Analysis
-
max time kernel
226s -
max time network
333s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
12/02/2023, 08:25
Static task
static1
Behavioral task
behavioral1
Sample
Debit Note.exe
Resource
win7-20221111-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
Debit Note.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
Debit Note.exe
-
Size
685KB
-
MD5
1a431097afb48954b94defec865d84f5
-
SHA1
eaafb2d6af27cec988ac6829ff528066771fe736
-
SHA256
309dd7ed63e9360abcb589290adda980a24e8a327d0090c6c839e306bada6558
-
SHA512
32685dec6fea0e2c149cfa4ce2828f0a461468fffb4c19ab709fa9e1fc2a5baf3d0812fb55805895a464dba71a896a0011457ab7cc5e30167e27cb06b5be9334
-
SSDEEP
12288:PuAskehLWn7dfWXeea+wpfXGJAHqvayEgfkxguPZW7z0JIZmDzOOua61A:W9LqYef+MHCGg8xgqZW7z0JIZm36
Score
10/10
Malware Config
Extracted
Family
agenttesla
C2
https://api.telegram.org/bot2134979594:AAFk4QkrlHlt2a-q-EhIoHZBbzxSH0QxiBI/
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 776 set thread context of 1572 776 Debit Note.exe 43 -
Program crash 1 IoCs
pid pid_target Process procid_target 944 1572 WerFault.exe 43 -
Suspicious behavior: EnumeratesProcesses 19 IoCs
pid Process 776 Debit Note.exe 776 Debit Note.exe 776 Debit Note.exe 776 Debit Note.exe 776 Debit Note.exe 776 Debit Note.exe 776 Debit Note.exe 776 Debit Note.exe 776 Debit Note.exe 776 Debit Note.exe 776 Debit Note.exe 776 Debit Note.exe 776 Debit Note.exe 776 Debit Note.exe 776 Debit Note.exe 776 Debit Note.exe 776 Debit Note.exe 776 Debit Note.exe 776 Debit Note.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 776 Debit Note.exe -
Suspicious use of WriteProcessMemory 61 IoCs
description pid Process procid_target PID 776 wrote to memory of 344 776 Debit Note.exe 28 PID 776 wrote to memory of 344 776 Debit Note.exe 28 PID 776 wrote to memory of 344 776 Debit Note.exe 28 PID 776 wrote to memory of 896 776 Debit Note.exe 29 PID 776 wrote to memory of 896 776 Debit Note.exe 29 PID 776 wrote to memory of 896 776 Debit Note.exe 29 PID 776 wrote to memory of 1408 776 Debit Note.exe 30 PID 776 wrote to memory of 1408 776 Debit Note.exe 30 PID 776 wrote to memory of 1408 776 Debit Note.exe 30 PID 776 wrote to memory of 1668 776 Debit Note.exe 31 PID 776 wrote to memory of 1668 776 Debit Note.exe 31 PID 776 wrote to memory of 1668 776 Debit Note.exe 31 PID 776 wrote to memory of 1780 776 Debit Note.exe 32 PID 776 wrote to memory of 1780 776 Debit Note.exe 32 PID 776 wrote to memory of 1780 776 Debit Note.exe 32 PID 776 wrote to memory of 1784 776 Debit Note.exe 33 PID 776 wrote to memory of 1784 776 Debit Note.exe 33 PID 776 wrote to memory of 1784 776 Debit Note.exe 33 PID 776 wrote to memory of 1448 776 Debit Note.exe 34 PID 776 wrote to memory of 1448 776 Debit Note.exe 34 PID 776 wrote to memory of 1448 776 Debit Note.exe 34 PID 776 wrote to memory of 1672 776 Debit Note.exe 35 PID 776 wrote to memory of 1672 776 Debit Note.exe 35 PID 776 wrote to memory of 1672 776 Debit Note.exe 35 PID 776 wrote to memory of 668 776 Debit Note.exe 36 PID 776 wrote to memory of 668 776 Debit Note.exe 36 PID 776 wrote to memory of 668 776 Debit Note.exe 36 PID 776 wrote to memory of 1412 776 Debit Note.exe 37 PID 776 wrote to memory of 1412 776 Debit Note.exe 37 PID 776 wrote to memory of 1412 776 Debit Note.exe 37 PID 776 wrote to memory of 1316 776 Debit Note.exe 38 PID 776 wrote to memory of 1316 776 Debit Note.exe 38 PID 776 wrote to memory of 1316 776 Debit Note.exe 38 PID 776 wrote to memory of 1112 776 Debit Note.exe 39 PID 776 wrote to memory of 1112 776 Debit Note.exe 39 PID 776 wrote to memory of 1112 776 Debit Note.exe 39 PID 776 wrote to memory of 988 776 Debit Note.exe 40 PID 776 wrote to memory of 988 776 Debit Note.exe 40 PID 776 wrote to memory of 988 776 Debit Note.exe 40 PID 776 wrote to memory of 1740 776 Debit Note.exe 41 PID 776 wrote to memory of 1740 776 Debit Note.exe 41 PID 776 wrote to memory of 1740 776 Debit Note.exe 41 PID 776 wrote to memory of 1468 776 Debit Note.exe 42 PID 776 wrote to memory of 1468 776 Debit Note.exe 42 PID 776 wrote to memory of 1468 776 Debit Note.exe 42 PID 776 wrote to memory of 1572 776 Debit Note.exe 43 PID 776 wrote to memory of 1572 776 Debit Note.exe 43 PID 776 wrote to memory of 1572 776 Debit Note.exe 43 PID 776 wrote to memory of 1572 776 Debit Note.exe 43 PID 776 wrote to memory of 1572 776 Debit Note.exe 43 PID 776 wrote to memory of 1572 776 Debit Note.exe 43 PID 776 wrote to memory of 1572 776 Debit Note.exe 43 PID 776 wrote to memory of 1572 776 Debit Note.exe 43 PID 776 wrote to memory of 1572 776 Debit Note.exe 43 PID 776 wrote to memory of 1572 776 Debit Note.exe 43 PID 776 wrote to memory of 1572 776 Debit Note.exe 43 PID 776 wrote to memory of 1572 776 Debit Note.exe 43 PID 1572 wrote to memory of 944 1572 SetupUtility.exe 44 PID 1572 wrote to memory of 944 1572 SetupUtility.exe 44 PID 1572 wrote to memory of 944 1572 SetupUtility.exe 44 PID 1572 wrote to memory of 944 1572 SetupUtility.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\Debit Note.exe"C:\Users\Admin\AppData\Local\Temp\Debit Note.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:776 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe"2⤵PID:344
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe"2⤵PID:896
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"2⤵PID:1408
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\DataSvcUtil.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\DataSvcUtil.exe"2⤵PID:1668
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regsql.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regsql.exe"2⤵PID:1780
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regtlibv12.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regtlibv12.exe"2⤵PID:1784
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe"2⤵PID:1448
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe"2⤵PID:1672
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe"2⤵PID:668
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe"2⤵PID:1412
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"2⤵PID:1316
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ComSvcConfig.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ComSvcConfig.exe"2⤵PID:1112
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe"2⤵PID:988
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe"2⤵PID:1740
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe"2⤵PID:1468
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\SetupUtility.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\SetupUtility.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1572 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1572 -s 1683⤵
- Program crash
PID:944
-
-