: SeDebugPrivilege 3240 STATEMENT OF ACCOUNT February 6, 2022..exe Token: SeDebugPrivilege 4132 STATEMENT OF ACCOUNT February 6, 2022..exe Token: SeSecurityPrivilege 1828 TiWorker.exe Token: SeRestorePrivilege 1828 TiWorker.exe Token: SeBackupPrivilege 1828 TiWorker.exe Token: SeBackupPrivilege 1828 TiWorker.exe Token: SeRestorePrivilege 1828 TiWorker.exe Token: SeSecurityPrivilege 1828 TiWorker.exe Token: SeBackupPrivilege 1828 TiWorker.exe Token: SeRestorePrivilege 1828 TiWorker.exe Token: SeSecurityPrivilege 1828 TiWorker.exe Token: SeBackupPrivilege 1828 TiWorker.exe Token: SeRestorePrivilege 1828 TiWorker.exe Token: SeSecurityPrivilege 1828 TiWorker.exe Token: SeBackupPrivilege 1828 TiWorker.exe Token: SeRestorePrivilege 1828 TiWorker.exe Token: SeSecurityPrivilege 1828 TiWorker.exe Token: SeBackupPrivilege 1828 TiWorker.exe Token: SeRestorePrivilege 1828 TiWorker.exe Token: SeSecurityPrivilege 1828 TiWorker.exe Token: SeBackupPrivilege 1828 TiWorker.exe Token: SeRestorePrivilege 1828 TiWorker.exe Token: SeSecurityPrivilege 1828 TiWorker.exe Token: SeBackupPrivilege 1828 TiWorker.exe Token: SeRestorePrivilege 1828 TiWorker.exe Token: SeSecurityPrivilege 1828 TiWorker.exe Token: SeBackupPrivilege 1828 TiWorker.exe Token: SeRestorePrivilege 1828 TiWorker.exe Token: SeSecurityPrivilege 1828 TiWorker.exe Token: SeBackupPrivilege 1828 TiWorker.exe Token: SeRestorePrivilege 1828 TiWorker.exe Token: SeSecurityPrivilege 1828 TiWorker.exe Token: SeBackupPrivilege 1828 TiWorker.exe Token: SeRestorePrivilege 1828 TiWorker.exe Token: SeSecurityPrivilege 1828 TiWorker.exe Token: SeBackupPrivilege 1828 TiWorker.exe Token: SeRestorePrivilege 1828 TiWorker.exe Token: SeSecurityPrivilege 1828 TiWorker.exe Token: SeBackupPrivilege 1828 TiWorker.exe Token: SeRestorePrivilege 1828 TiWorker.exe Token: SeSecurityPrivilege 1828 TiWorker.exe Token: SeBackupPrivilege 1828 TiWorker.exe Token: SeRestorePrivilege 1828 TiWorker.exe Token: SeSecurityPrivilege 1828 TiWorker.exe Token: SeBackupPrivilege 1828 TiWorker.exe Token: SeRestorePrivilege 1828 TiWorker.exe Token: SeSecurityPrivilege 1828 TiWorker.exe Token: SeBackupPrivilege 1828 TiWorker.exe Token: SeRestorePrivilege 1828 TiWorker.exe Token: SeSecurityPrivilege 1828 TiWorker.exe Token: SeBackupPrivilege 1828 TiWorker.exe Token: SeRestorePrivilege 1828 TiWorker.exe Token: SeSecurityPrivilege 1828 TiWorker.exe Token: SeBackupPrivilege 1828 TiWorker.exe Token: SeRestorePrivilege 1828 TiWorker.exe Token: SeSecurityPrivilege 1828 TiWorker.exe Token: SeBackupPrivilege 1828 TiWorker.exe Token: SeRestorePrivilege 1828 TiWorker.exe - Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 3240 wrote to memory of 3464 3240 STATEMENT OF ACCOUNT February 6, 2022..exe 96 PID 3240 wrote to memory of 3464 3240 STATEMENT OF ACCOUNT February 6, 2022..exe 96 PID 3240 wrote to memory of 3464 3240 STATEMENT OF ACCOUNT February 6, 2022..exe 96 PID 3240 wrote to memory of 2984 3240 STATEMENT OF ACCOUNT February 6, 2022..exe 97 PID 3240 wrote to memory of 2984 3240 STATEMENT OF ACCOUNT February 6, 2022..exe 97 PID 3240 wrote to memory of 2984 3240 STATEMENT OF ACCOUNT February 6, 2022..exe 97 PID 3240 wrote to memory of 4132 3240 STATEMENT OF ACCOUNT February 6, 2022..exe 98 PID 3240 wrote to memory of 4132 3240 STATEMENT OF ACCOUNT February 6, 2022..exe 98 PID 3240 wrote to memory of 4132 3240 STATEMENT OF ACCOUNT February 6, 2022..exe 98 PID 3240 wrote to memory of 4132 3240 STATEMENT OF ACCOUNT February 6, 2022..exe 98 PID 3240 wrote to memory of 4132 3240 STATEMENT OF ACCOUNT February 6, 2022..exe 98 PID 3240 wrote to memory of 4132 3240 STATEMENT OF ACCOUNT February 6, 2022..exe 98 PID 3240 wrote to memory of 4132 3240 STATEMENT OF ACCOUNT February 6, 2022..exe 98 PID 3240 wrote to memory of 4132 3240 STATEMENT OF ACCOUNT February 6, 2022..exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\STATEMENT OF ACCOUNT February 6, 2022..exe"C:\Users\Admin\AppData\Local\Temp\STATEMENT OF ACCOUNT February 6, 2022..exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3240 -
C:\Users\Admin\AppData\Local\Temp\STATEMENT OF ACCOUNT February 6, 2022..exe"C:\Users\Admin\AppData\Local\Temp\STATEMENT OF ACCOUNT February 6, 2022..exe"2⤵PID:3464
-
-
C:\Users\Admin\AppData\Local\Temp\STATEMENT OF ACCOUNT February 6, 2022..exe"C:\Users\Admin\AppData\Local\Temp\STATEMENT OF ACCOUNT February 6, 2022..exe"2⤵PID:2984
-
-
C:\Users\Admin\AppData\Local\Temp\STATEMENT OF ACCOUNT February 6, 2022..exe"C:\Users\Admin\AppData\Local\Temp\STATEMENT OF ACCOUNT February 6, 2022..exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4132
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3136
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1828