Analysis
-
max time kernel
91s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
21-05-2022 10:51
Static task
static1
Behavioral task
behavioral1
Sample
cheque deposit slip, BDT Amount 70,000.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
cheque deposit slip, BDT Amount 70,000.exe
Resource
win10v2004-20220414-en
General
-
Target
cheque deposit slip, BDT Amount 70,000.exe
-
Size
719KB
-
MD5
d207440e1ddcfd07dd367716b4352ad8
-
SHA1
99c84cd904ecfc83d818ae91853b9b8135e6f447
-
SHA256
fb2089862c97bb7765b51eda264b7338e5e32f71a70412926643a8991ce97c98
-
SHA512
9ab4c5a48af1a2927416b8f6ceed6b0cd6071d2f135f7b04a155f2cb540734882dd6ca434b5667899a426d193e6c1b25bd45f1c10ed39379fa9edd1c76234327
Malware Config
Extracted
Protocol: smtp- Host:
mail.totallyanonymous.com - Port:
587 - Username:
[email protected] - Password:
506g239R
Extracted
agenttesla
Protocol: smtp- Host:
mail.totallyanonymous.com - Port:
587 - Username:
[email protected] - Password:
506g239R
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/4884-133-0x00000000009E0000-0x0000000000A32000-memory.dmp family_agenttesla behavioral2/memory/4884-132-0x00000000009E0000-0x0000000000A32000-memory.dmp family_agenttesla -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
cheque deposit slip, BDT Amount 70,000.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 cheque deposit slip, BDT Amount 70,000.exe Key opened \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 cheque deposit slip, BDT Amount 70,000.exe Key opened \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 cheque deposit slip, BDT Amount 70,000.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
cheque deposit slip, BDT Amount 70,000.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\UC Browser = "C:\\Users\\Admin\\AppData\\Roaming\\UC Browser\\UC Browser.exe" cheque deposit slip, BDT Amount 70,000.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
cheque deposit slip, BDT Amount 70,000.exedescription pid process target process PID 3584 set thread context of 4884 3584 cheque deposit slip, BDT Amount 70,000.exe cheque deposit slip, BDT Amount 70,000.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
cheque deposit slip, BDT Amount 70,000.execheque deposit slip, BDT Amount 70,000.exepid process 3584 cheque deposit slip, BDT Amount 70,000.exe 3584 cheque deposit slip, BDT Amount 70,000.exe 4896 cheque deposit slip, BDT Amount 70,000.exe 4896 cheque deposit slip, BDT Amount 70,000.exe 4896 cheque deposit slip, BDT Amount 70,000.exe 4896 cheque deposit slip, BDT Amount 70,000.exe 4896 cheque deposit slip, BDT Amount 70,000.exe 4896 cheque deposit slip, BDT Amount 70,000.exe 4896 cheque deposit slip, BDT Amount 70,000.exe 4896 cheque deposit slip, BDT Amount 70,000.exe 4896 cheque deposit slip, BDT Amount 70,000.exe 4896 cheque deposit slip, BDT Amount 70,000.exe 4896 cheque deposit slip, BDT Amount 70,000.exe 4896 cheque deposit slip, BDT Amount 70,000.exe 4896 cheque deposit slip, BDT Amount 70,000.exe 4896 cheque deposit slip, BDT Amount 70,000.exe 4896 cheque deposit slip, BDT Amount 70,000.exe 4896 cheque deposit slip, BDT Amount 70,000.exe 4896 cheque deposit slip, BDT Amount 70,000.exe 4896 cheque deposit slip, BDT Amount 70,000.exe 4896 cheque deposit slip, BDT Amount 70,000.exe 4896 cheque deposit slip, BDT Amount 70,000.exe 4896 cheque deposit slip, BDT Amount 70,000.exe 4896 cheque deposit slip, BDT Amount 70,000.exe 4896 cheque deposit slip, BDT Amount 70,000.exe 4896 cheque deposit slip, BDT Amount 70,000.exe 4896 cheque deposit slip, BDT Amount 70,000.exe 4896 cheque deposit slip, BDT Amount 70,000.exe 4896 cheque deposit slip, BDT Amount 70,000.exe 4896 cheque deposit slip, BDT Amount 70,000.exe 4896 cheque deposit slip, BDT Amount 70,000.exe 4896 cheque deposit slip, BDT Amount 70,000.exe 4896 cheque deposit slip, BDT Amount 70,000.exe 4896 cheque deposit slip, BDT Amount 70,000.exe 4896 cheque deposit slip, BDT Amount 70,000.exe 4896 cheque deposit slip, BDT Amount 70,000.exe 4896 cheque deposit slip, BDT Amount 70,000.exe 4896 cheque deposit slip, BDT Amount 70,000.exe 4896 cheque deposit slip, BDT Amount 70,000.exe 4896 cheque deposit slip, BDT Amount 70,000.exe 4896 cheque deposit slip, BDT Amount 70,000.exe 4896 cheque deposit slip, BDT Amount 70,000.exe 4896 cheque deposit slip, BDT Amount 70,000.exe 4896 cheque deposit slip, BDT Amount 70,000.exe 4896 cheque deposit slip, BDT Amount 70,000.exe 4896 cheque deposit slip, BDT Amount 70,000.exe 4896 