Analysis
-
max time kernel
203s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
20-05-2022 22:57
Static task
static1
Behavioral task
behavioral1
Sample
NEW INVOICE.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
NEW INVOICE.exe
Resource
win10v2004-20220414-en
General
-
Target
NEW INVOICE.exe
-
Size
561KB
-
MD5
55b95046471af229ee99c420a9305466
-
SHA1
5722d102e4010564f2428ed878c58a8a6a865e45
-
SHA256
f63a89559c83329e8ea8f79ad5cbd03d3ae2f5a71312f26feecc132379c14eab
-
SHA512
8eddf9d88a340fc70201fc6c2dd4b9ac9cf4523e0de24404ed2fe7ca98a832d4a30786ce82234829a2ef93d85ac83547829660cb121b0a19a7ca26af6dba9e69
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.proetizo.com - Port:
587 - Username:
[email protected] - Password:
:n7#l_CcH8wh
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/1820-63-0x0000000000400000-0x000000000044E000-memory.dmp family_agenttesla behavioral1/memory/1820-64-0x0000000000400000-0x000000000044E000-memory.dmp family_agenttesla behavioral1/memory/1820-65-0x0000000000400000-0x000000000044E000-memory.dmp family_agenttesla behavioral1/memory/1820-66-0x0000000000447FFE-mapping.dmp family_agenttesla behavioral1/memory/1820-70-0x0000000000400000-0x000000000044E000-memory.dmp family_agenttesla behavioral1/memory/1820-68-0x0000000000400000-0x000000000044E000-memory.dmp family_agenttesla -
ReZer0 packer 1 IoCs
Detects ReZer0, a packer with multiple versions used in various campaigns.
Processes:
resource yara_rule behavioral1/memory/1940-57-0x00000000047D0000-0x0000000004824000-memory.dmp rezer0 -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
RegSvcs.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe Key opened \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe Key opened \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
NEW INVOICE.exedescription pid process target process PID 1940 set thread context of 1820 1940 NEW INVOICE.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
NEW INVOICE.exeRegSvcs.exepid process 1940 NEW INVOICE.exe 1940 NEW INVOICE.exe 1940 NEW INVOICE.exe 1820 RegSvcs.exe 1820 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
NEW INVOICE.exeRegSvcs.exedescription pid process Token: SeDebugPrivilege 1940 NEW INVOICE.exe Token: SeDebugPrivilege 1820 RegSvcs.exe -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
NEW INVOICE.exedescription pid process target process PID 1940 wrote to memory of 1732 1940 NEW INVOICE.exe schtasks.exe PID 1940 wrote to memory of 1732 1940 NEW INVOICE.exe schtasks.exe PID 1940 wrote to memory of 1732 1940 NEW INVOICE.exe schtasks.exe PID 1940 wrote to memory of 1732 1940 NEW INVOICE.exe schtasks.exe PID 1940 wrote to memory of 876 1940 NEW INVOICE.exe RegSvcs.exe PID 1940 wrote to memory of 876 1940 NEW INVOICE.exe RegSvcs.exe PID 1940 wrote to memory of 876 1940 NEW INVOICE.exe RegSvcs.exe PID 1940 wrote to memory of 876 1940 NEW INVOICE.exe RegSvcs.exe PID 1940 wrote to memory of 876 1940 NEW INVOICE.exe RegSvcs.exe PID 1940 wrote to memory of 876 1940 NEW INVOICE.exe RegSvcs.exe PID 1940 wrote to memory of 876 1940 NEW INVOICE.exe RegSvcs.exe PID 1940 wrote to memory of 1820 1940 NEW INVOICE.exe RegSvcs.exe PID 1940 wrote to memory of 1820 1940 NEW INVOICE.exe RegSvcs.exe PID 1940 wrote to memory of 1820 1940 NEW INVOICE.exe RegSvcs.exe PID 1940 wrote to memory of 1820 1940 NEW INVOICE.exe RegSvcs.exe PID 1940 wrote to memory of 1820 1940 NEW INVOICE.exe RegSvcs.exe PID 1940 wrote to memory of 1820 1940 NEW INVOICE.exe RegSvcs.exe PID 1940 wrote to memory of 1820 1940 NEW INVOICE.exe RegSvcs.exe PID 1940 wrote to memory of 1820 1940 NEW INVOICE.exe RegSvcs.exe PID 1940 wrote to memory of 1820 1940 NEW INVOICE.exe RegSvcs.exe PID 1940 wrote to memory of 1820 1940 NEW INVOICE.exe RegSvcs.exe PID 1940 wrote to memory of 1820 1940 NEW INVOICE.exe RegSvcs.exe PID 1940 wrote to memory of 1820 1940 NEW INVOICE.exe RegSvcs.exe -
outlook_office_path 1 IoCs
Processes:
RegSvcs.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe -
outlook_win_path 1 IoCs
Processes:
RegSvcs.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEW INVOICE.exe"C:\Users\Admin\AppData\Local\Temp\NEW INVOICE.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\aVEwpDPWQpr" /XML "C:\Users\Admin\AppData\Local\Temp\tmp77CF.tmp"2⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp77CF.tmpFilesize
1KB
MD59de937f4b0fa1d3c73169b0aac6f275e
SHA12765f1abd8bdeb849771f44ffba53b5739eada1e
SHA256629d656a1623fe01b3b3478d9be2f853629eaeb7aabc0467ca21afd9c452ee30
SHA512daebc3f6b9b78659d955996c92de8eccfbbda92883a41f26ba83c07bbbd414853419de54496a6962bb58ecbf06209e0b9e4b281869848b366e86fd5144d7c9cd
-
memory/1732-58-0x0000000000000000-mapping.dmp
-
memory/1820-64-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/1820-60-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/1820-61-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/1820-63-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/1820-65-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/1820-66-0x0000000000447FFE-mapping.dmp
-
memory/1820-70-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/1820-68-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/1820-71-0x0000000075941000-0x0000000075943000-memory.dmpFilesize
8KB
-
memory/1940-57-0x00000000047D0000-0x0000000004824000-memory.dmpFilesize
336KB
-
memory/1940-56-0x0000000000580000-0x0000000000588000-memory.dmpFilesize
32KB
-
memory/1940-55-0x0000000000970000-0x00000000009CE000-memory.dmpFilesize
376KB
-
memory/1940-54-0x0000000001250000-0x00000000012E6000-memory.dmpFilesize
600KB