Analysis
-
max time kernel
68s -
max time network
51s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
01-10-2022 07:27
Static task
static1
Behavioral task
behavioral1
Sample
payment copy (2).exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
payment copy (2).exe
Resource
win10v2004-20220812-en
General
-
Target
payment copy (2).exe
-
Size
884KB
-
MD5
5cc9f8e39f90f420adda6699196bb877
-
SHA1
a402d16c6dc29521ad519e8a96933578677369c6
-
SHA256
545830c8f3640a7fa7c37115b87fd7c3f8872a580effec10d42a0f4e549c9732
-
SHA512
860c78baa29d378c2cff93baeaa4922ebe9b1cc08cf6ca2160b6cb694962b96c90a26c2b61b870a1a453b307fe343dd5c894ad2bcc51ec6fbd79c15d0fd9d78e
-
SSDEEP
12288:UFWO4z6C42iNOAyPwC5ymqabONmNs3eqjJ5nlaokrZ5CHj8hgDn++1EV3gtZvbNC:UwO4ut1tu9qOsJjrl2
Malware Config
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
payment copy (2).exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 payment copy (2).exe Key opened \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 payment copy (2).exe Key opened \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 payment copy (2).exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
payment copy (2).exedescription pid process target process PID 860 set thread context of 620 860 payment copy (2).exe payment copy (2).exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
payment copy (2).exepayment copy (2).exepid process 860 payment copy (2).exe 620 payment copy (2).exe 620 payment copy (2).exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
payment copy (2).exepayment copy (2).exedescription pid process Token: SeDebugPrivilege 860 payment copy (2).exe Token: SeDebugPrivilege 620 payment copy (2).exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
payment copy (2).exedescription pid process target process PID 860 wrote to memory of 588 860 payment copy (2).exe schtasks.exe PID 860 wrote to memory of 588 860 payment copy (2).exe schtasks.exe PID 860 wrote to memory of 588 860 payment copy (2).exe schtasks.exe PID 860 wrote to memory of 588 860 payment copy (2).exe schtasks.exe PID 860 wrote to memory of 620 860 payment copy (2).exe payment copy (2).exe PID 860 wrote to memory of 620 860 payment copy (2).exe payment copy (2).exe PID 860 wrote to memory of 620 860 payment copy (2).exe payment copy (2).exe PID 860 wrote to memory of 620 860 payment copy (2).exe payment copy (2).exe PID 860 wrote to memory of 620 860 payment copy (2).exe payment copy (2).exe PID 860 wrote to memory of 620 860 payment copy (2).exe payment copy (2).exe PID 860 wrote to memory of 620 860 payment copy (2).exe payment copy (2).exe PID 860 wrote to memory of 620 860 payment copy (2).exe payment copy (2).exe PID 860 wrote to memory of 620 860 payment copy (2).exe payment copy (2).exe -
outlook_office_path 1 IoCs
Processes:
payment copy (2).exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 payment copy (2).exe -
outlook_win_path 1 IoCs
Processes:
payment copy (2).exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 payment copy (2).exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\payment copy (2).exe"C:\Users\Admin\AppData\Local\Temp\payment copy (2).exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FZmuQuJwH" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA0A4.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\payment copy (2).exe"{path}"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpA0A4.tmpFilesize
1KB
MD5020ff228a5693ac343966c5e97259426
SHA1d394dee6b8877d2206be916ffe4af2f86eab1c66
SHA2565dfdd2a2c9c0d9e507f50d815c434897ae83ba8d47cc9d4a473d13ade2a0197e
SHA512546575ec8cb509c22fcfc77f88c32cf634ad475a29eb270c620fba6172c9ac8e4eb8141b3c5c7f79655445c0f5d474b3dd33a6afd100c85a64245130a595090c
-
memory/588-59-0x0000000000000000-mapping.dmp
-
memory/620-64-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/620-61-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/620-62-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/620-65-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/620-67-0x00000000004358DE-mapping.dmp
-
memory/620-66-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/620-69-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/620-71-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/860-57-0x00000000053B0000-0x000000000542E000-memory.dmpFilesize
504KB
-
memory/860-58-0x0000000000B10000-0x0000000000B4A000-memory.dmpFilesize
232KB
-
memory/860-56-0x0000000000270000-0x0000000000290000-memory.dmpFilesize
128KB
-
memory/860-55-0x0000000074DE1000-0x0000000074DE3000-memory.dmpFilesize
8KB
-
memory/860-54-0x00000000013D0000-0x00000000014B2000-memory.dmpFilesize
904KB