Analysis
- max time kernel
19s - max time network
30s - platform
windows7_x64 - resource
win7-20221111-en - resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system - submitted
09/02/2023, 10:38
Static task
static1
Behavioral task
behavioral1
Sample
Invoice.exe
Resource
win7-20221111-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
Invoice.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target Invoice.exe
- Size 64KB
- Sample230209-mpd81agg55
- SHA256 fca4fad8a97a71ab6192b8e54c42ed6469f20c41fcde73dc270ffcafae9495f0
- MD5 7550fa07706e7920d4fc819f330212d2
- SHA1 57383d74517e6bedc6229c9921d2648ffa1271d6
- SHA512 f0ce42eedc505052a417c636991bef93441054b3be554047c5d7165c6760027ba0547bc6abff2bc6120c4cd4ea1553f6ce59af6d0264c0edc515f39a835585a8
- SSDEEP 768:pkOyF9AKzwzsaV4pl3F9F/Rix40LO6dusn04eF:eOe9AAwwaVk3FR+40ymuL3F
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 972 set thread context of 672 972 Invoice.exe 41 - Program crash 1 IoCs
pid pid_target Process procid_target 684 672 WerFault.exe 41 - Suspicious behavior: EnumeratesProcesses 26 IoCs
pid Process 972 Invoice.exe 972 Invoice.exe 972 Invoice.exe 972 Invoice.exe 972 Invoice.exe 972 Invoice.exe 972 Invoice.exe 972 Invoice.exe 972 Invoice.exe 972 Invoice.exe 972 Invoice.exe 972 Invoice.exe 972 Invoice.exe 972 Invoice.exe 972 Invoice.exe 972 Invoice.exe 972 Invoice.exe 972 Invoice.exe 972 Invoice.exe 972 Invoice.exe 972 Invoice.exe 972 Invoice.exe 972 Invoice.exe 972 Invoice.exe 972 Invoice.exe 972 Invoice.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 972 Invoice.exe - Suspicious use of WriteProcessMemory 55 IoCs
description pid Process procid_target PID 972 wrote to memory of 468 972 Invoice.exe 28 PID 972 wrote to memory of 468 972 Invoice.exe 28 PID 972 wrote to memory of 468 972 Invoice.exe 28 PID 972 wrote to memory of 1908 972 Invoice.exe 29 PID 972 wrote to memory of 1908 972 Invoice.exe 29 PID 972 wrote to memory of 1908 972 Invoice.exe 29 PID 972 wrote to memory of 1400 972 Invoice.exe 30 PID 972 wrote to memory of 1400 972 Invoice.exe 30 PID 972 wrote to memory of 1400 972 Invoice.exe 30 PID 972 wrote to memory of 1992 972 Invoice.exe 31 PID 972 wrote to memory of 1992 972 Invoice.exe 31 PID 972 wrote to memory of 1992 972 Invoice.exe 31 PID 972 wrote to memory of 1480 972 Invoice.exe 32 PID 972 wrote to memory of 1480 972 Invoice.exe 32 PID 972 wrote to memory of 1480 972 Invoice.exe 32 PID 972 wrote to memory of 1156 972 Invoice.exe 33 PID 972 wrote to memory of 1156 972 Invoice.exe 33 PID 972 wrote to memory of 1156 972 Invoice.exe 33 PID 972 wrote to memory of 1564 972 Invoice.exe 34 PID 972 wrote to memory of 1564 972 Invoice.exe 34 PID 972 wrote to memory of 1564 972 Invoice.exe 34 PID 972 wrote to memory of 532 972 Invoice.exe 35 PID 972 wrote to memory of 532 972 Invoice.exe 35 PID 972 wrote to memory of 532 972 Invoice.exe 35 PID 972 wrote to memory of 748 972 Invoice.exe 36 PID 972 wrote to memory of 748 972 Invoice.exe 36 PID 972 wrote to memory of 748 972 Invoice.exe 36 PID 972 wrote to memory of 1484 972 Invoice.exe 37 PID 972 wrote to memory of 1484 972 Invoice.exe 37 PID 972 wrote to memory of 1484 972 Invoice.exe 37 PID 972 wrote to memory of 1128 972 Invoice.exe 38 PID 972 wrote to memory of 1128 972 Invoice.exe 38 PID 972 wrote to memory of 1128 972 Invoice.exe 38 PID 972 wrote to memory of 284 972 Invoice.exe 39 PID 972 wrote to memory of 284 972 Invoice.exe 39 PID 972 wrote to memory of 284 972 Invoice.exe 39 PID 972 wrote to memory of 1860 972 Invoice.exe 40 PID 972 wrote to memory of 1860 972 Invoice.exe 40 PID 972 wrote to memory of 1860 972 Invoice.exe 40 PID 972 wrote to memory of 672 972 Invoice.exe 41 PID 972 wrote to memory of 672 972 Invoice.exe 41 PID 972 wrote to memory of 672 972 Invoice.exe 41 PID 972 wrote to memory of 672 972 Invoice.exe 41 PID 972 wrote to memory of 672 972 Invoice.exe 41 PID 972 wrote to memory of 672 972 Invoice.exe 41 PID 972 wrote to memory of 672 972 Invoice.exe 41 PID 972 wrote to memory of 672 972 Invoice.exe 41 PID 972 wrote to memory of 672 972 Invoice.exe 41 PID 972 wrote to memory of 672 972 Invoice.exe 41 PID 972 wrote to memory of 672 972 Invoice.exe 41 PID 972 wrote to memory of 672 972 Invoice.exe 41 PID 672 wrote to memory of 684 672 SetupUtility.exe 42 PID 672 wrote to memory of 684 672 SetupUtility.exe 42 PID 672 wrote to memory of 684 672 SetupUtility.exe 42 PID 672 wrote to memory of 684 672 SetupUtility.exe 42
Processes
-
C:\Users\Admin\AppData\Local\Temp\Invoice.exe"C:\Users\Admin\AppData\Local\Temp\Invoice.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:972 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WsatConfig.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WsatConfig.exe"2⤵PID:468
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe"2⤵PID:1908
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\CasPol.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\CasPol.exe"2⤵PID:1400
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regtlibv12.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regtlibv12.exe"2⤵PID:1992
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe"2⤵PID:1480
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe"2⤵PID:1156
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\DataSvcUtil.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\DataSvcUtil.exe"2⤵PID:1564
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe"2⤵PID:532
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe"2⤵PID:748
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EdmGen.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EdmGen.exe"2⤵PID:1484
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe"2⤵PID:1128
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"2⤵PID:284
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe"2⤵PID:1860
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\SetupUtility.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\SetupUtility.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:672 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 672 -s 1683⤵
- Program crash
PID:684
-
-