Overview

overview

10

Static

static

PAYMENT AD...__.exe

windows7_x64

10

PAYMENT AD...__.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    90s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    21-05-2022 02:29

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    PAYMENT ADVISE_Pdf__________.exe

  • Size

    730KB

  • MD5

    a0146d201d817b776384020b0d167cb7

  • SHA1

    e925ab7118c2a4852cbe56323530a136a2adb010

  • SHA256

    fdd6a733c719e505650b9eebfe1511ec9e41db1a8b254ae09e2252ffd6a58333

  • SHA512

    f2fb658b204c9c61ef363683bc3e7935f8ff30878a2cfd0ab7990b7be0734d916284807e64fefb9ac2a0dfdde7e2a9ce41b559cdca223d7bc04569b648706cb2

Score
10/10
agentteslacollectionkeyloggerpersistencespywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    mail.catathai.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    CatathaiCatamaran

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla
  • AgentTesla Payload 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
    collection
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious behavior: EnumeratesProcesses 13 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\PAYMENT ADVISE_Pdf__________.exe
    "C:\Users\Admin\AppData\Local\Temp\PAYMENT ADVISE_Pdf__________.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4592
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\sRaYruSQljs" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4585.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:360
    • C:\Users\Admin\AppData\Local\Temp\PAYMENT ADVISE_Pdf__________.exe
      "{path}"
      2⤵
        PID:3956
      • C:\Users\Admin\AppData\Local\Temp\PAYMENT ADVISE_Pdf__________.exe
        "{path}"
        2⤵
          PID:3732
        • C:\Users\Admin\AppData\Local\Temp\PAYMENT ADVISE_Pdf__________.exe
          "{path}"
          2⤵
            PID:4084
          • C:\Users\Admin\AppData\Local\Temp\PAYMENT ADVISE_Pdf__________.exe
            "{path}"
            2⤵
              PID:4020
            • C:\Users\Admin\AppData\Local\Temp\PAYMENT ADVISE_Pdf__________.exe
              "{path}"
              2⤵
              • Accesses Microsoft Outlook profiles
              • Adds Run key to start application
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • outlook_office_path
              • outlook_win_path
              PID:1500

          Network

          MITRE ATT&CK Matrix ATT&CK v6

          Initial Access

          Execution

          Scheduled Task

          1
          T1053

          Persistence

          Registry Run Keys / Startup Folder

          1
          T1060

          Scheduled Task

          1
          T1053

          Privilege Escalation

          Scheduled Task

          1
          T1053

          Defense Evasion

          Modify Registry

          1
          T1112

          Credential Access

          Credentials in Files

          3
          T1081

          Discovery

          Query Registry

          1
          T1012

          System Information Discovery

          2
          T1082

          Lateral Movement

          Collection

          Data from Local System

          3
          T1005

          Email Collection

          1
          T1114

          Exfiltration

          Command and Control

          Impact

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PAYMENT ADVISE_Pdf__________.exe.log
            Filesize

            694B

            MD5

            bdf183ab07e93a61448f0d0a74a05528

            SHA1

            9764c90df6ad34e4ed5d8fdf46929709313e9d88

            SHA256

            ce9330d47a374547fbe17749dfc50524611f3b53348bf4f77ed852b02b744333

            SHA512

            4ec55580f4332665369ae99517bebcdb94de7f96c56c30d16830381634fa5f7cfd863df2bb64c0cd302efe6cb09f6307d3e3d23fd83d89c0bf484bb1c583718f

            Download Submit
          • C:\Users\Admin\AppData\Local\Temp\tmp4585.tmp
            Filesize

            1KB

            MD5

            ed2e85e5ae7e096b20d555d85b2b75c3

            SHA1

            27b15f22ef1e51d45a5bc1849378545c5f2cdd6d

            SHA256

            49c81e0cd2ec8ab99520e8309400273381a327affce6faff1423fdf0aafe1d00

            SHA512

            83dfae31690208fa5c3b27ff6f524b49205b4413a6cf6b91dba06e85d726f0010949834b886b100461c742d40d780278eecbd7b897b6e50d9211fa8f6b0ed9a3

            Download Submit
          • memory/360-133-0x0000000000000000-mapping.dmp
            Download
          • memory/1500-142-0x0000000005930000-0x0000000005ED4000-memory.dmp
            Filesize

            5.6MB

            Download
          • memory/1500-139-0x0000000000000000-mapping.dmp
            Download
          • memory/1500-140-0x0000000000400000-0x0000000000466000-memory.dmp
            Filesize

            408KB

            Download
          • memory/1500-143-0x0000000005820000-0x0000000005886000-memory.dmp
            Filesize

            408KB

            Download
          • memory/1500-144-0x0000000006740000-0x0000000006790000-memory.dmp
            Filesize

            320KB

            Download
          • memory/1500-145-0x0000000006610000-0x000000000661A000-memory.dmp
            Filesize

            40KB

            Download
          • memory/3732-136-0x0000000000000000-mapping.dmp
            Download
          • memory/3956-135-0x0000000000000000-mapping.dmp
            Download
          • memory/4020-138-0x0000000000000000-mapping.dmp
            Download
          • memory/4084-137-0x0000000000000000-mapping.dmp
            Download
          • memory/4592-132-0x0000000005C40000-0x0000000005CD2000-memory.dmp
            Filesize

            584KB

            Download
          • memory/4592-131-0x00000000054D0000-0x000000000556C000-memory.dmp
            Filesize

            624KB

            Download
          • memory/4592-130-0x0000000000AA0000-0x0000000000B5C000-memory.dmp
            Filesize

            752KB

            Download