Analysis
-
max time kernel
137s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
20-05-2022 23:45
Static task
static1
Behavioral task
behavioral1
Sample
payment advice.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
payment advice.exe
Resource
win10v2004-20220414-en
General
-
Target
payment advice.exe
-
Size
458KB
-
MD5
9a3578fcc5f1a7eb34775cf349fcab48
-
SHA1
5ca4483e86d077eaa6d18299dbcfb156d3abc98b
-
SHA256
c7f5f7669d517c51c3d5417f309c365f7f0a8dccc9a205626caf345805c5f653
-
SHA512
6782bb274c37c14b9a522a2563edf8fe894f5e6190de4f70dfacdaf2601e75eb506fb28f31861324677233253df12c6e5e8f55e2ce5e4abf3a203884d6cddcb8
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.rajhibulid.com - Port:
587 - Username:
[email protected] - Password:
chuks0147
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/2028-61-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla behavioral1/memory/2028-62-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla behavioral1/memory/2028-63-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla behavioral1/memory/2028-64-0x00000000004473FE-mapping.dmp family_agenttesla behavioral1/memory/2028-66-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla behavioral1/memory/2028-68-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla -
Drops file in Drivers directory 1 IoCs
Processes:
payment advice.exedescription ioc process File opened for modification C:\Windows\system32\drivers\etc\hosts payment advice.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
payment advice.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 payment advice.exe Key opened \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 payment advice.exe Key opened \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 payment advice.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
payment advice.exedescription pid process target process PID 1380 set thread context of 2028 1380 payment advice.exe payment advice.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
payment advice.exepayment advice.exepid process 1380 payment advice.exe 1380 payment advice.exe 1380 payment advice.exe 1380 payment advice.exe 2028 payment advice.exe 2028 payment advice.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
payment advice.exepayment advice.exedescription pid process Token: SeDebugPrivilege 1380 payment advice.exe Token: SeDebugPrivilege 2028 payment advice.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
payment advice.exepayment advice.exedescription pid process target process PID 1380 wrote to memory of 2028 1380 payment advice.exe payment advice.exe PID 1380 wrote to memory of 2028 1380 payment advice.exe payment advice.exe PID 1380 wrote to memory of 2028 1380 payment advice.exe payment advice.exe PID 1380 wrote to memory of 2028 1380 payment advice.exe payment advice.exe PID 1380 wrote to memory of 2028 1380 payment advice.exe payment advice.exe PID 1380 wrote to memory of 2028 1380 payment advice.exe payment advice.exe PID 1380 wrote to memory of 2028 1380 payment advice.exe payment advice.exe PID 1380 wrote to memory of 2028 1380 payment advice.exe payment advice.exe PID 1380 wrote to memory of 2028 1380 payment advice.exe payment advice.exe PID 2028 wrote to memory of 1096 2028 payment advice.exe REG.exe PID 2028 wrote to memory of 1096 2028 payment advice.exe REG.exe PID 2028 wrote to memory of 1096 2028 payment advice.exe REG.exe PID 2028 wrote to memory of 1096 2028 payment advice.exe REG.exe -
outlook_office_path 1 IoCs
Processes:
payment advice.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 payment advice.exe -
outlook_win_path 1 IoCs
Processes:
payment advice.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 payment advice.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\payment advice.exe"C:\Users\Admin\AppData\Local\Temp\payment advice.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\payment advice.exe"{path}"2⤵
- Drops file in Drivers directory
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
-
C:\Windows\SysWOW64\REG.exeREG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System / v DisableTaskMgr / t REG_DWORD / d 1 / f3⤵
- Modifies registry key
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1096-70-0x0000000000000000-mapping.dmp
-
memory/1380-54-0x0000000001270000-0x00000000012E8000-memory.dmpFilesize
480KB
-
memory/1380-55-0x0000000000490000-0x000000000049A000-memory.dmpFilesize
40KB
-
memory/1380-56-0x00000000005C0000-0x0000000000628000-memory.dmpFilesize
416KB
-
memory/1380-57-0x0000000000E30000-0x0000000000E7C000-memory.dmpFilesize
304KB
-
memory/2028-61-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/2028-59-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/2028-62-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/2028-63-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/2028-64-0x00000000004473FE-mapping.dmp
-
memory/2028-66-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/2028-68-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/2028-69-0x0000000075871000-0x0000000075873000-memory.dmpFilesize
8KB
-
memory/2028-58-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB