Analysis
-
max time kernel
144s -
max time network
42s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 01:16
General
-
Target
Payment Advice.pdf.exe
-
Size
455KB
-
MD5
6ad6ceabd5276ef0ac02cacaeb8ec2b0
-
SHA1
fb3b7b648078309f40db8fe6bb463f9315cf66d5
-
SHA256
5ce2d2774ba40e6dc9997abefd9d8d50321eb37b26e3b6963add26877f036a3e
-
SHA512
496713183cbcaace5d526ce0bcbbfedd294caa60336ce8191bda10cf086c3ef80bb23246a307709b94f5d793c4376c1b2568b376d94fafccec037a8ebf393aee
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.ahrass.com - Port:
587 - Username:
[email protected] - Password:
chukwuma22
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
CoreEntity .NET Packer 1 IoCs
A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.
-
AgentTesla Payload 6 IoCs
-
ReZer0 packer 1 IoCs
Detects ReZer0, a packer with multiple versions used in various campaigns.
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 13 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Payment Advice.pdf.exe"C:\Users\Admin\AppData\Local\Temp\Payment Advice.pdf.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\SsSTSLAZdec" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5BF6.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\Payment Advice.pdf.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp5BF6.tmpFilesize
1KB
MD546f7f69aec1b40aad0242ae88095e1c8
SHA10722f4152ffe5ccd432cbb9acdc6e0baa6114876
SHA25684a315859665a5ff4de38151f60914268302218e976c5bdf34caf0ac696976a1
SHA5127a498e5f89f2d31cd6290a598f9f83d51a9bfd1903833eccf1f76ba9a131d5d205a141034d797e4cb3eee6e9f7044ec74249f0455ea6dbb272a51422e907f98f
-
memory/952-58-0x0000000000000000-mapping.dmp
-
memory/1256-64-0x0000000000400000-0x0000000000452000-memory.dmpFilesize
328KB
-
memory/1256-60-0x0000000000400000-0x0000000000452000-memory.dmpFilesize
328KB
-
memory/1256-61-0x0000000000400000-0x0000000000452000-memory.dmpFilesize
328KB
-
memory/1256-63-0x0000000000400000-0x0000000000452000-memory.dmpFilesize
328KB
-
memory/1256-65-0x0000000000400000-0x0000000000452000-memory.dmpFilesize
328KB
-
memory/1256-66-0x000000000044CC2E-mapping.dmp
-
memory/1256-68-0x0000000000400000-0x0000000000452000-memory.dmpFilesize
328KB
-
memory/1256-70-0x0000000000400000-0x0000000000452000-memory.dmpFilesize
328KB
-
memory/1868-57-0x0000000000670000-0x00000000006C8000-memory.dmpFilesize
352KB
-
memory/1868-56-0x00000000004F0000-0x00000000004F8000-memory.dmpFilesize
32KB
-
memory/1868-55-0x00000000759E1000-0x00000000759E3000-memory.dmpFilesize
8KB
-
memory/1868-54-0x0000000000330000-0x00000000003A8000-memory.dmpFilesize
480KB