Analysis
-
max time kernel
116s -
max time network
43s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 01:30
Static task
static1
Behavioral task
behavioral1
Sample
BANK_ACC.exe
Resource
win7-20220414-en
General
-
Target
BANK_ACC.exe
-
Size
472KB
-
MD5
7c900acb04fc360427fa4c15292a7efe
-
SHA1
ca0468c0aa0883532a8f7a4853620653978a8e58
-
SHA256
42fcf6a2253cd374d0b8173e7e5278b00780bb0ddff8a3169254f2bff424f916
-
SHA512
949fa27ad01cbc24add00579ed5022f33fa62070bc95baff5af206532406d459ae65b92f207e6961cfd3046159eb14764958f8a432efac454197a075d50d530a
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.haden-tours.com - Port:
587 - Username:
[email protected] - Password:
In-159753
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/1160-63-0x0000000000400000-0x000000000044E000-memory.dmp family_agenttesla behavioral1/memory/1160-64-0x0000000000400000-0x000000000044E000-memory.dmp family_agenttesla behavioral1/memory/1160-65-0x0000000000400000-0x000000000044E000-memory.dmp family_agenttesla behavioral1/memory/1160-66-0x00000000004485FE-mapping.dmp family_agenttesla behavioral1/memory/1160-68-0x0000000000400000-0x000000000044E000-memory.dmp family_agenttesla behavioral1/memory/1160-70-0x0000000000400000-0x000000000044E000-memory.dmp family_agenttesla -
Looks for VirtualBox Guest Additions in registry 2 TTPs
-
Looks for VMWare Tools registry key 2 TTPs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
BANK_ACC.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion BANK_ACC.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion BANK_ACC.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
BANK_ACC.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum BANK_ACC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 BANK_ACC.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
BANK_ACC.exedescription pid process target process PID 1884 set thread context of 1160 1884 BANK_ACC.exe BANK_ACC.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
BANK_ACC.exepid process 1884 BANK_ACC.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
BANK_ACC.exedescription pid process Token: SeDebugPrivilege 1884 BANK_ACC.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
BANK_ACC.exedescription pid process target process PID 1884 wrote to memory of 1432 1884 BANK_ACC.exe schtasks.exe PID 1884 wrote to memory of 1432 1884 BANK_ACC.exe schtasks.exe PID 1884 wrote to memory of 1432 1884 BANK_ACC.exe schtasks.exe PID 1884 wrote to memory of 1432 1884 BANK_ACC.exe schtasks.exe PID 1884 wrote to memory of 1160 1884 BANK_ACC.exe BANK_ACC.exe PID 1884 wrote to memory of 1160 1884 BANK_ACC.exe BANK_ACC.exe PID 1884 wrote to memory of 1160 1884 BANK_ACC.exe BANK_ACC.exe PID 1884 wrote to memory of 1160 1884 BANK_ACC.exe BANK_ACC.exe PID 1884 wrote to memory of 1160 1884 BANK_ACC.exe BANK_ACC.exe PID 1884 wrote to memory of 1160 1884 BANK_ACC.exe BANK_ACC.exe PID 1884 wrote to memory of 1160 1884 BANK_ACC.exe BANK_ACC.exe PID 1884 wrote to memory of 1160 1884 BANK_ACC.exe BANK_ACC.exe PID 1884 wrote to memory of 1160 1884 BANK_ACC.exe BANK_ACC.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\BANK_ACC.exe"C:\Users\Admin\AppData\Local\Temp\BANK_ACC.exe"1⤵
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\XuGrfbQGvcx" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD4BE.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\BANK_ACC.exe"{path}"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpD4BE.tmpFilesize
1KB
MD5eaa4fea991cc6f02814ca81a0c53386f
SHA1d1693f9b0958b6f6663758d25fc6ba4cbb8f7b70
SHA256dfa179cf9285fffb2dc94904795f9df508a477e91b1317d5617107595884e4ef
SHA512bd360e48942c398dab959bb1bfcf051b89bc8cd15e0a1041f98297710bca81ccfbcb1f1496bceb2151f4356d32a285104a17a89beb219a0217b279ccf979ce5f
-
memory/1160-64-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/1160-60-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/1160-61-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/1160-63-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/1160-65-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/1160-66-0x00000000004485FE-mapping.dmp
-
memory/1160-68-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/1160-70-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/1432-58-0x0000000000000000-mapping.dmp
-
memory/1884-56-0x00000000004B0000-0x00000000004B8000-memory.dmpFilesize
32KB
-
memory/1884-57-0x0000000000EF0000-0x0000000000F46000-memory.dmpFilesize
344KB
-
memory/1884-55-0x0000000075191000-0x0000000075193000-memory.dmpFilesize
8KB
-
memory/1884-54-0x0000000000F60000-0x0000000000FDC000-memory.dmpFilesize
496KB