cheque deposit slip, BDT Amount 70,000.exe 4896 cheque deposit slip, BDT Amount 70,000.exe 4896 cheque deposit slip, BDT Amount 70,000.exe 4896 cheque deposit slip, BDT Amount 70,000.exe 4896 cheque deposit slip, BDT Amount 70,000.exe 4896 cheque deposit slip, BDT Amount 70,000.exe 4896 cheque deposit slip, BDT Amount 70,000.exe 4896 cheque deposit slip, BDT Amount 70,000.exe 4896 cheque deposit slip, BDT Amount 70,000.exe 4896 cheque deposit slip, BDT Amount 70,000.exe 4896 cheque deposit slip, BDT Amount 70,000.exe 4896 cheque deposit slip, BDT Amount 70,000.exe 4896 cheque deposit slip, BDT Amount 70,000.exe 4896 cheque deposit slip, BDT Amount 70,000.exe 4896 cheque deposit slip, BDT Amount 70,000.exe 4896 cheque deposit slip, BDT Amount 70,000.exe 4896 cheque deposit slip, BDT Amount 70,000.exe 4896 cheque deposit slip, BDT Amount 70,000.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
cheque deposit slip, BDT Amount 70,000.exepid process 3584 cheque deposit slip, BDT Amount 70,000.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
cheque deposit slip, BDT Amount 70,000.exepid process 4884 cheque deposit slip, BDT Amount 70,000.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
cheque deposit slip, BDT Amount 70,000.exedescription pid process Token: SeDebugPrivilege 4884 cheque deposit slip, BDT Amount 70,000.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
cheque deposit slip, BDT Amount 70,000.execheque deposit slip, BDT Amount 70,000.exedescription pid process target process PID 3584 wrote to memory of 4884 3584 cheque deposit slip, BDT Amount 70,000.exe cheque deposit slip, BDT Amount 70,000.exe PID 3584 wrote to memory of 4884 3584 cheque deposit slip, BDT Amount 70,000.exe cheque deposit slip, BDT Amount 70,000.exe PID 3584 wrote to memory of 4884 3584 cheque deposit slip, BDT Amount 70,000.exe cheque deposit slip, BDT Amount 70,000.exe PID 3584 wrote to memory of 4896 3584 cheque deposit slip, BDT Amount 70,000.exe cheque deposit slip, BDT Amount 70,000.exe PID 3584 wrote to memory of 4896 3584 cheque deposit slip, BDT Amount 70,000.exe cheque deposit slip, BDT Amount 70,000.exe PID 3584 wrote to memory of 4896 3584 cheque deposit slip, BDT Amount 70,000.exe cheque deposit slip, BDT Amount 70,000.exe PID 4884 wrote to memory of 5116 4884 cheque deposit slip, BDT Amount 70,000.exe netsh.exe PID 4884 wrote to memory of 5116 4884 cheque deposit slip, BDT Amount 70,000.exe netsh.exe PID 4884 wrote to memory of 5116 4884 cheque deposit slip, BDT Amount 70,000.exe netsh.exe -
outlook_office_path 1 IoCs
Processes:
cheque deposit slip, BDT Amount 70,000.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 cheque deposit slip, BDT Amount 70,000.exe -
outlook_win_path 1 IoCs
Processes:
cheque deposit slip, BDT Amount 70,000.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 cheque deposit slip, BDT Amount 70,000.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cheque deposit slip, BDT Amount 70,000.exe"C:\Users\Admin\AppData\Local\Temp\cheque deposit slip, BDT Amount 70,000.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\cheque deposit slip, BDT Amount 70,000.exe"C:\Users\Admin\AppData\Local\Temp\cheque deposit slip, BDT Amount 70,000.exe"2⤵
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
-
C:\Windows\SysWOW64\netsh.exe"netsh" wlan show profile3⤵
-
C:\Users\Admin\AppData\Local\Temp\cheque deposit slip, BDT Amount 70,000.exe"C:\Users\Admin\AppData\Local\Temp\cheque deposit slip, BDT Amount 70,000.exe" 2 4884 2405707502⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3584-134-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/4884-136-0x0000000004EB0000-0x0000000005454000-memory.dmpFilesize
5.6MB
-
memory/4884-133-0x00000000009E0000-0x0000000000A32000-memory.dmpFilesize
328KB
-
memory/4884-132-0x00000000009E0000-0x0000000000A32000-memory.dmpFilesize
328KB
-
memory/4884-130-0x0000000000000000-mapping.dmp
-
memory/4884-137-0x0000000004C50000-0x0000000004CE2000-memory.dmpFilesize
584KB
-
memory/4884-138-0x0000000004DE0000-0x0000000004E7C000-memory.dmpFilesize
624KB
-
memory/4884-139-0x0000000005A50000-0x0000000005AB6000-memory.dmpFilesize
408KB
-
memory/4884-140-0x0000000005E30000-0x0000000005E80000-memory.dmpFilesize
320KB
-
memory/4884-142-0x0000000002300000-0x000000000230A000-memory.dmpFilesize
40KB
-
memory/4896-131-0x0000000000000000-mapping.dmp
-
memory/4896-135-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/5116-141-0x0000000000000000-mapping.dmp