Analysis
-
max time kernel
167s -
max time network
181s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
09-02-2023 11:15
Static task
static1
Behavioral task
behavioral1
Sample
Statement of Account.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
Statement of Account.exe
Resource
win10v2004-20221111-en
General
-
Target
Statement of Account.exe
-
Size
492KB
-
MD5
6e7687b86eeb2bd86478ee96e06c200e
-
SHA1
105fc272b1c2e949e3113e72ff2f4e2b9b057cbb
-
SHA256
0646c74553ece34bde89208dc879a57458e28d8b7e069d352336021705b9bd1e
-
SHA512
64e0cd8c76380e6176327b353c4cca0d1c512ea1a821b7598cf614fa8769e1e552825f33caddee85707cd6d4a362a4fb93d4d782a47fbbf34ec100ef9e13d616
-
SSDEEP
12288:lcbsoVgc0AkTIDadXg82PpVWSTAqwhdV7gGyE5hk480+ttP5:lvAjeTIoXgzSS0HhcG16480i5
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot5896636070:AAE1wgCylxBdOo6ud0Pm37zMf2XWSsuCQ0g/
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Checks QEMU agent file 2 TTPs 2 IoCs
Checks presence of QEMU agent, possibly to detect virtualization.
Processes:
caspol.exeStatement of Account.exedescription ioc process File opened (read-only) C:\Program Files\Qemu-ga\qemu-ga.exe caspol.exe File opened (read-only) C:\Program Files\Qemu-ga\qemu-ga.exe Statement of Account.exe -
Loads dropped DLL 1 IoCs
Processes:
Statement of Account.exepid process 4472 Statement of Account.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 56 api.ipify.org 57 api.ipify.org -
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
Processes:
caspol.exepid process 4172 caspol.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
Statement of Account.execaspol.exepid process 4472 Statement of Account.exe 4172 caspol.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Statement of Account.exedescription pid process target process PID 4472 set thread context of 4172 4472 Statement of Account.exe caspol.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
Statement of Account.exepid process 4472 Statement of Account.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
caspol.exedescription pid process Token: SeDebugPrivilege 4172 caspol.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
Statement of Account.exedescription pid process target process PID 4472 wrote to memory of 4172 4472 Statement of Account.exe caspol.exe PID 4472 wrote to memory of 4172 4472 Statement of Account.exe caspol.exe PID 4472 wrote to memory of 4172 4472 Statement of Account.exe caspol.exe PID 4472 wrote to memory of 4172 4472 Statement of Account.exe caspol.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Statement of Account.exe"C:\Users\Admin\AppData\Local\Temp\Statement of Account.exe"1⤵
- Checks QEMU agent file
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe"C:\Users\Admin\AppData\Local\Temp\Statement of Account.exe"2⤵
- Checks QEMU agent file
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:4172
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD517ed1c86bd67e78ade4712be48a7d2bd
SHA11cc9fe86d6d6030b4dae45ecddce5907991c01a0
SHA256bd046e6497b304e4ea4ab102cab2b1f94ce09bde0eebba4c59942a732679e4eb
SHA5120cbed521e7d6d1f85977b3f7d3ca7ac34e1b5495b69fd8c7bfa1a846baf53b0ecd06fe1ad02a3599082ffacaf8c71a3bb4e32dec05f8e24859d736b828092cd5