Analysis
-
max time kernel
190s -
max time network
218s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
29-11-2022 13:23
Static task
static1
Behavioral task
behavioral1
Sample
payment receipt.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
payment receipt.exe
Resource
win10v2004-20221111-en
General
-
Target
payment receipt.exe
-
Size
777KB
-
MD5
933c54fec2b05a8dc386623a79f5fed6
-
SHA1
b70e1861d76cd1a37810fe91ec74cb1848011642
-
SHA256
f71c278f8f31eb5aafb97b9b8cc6c7f6b2aea97c80bca11ddeede2b7df8b1ee5
-
SHA512
c25cf1155283841af5b0d510f168837c74652251f969ec55663c2d6174e593cc4f198387be11be2cf187f43f2de2e2e76b09f69c5c063e1cf898280d3760d4de
-
SSDEEP
12288:oKdsGfZFr5cE8LHWt+zvhqbcIERlSCWs/OL6mMk/SEdRMA/LyzIPPPu6gt:5WvL/YbclSa5mt9/LkInst
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.sseximclearing.com - Port:
587 - Username:
saurav.roy@sseximclearing.com - Password:
Ssxm@9854 - Email To:
maxitears7@gmail.com
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
payment receipt.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation payment receipt.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
payment receipt.exedescription pid process target process PID 1584 set thread context of 1156 1584 payment receipt.exe payment receipt.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
payment receipt.exedescription pid process target process PID 1584 wrote to memory of 4072 1584 payment receipt.exe schtasks.exe PID 1584 wrote to memory of 4072 1584 payment receipt.exe schtasks.exe PID 1584 wrote to memory of 4072 1584 payment receipt.exe schtasks.exe PID 1584 wrote to memory of 1156 1584 payment receipt.exe payment receipt.exe PID 1584 wrote to memory of 1156 1584 payment receipt.exe payment receipt.exe PID 1584 wrote to memory of 1156 1584 payment receipt.exe payment receipt.exe PID 1584 wrote to memory of 1156 1584 payment receipt.exe payment receipt.exe PID 1584 wrote to memory of 1156 1584 payment receipt.exe payment receipt.exe PID 1584 wrote to memory of 1156 1584 payment receipt.exe payment receipt.exe PID 1584 wrote to memory of 1156 1584 payment receipt.exe payment receipt.exe PID 1584 wrote to memory of 1156 1584 payment receipt.exe payment receipt.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\payment receipt.exe"C:\Users\Admin\AppData\Local\Temp\payment receipt.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\DlyOwyVrzaxNT" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5857.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\payment receipt.exe"{path}"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\payment receipt.exe.logFilesize
1KB
MD584e77a587d94307c0ac1357eb4d3d46f
SHA183cc900f9401f43d181207d64c5adba7a85edc1e
SHA256e16024b092a026a9dc00df69d4b9bbcab7b2dc178dc5291fc308a1abc9304a99
SHA512aefb5c62200b3ed97718d20a89990954d4d8acdc0a6a73c5a420f1bba619cb79e70c2cd0a579b9f52dc6b09e1de2cea6cd6cac4376cfee92d94e2c01d310f691
-
C:\Users\Admin\AppData\Local\Temp\tmp5857.tmpFilesize
1KB
MD54d4467036baebda84002ba8c54396a2d
SHA1b31b5716e4b2857d50ec99cc282913a66425e71e
SHA2569dd7598834206bb52a66096044ba968c217cc2a12d774700f709b186dee936c6
SHA512ae34b0cd516e9ec1c635ba8b3f1c44d3801ccf7a5545802082c0bd709d58b9596b9fb458c9419f163108772e5e343e5c31409454148c90fd5c9ed7a1d1c62ae4
-
memory/1156-139-0x0000000000000000-mapping.dmp
-
memory/1156-140-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1584-132-0x0000000000330000-0x00000000003F8000-memory.dmpFilesize
800KB
-
memory/1584-133-0x00000000053E0000-0x0000000005984000-memory.dmpFilesize
5.6MB
-
memory/1584-134-0x0000000004D80000-0x0000000004E12000-memory.dmpFilesize
584KB
-
memory/1584-135-0x0000000004ED0000-0x0000000004F6C000-memory.dmpFilesize
624KB
-
memory/1584-136-0x0000000004E40000-0x0000000004E4A000-memory.dmpFilesize
40KB
-
memory/4072-137-0x0000000000000000-mapping.dmp