Overview

overview

10

Static

static

invoice#2347930.exe

windows7_x64

10

invoice#2347930.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    146s
  • max time network
    158s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    21-05-2022 00:23

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    invoice#2347930.exe

  • Size

    678KB

  • MD5

    023ca5b91965a4ea652154c839dd33c6

  • SHA1

    76bdbfb5e42ac74ffd79773bc28d2edbb05bd224

  • SHA256

    48d31b2e1bea5847cde1ae85f6f9997d6dc301222463971a713e381e3fb2d1e8

  • SHA512

    d43547d161054c72eadf4fd6ec8d202f3e1774f941c8ffcbba2dcc26009998f1439b255046ceb349eb16fb5c0e0287993ba86de4f29ef6135b2b13af6bd1fda7

Score
10/10
agentteslacollectionevasionkeyloggerspywarestealertrojan

Malware Config

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    mail.cybix.in
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    cybix@16july

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    mail.cybix.in
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    cybix@16july

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla
  • AgentTesla Payload 1 IoCs
  • Looks for VirtualBox Guest Additions in registry 2 TTPs
    evasion
  • Looks for VMWare Tools registry key 2 TTPs
    evasion
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
    collection
  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious behavior: EnumeratesProcesses 13 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\invoice#2347930.exe
    "C:\Users\Admin\AppData\Local\Temp\invoice#2347930.exe"
    1⤵
    • Checks BIOS information in registry
    • Checks computer location settings
    • Maps connected drives based on registry
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3388
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\pHqSfGF" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF7DD.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:3392
    • C:\Users\Admin\AppData\Local\Temp\invoice#2347930.exe
      "{path}"
      2⤵
        PID:1340
      • C:\Users\Admin\AppData\Local\Temp\invoice#2347930.exe
        "{path}"
        2⤵
          PID:4824
        • C:\Users\Admin\AppData\Local\Temp\invoice#2347930.exe
          "{path}"
          2⤵
          • Accesses Microsoft Outlook profiles
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • outlook_office_path
          • outlook_win_path
          PID:5044

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Initial Access

      Execution

      Scheduled Task

      1
      T1053

      Persistence

      Scheduled Task

      1
      T1053

      Privilege Escalation

      Scheduled Task

      1
      T1053

      Defense Evasion

      Virtualization/Sandbox Evasion

      2
      T1497

      Credential Access

      Credentials in Files

      3
      T1081

      Discovery

      Query Registry

      5
      T1012

      Virtualization/Sandbox Evasion

      2
      T1497

      System Information Discovery

      4
      T1082

      Peripheral Device Discovery

      1
      T1120

      Lateral Movement

      Collection

      Data from Local System

      3
      T1005

      Email Collection

      1
      T1114

      Exfiltration

      Command and Control

      Impact

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\invoice#2347930.exe.log
        Filesize

        1KB

        MD5

        d51429e0af98d49d9f8ad3bc303fe83b

        SHA1

        50b4e3b7c101706798afa7a3acb24ae54a91a8f6

        SHA256

        10be89c07fa1451c711655bf49a2a1d5e4db8085add97f3b744091f50f40f57c

        SHA512

        ee2ece2e0464f1fac07b4573760628c5407c874812c5f6553a118202845be9553e0206bfc44198fc63fa574ff0d091feef3257991333454d2982133c56f39205

        Download Submit
      • C:\Users\Admin\AppData\Local\Temp\tmpF7DD.tmp
        Filesize

        1KB

        MD5

        7141bd53fd47d91395c7f1491ddd3d2c

        SHA1

        641c77e9122e5198730c1fd24db07a9113b67498

        SHA256

        95b26f8921ac6e5b4101459d158df990b2a67554ae7a81e8d172835b40ad7e31

        SHA512

        c630527e3c7ad5c9b88efe37bd3351df5c29e6e0297b8a358862cbc353e0a68bd9fd23741a527ba07a89314af57c8f06358d96a88da066337a81fa659f3cf8e7

        Download Submit
      • memory/1340-138-0x0000000000000000-mapping.dmp
        Download
      • memory/3388-131-0x0000000005C90000-0x0000000006234000-memory.dmp
        Filesize

        5.6MB

        Download
      • memory/3388-132-0x00000000058C0000-0x0000000005952000-memory.dmp
        Filesize

        584KB

        Download
      • memory/3388-133-0x00000000058B0000-0x00000000058BA000-memory.dmp
        Filesize

        40KB

        Download
      • memory/3388-134-0x000000000D720000-0x000000000D7BC000-memory.dmp
        Filesize

        624KB

        Download
      • memory/3388-135-0x000000000EF90000-0x000000000EFF6000-memory.dmp
        Filesize

        408KB

        Download
      • memory/3388-130-0x0000000000AC0000-0x0000000000B6E000-memory.dmp
        Filesize

        696KB

        Download
      • memory/3392-136-0x0000000000000000-mapping.dmp
        Download
      • memory/4824-139-0x0000000000000000-mapping.dmp
        Download
      • memory/5044-140-0x0000000000000000-mapping.dmp
        Download
      • memory/5044-141-0x0000000000400000-0x000000000044C000-memory.dmp
        Filesize

        304KB

        Download
      • memory/5044-143-0x0000000006B40000-0x0000000006B90000-memory.dmp
        Filesize

        320KB

        Download