Analysis
-
max time kernel
123s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
20-05-2022 23:45
Static task
static1
Behavioral task
behavioral1
Sample
payment advice.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
payment advice.exe
Resource
win10v2004-20220414-en
General
-
Target
payment advice.exe
-
Size
458KB
-
MD5
9a3578fcc5f1a7eb34775cf349fcab48
-
SHA1
5ca4483e86d077eaa6d18299dbcfb156d3abc98b
-
SHA256
c7f5f7669d517c51c3d5417f309c365f7f0a8dccc9a205626caf345805c5f653
-
SHA512
6782bb274c37c14b9a522a2563edf8fe894f5e6190de4f70dfacdaf2601e75eb506fb28f31861324677233253df12c6e5e8f55e2ce5e4abf3a203884d6cddcb8
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.rajhibulid.com - Port:
587 - Username:
[email protected] - Password:
chuks0147
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/1300-135-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla -
Drops file in Drivers directory 1 IoCs
Processes:
payment advice.exedescription ioc process File opened for modification C:\Windows\system32\drivers\etc\hosts payment advice.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
payment advice.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 payment advice.exe Key opened \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 payment advice.exe Key opened \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 payment advice.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
payment advice.exedescription pid process target process PID 3092 set thread context of 1300 3092 payment advice.exe payment advice.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
payment advice.exepayment advice.exepid process 3092 payment advice.exe 3092 payment advice.exe 3092 payment advice.exe 3092 payment advice.exe 3092 payment advice.exe 3092 payment advice.exe 1300 payment advice.exe 1300 payment advice.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
payment advice.exepayment advice.exedescription pid process Token: SeDebugPrivilege 3092 payment advice.exe Token: SeDebugPrivilege 1300 payment advice.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
payment advice.exepayment advice.exedescription pid process target process PID 3092 wrote to memory of 1300 3092 payment advice.exe payment advice.exe PID 3092 wrote to memory of 1300 3092 payment advice.exe payment advice.exe PID 3092 wrote to memory of 1300 3092 payment advice.exe payment advice.exe PID 3092 wrote to memory of 1300 3092 payment advice.exe payment advice.exe PID 3092 wrote to memory of 1300 3092 payment advice.exe payment advice.exe PID 3092 wrote to memory of 1300 3092 payment advice.exe payment advice.exe PID 3092 wrote to memory of 1300 3092 payment advice.exe payment advice.exe PID 3092 wrote to memory of 1300 3092 payment advice.exe payment advice.exe PID 1300 wrote to memory of 1920 1300 payment advice.exe REG.exe PID 1300 wrote to memory of 1920 1300 payment advice.exe REG.exe PID 1300 wrote to memory of 1920 1300 payment advice.exe REG.exe -
outlook_office_path 1 IoCs
Processes:
payment advice.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 payment advice.exe -
outlook_win_path 1 IoCs
Processes:
payment advice.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 payment advice.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\payment advice.exe"C:\Users\Admin\AppData\Local\Temp\payment advice.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\payment advice.exe"{path}"2⤵
- Drops file in Drivers directory
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
-
C:\Windows\SysWOW64\REG.exeREG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System / v DisableTaskMgr / t REG_DWORD / d 1 / f3⤵
- Modifies registry key
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\payment advice.exe.logFilesize
412B
MD5ad1c7f6525cfeb54c0487efd38b0e26c
SHA1ed3da94723ac7e3828a9e93d68418bb810592f3b
SHA2560a534a3d0fa82e6a427164c5f6e702cac7e4afc9967af9bc5ddba4f84ab33276
SHA51248d625e6be5391d91d95c2850226fe39bb2411cb72139797699cfe126e6b066182e83950a8ea67e63b64a66b0d45f58d8bc97cab0363d55c2fd88c0d1d28009c
-
memory/1300-134-0x0000000000000000-mapping.dmp
-
memory/1300-135-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1300-137-0x0000000005B20000-0x00000000060C4000-memory.dmpFilesize
5.6MB
-
memory/1300-138-0x0000000005AB0000-0x0000000005B16000-memory.dmpFilesize
408KB
-
memory/1300-139-0x0000000006A10000-0x0000000006A60000-memory.dmpFilesize
320KB
-
memory/1300-141-0x0000000006B70000-0x0000000006B7A000-memory.dmpFilesize
40KB
-
memory/1920-140-0x0000000000000000-mapping.dmp
-
memory/3092-131-0x0000000000500000-0x0000000000578000-memory.dmpFilesize
480KB
-
memory/3092-132-0x00000000052E0000-0x000000000537C000-memory.dmpFilesize
624KB
-
memory/3092-133-0x0000000005420000-0x00000000054B2000-memory.dmpFilesize
584KB