Overview

overview

10

Static

static

Payment In...on.exe

windows7_x64

10

Payment In...on.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    163s
  • max time network
    169s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    21-05-2022 12:11

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Payment Information.exe

  • Size

    596KB

  • MD5

    08cb9ea318ef263c4c0434f26bb41a95

  • SHA1

    1ad38381184d53222b3e40ca21294fd028090dda

  • SHA256

    95c93aceae03da91a38a1e26449254aac2aa113ac5f0362edd0e09a8d4d1e442

  • SHA512

    c3a95eb2119d4c1e5c0426ad28cb650e9ff0a26c899ecf39d4673ac7c7eb620ee82c8abdc2bd997fe6b918912e314a8a9548349548243e6bfea25863d9dc0903

Score
10/10
agentteslacollectionkeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    smtp.truebarnds.com
  • Port:
    587
  • Username:
    info@truebarnds.com
  • Password:
    SnbDUMn7

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla
  • AgentTesla Payload 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
    collection
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Payment Information.exe
    "C:\Users\Admin\AppData\Local\Temp\Payment Information.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2744
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\nDnztEgIGW" /XML "C:\Users\Admin\AppData\Local\Temp\tmp349D.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:4792
    • C:\Users\Admin\AppData\Local\Temp\Payment Information.exe
      "{path}"
      2⤵
        PID:3696
      • C:\Users\Admin\AppData\Local\Temp\Payment Information.exe
        "{path}"
        2⤵
        • Accesses Microsoft Outlook profiles
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • outlook_office_path
        • outlook_win_path
        PID:4720

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Scheduled Task

    1
    T1053

    Persistence

    Scheduled Task

    1
    T1053

    Privilege Escalation

    Scheduled Task

    1
    T1053

    Defense Evasion

    Credential Access

    Credentials in Files

    3
    T1081

    Discovery

    Query Registry

    1
    T1012

    System Information Discovery

    2
    T1082

    Lateral Movement

    Collection

    Data from Local System

    3
    T1005

    Email Collection

    1
    T1114

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\tmp349D.tmp
      Filesize

      1KB

      MD5

      4e8c68c42f67eec0ca7fac4d3ea42673

      SHA1

      b970feea0bde4b7db32a533dd11b311043c95404

      SHA256

      968114a21ac721f753a67d89d73e7fe7b540f936646d40bf52971d14fe99b32c

      SHA512

      a2c3f0625282ee19beec7bb1803f7c4069582f91d4d2b34ac606fddf161ee4ec6babac4d36955f82a4afbc7eee582d354f47137c8e4962378d1af8a5a6986889

      Download Submit
    • memory/2744-130-0x0000000074A20000-0x0000000074FD1000-memory.dmp
      Filesize

      5.7MB

      Download
    • memory/3696-133-0x0000000000000000-mapping.dmp
      Download
    • memory/4720-134-0x0000000000000000-mapping.dmp
      Download
    • memory/4720-135-0x0000000000400000-0x000000000044C000-memory.dmp
      Filesize

      304KB

      Download
    • memory/4720-136-0x0000000074A20000-0x0000000074FD1000-memory.dmp
      Filesize

      5.7MB

      Download
    • memory/4792-131-0x0000000000000000-mapping.dmp
      Download