Analysis

  • max time kernel
    90s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-09-2022 06:27

General

  • Target

    Invoice.exe

  • Size

    790KB

  • MD5

    a190b2ff24d2c48c0a559e5721f0707b

  • SHA1

    ca664df590e439bb7f257d0948c1ba8d95119cbb

  • SHA256

    21aeef1143995fb050b42f9a93e8852996815350fb21ed0b5e6e7a5dd880b482

  • SHA512

    ce6f22152f7e5b83d9252962201136e4963612ab598e5f2b22b02adb35aa6485c235450f96f675d7ad1f178067f56f4f5745a23a65b14e11b5d436a0479f3469

Malware Config

Extracted

Credentials

Protocol: smtp

Host: mail.pisc.lk

Port: 587

Username: sales@pisc.lk

Password: PIsafeTY2021

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Drops file in Drivers directory ⋅ 1 IoCs
  • Checks computer location settings ⋅ 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles ⋅ 1 TTPs 3 IoCs
  • Suspicious use of SetThreadContext ⋅ 1 IoCs
  • Enumerates physical storage devices ⋅ 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) ⋅ 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses ⋅ 6 IoCs
  • Suspicious use of AdjustPrivilegeToken ⋅ 3 IoCs
  • Suspicious use of WriteProcessMemory ⋅ 14 IoCs
  • outlook_office_path ⋅ 1 IoCs
  • outlook_win_path ⋅ 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Invoice.exe
    "C:\Users\Admin\AppData\Local\Temp\Invoice.exe"
    Checks computer location settings
    Suspicious use of SetThreadContext
    Suspicious behavior: EnumeratesProcesses
    Suspicious use of AdjustPrivilegeToken
    Suspicious use of WriteProcessMemory
    PID:944
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\EAQYFApq.exe"
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3984
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\EAQYFApq" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8CBF.tmp"
      Creates scheduled task(s)
      PID:4080
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      Drops file in Drivers directory
      Accesses Microsoft Outlook profiles
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      outlook_office_path
      outlook_win_path
      PID:3384

Network

MITRE ATT&CK Matrix

Collection

Command and Control

    Credential Access

      Defense Evasion

        Execution

          Exfiltration

            Impact

              Initial Access

                Lateral Movement

                  Persistence

                  Privilege Escalation

                    Replay Monitor

                    00:00 00:00

                    Downloads

                    • C:\Users\Admin\AppData\Local\Temp\tmp8CBF.tmp
                      MD5

                      88c615e032b605df1b37f454957fad6d

                      SHA1

                      4f60843be4c609f3fe02ebc852718f86a2a7ee50

                      SHA256

                      584f3a40cef1f8b133a0f04b78d66951e59060bde252597e4e14df22634b48f7

                      SHA512

                      2f42a0487e63721e2336052aa56b49d37745e1d5eb6a86bff75c56d8217c9a8ff640bcff011873c2a3797ba1242ea3c665ae4b26139a5ff6d8f82b7c0c86d018

                    • memory/944-133-0x0000000005350000-0x00000000058F4000-memory.dmp
                    • memory/944-134-0x0000000004C40000-0x0000000004CD2000-memory.dmp
                    • memory/944-135-0x0000000004C30000-0x0000000004C3A000-memory.dmp
                    • memory/944-136-0x0000000007690000-0x000000000772C000-memory.dmp
                    • memory/944-137-0x0000000007AA0000-0x0000000007B06000-memory.dmp
                    • memory/944-132-0x00000000001C0000-0x000000000028C000-memory.dmp
                    • memory/3384-143-0x0000000000000000-mapping.dmp
                    • memory/3384-154-0x0000000006860000-0x00000000068B0000-memory.dmp
                    • memory/3384-144-0x0000000000400000-0x000000000043A000-memory.dmp
                    • memory/3984-145-0x0000000005F00000-0x0000000005F22000-memory.dmp
                    • memory/3984-151-0x0000000008070000-0x00000000086EA000-memory.dmp
                    • memory/3984-140-0x0000000005100000-0x0000000005136000-memory.dmp
                    • memory/3984-158-0x0000000007D40000-0x0000000007D48000-memory.dmp
                    • memory/3984-146-0x0000000005FA0000-0x0000000006006000-memory.dmp
                    • memory/3984-147-0x0000000006710000-0x000000000672E000-memory.dmp
                    • memory/3984-148-0x00000000076D0000-0x0000000007702000-memory.dmp
                    • memory/3984-149-0x00000000702E0000-0x000000007032C000-memory.dmp
                    • memory/3984-150-0x0000000006CD0000-0x0000000006CEE000-memory.dmp
                    • memory/3984-142-0x0000000005770000-0x0000000005D98000-memory.dmp
                    • memory/3984-152-0x0000000007A20000-0x0000000007A3A000-memory.dmp
                    • memory/3984-153-0x0000000007A90000-0x0000000007A9A000-memory.dmp
                    • memory/3984-155-0x0000000007CA0000-0x0000000007D36000-memory.dmp
                    • memory/3984-138-0x0000000000000000-mapping.dmp
                    • memory/3984-156-0x0000000007C50000-0x0000000007C5E000-memory.dmp
                    • memory/3984-157-0x0000000007D60000-0x0000000007D7A000-memory.dmp
                    • memory/4080-139-0x0000000000000000-mapping.dmp