Analysis
-
max time kernel
62s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
02-06-2023 10:36
Behavioral task
behavioral1
Sample
Remittance of $76,000.00.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
Remittance of $76,000.00.exe
Resource
win10v2004-20230220-en
General
-
Target
Remittance of $76,000.00.exe
-
Size
7KB
-
MD5
35004f2270d99d582de6c138614e602c
-
SHA1
726df09a779ac8d2cb23e0ff3e5aca32b5a7874e
-
SHA256
b828fabbbc217d50542d19c8f8fb2b49c924f7a0cc6cbbc404e4439063febe51
-
SHA512
4eb17d42c3c2b9a4299153784690dd2030a5a7572bc5f34e3038392ea5dc881f2f962777f0dea28a1cef59c8012a670c547d4dbcbc1a98c37ba785f984fcd9f8
-
SSDEEP
192:li64f60lNCQEeL+57HNCx0L0Lyfzn5G9:L4f9oveL+5rNCqL0LyfzE
Malware Config
Extracted
purecrypter
http://85.31.45.42/Hmumry.png
Extracted
agenttesla
Protocol: smtp- Host:
mail.keefort.com.ec - Port:
587 - Username:
ssg@keefort.com.ec - Password:
u=Wa6eChU3nj - Email To:
kaka@kingsamodin.com
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
Remittance of $76,000.00.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Remittance of $76,000.00.exe Key opened \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Remittance of $76,000.00.exe Key opened \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Remittance of $76,000.00.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 5 api.ipify.org 6 api.ipify.org -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
powershell.exepid process 1952 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Remittance of $76,000.00.exepowershell.exedescription pid process Token: SeDebugPrivilege 2032 Remittance of $76,000.00.exe Token: SeDebugPrivilege 1952 powershell.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
Remittance of $76,000.00.exedescription pid process target process PID 2032 wrote to memory of 1952 2032 Remittance of $76,000.00.exe powershell.exe PID 2032 wrote to memory of 1952 2032 Remittance of $76,000.00.exe powershell.exe PID 2032 wrote to memory of 1952 2032 Remittance of $76,000.00.exe powershell.exe PID 2032 wrote to memory of 1952 2032 Remittance of $76,000.00.exe powershell.exe -
outlook_office_path 1 IoCs
Processes:
Remittance of $76,000.00.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Remittance of $76,000.00.exe -
outlook_win_path 1 IoCs
Processes:
Remittance of $76,000.00.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Remittance of $76,000.00.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Remittance of $76,000.00.exe"C:\Users\Admin\AppData\Local\Temp\Remittance of $76,000.00.exe"1⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgA1AA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1952-62-0x0000000002520000-0x0000000002560000-memory.dmpFilesize
256KB
-
memory/1952-61-0x0000000002520000-0x0000000002560000-memory.dmpFilesize
256KB
-
memory/1952-64-0x0000000002520000-0x0000000002560000-memory.dmpFilesize
256KB
-
memory/1952-63-0x0000000002520000-0x0000000002560000-memory.dmpFilesize
256KB
-
memory/2032-54-0x0000000000BB0000-0x0000000000BB8000-memory.dmpFilesize
32KB
-
memory/2032-55-0x0000000004C90000-0x0000000004CD0000-memory.dmpFilesize
256KB
-
memory/2032-56-0x0000000008E40000-0x0000000008F3E000-memory.dmpFilesize
1016KB
-
memory/2032-57-0x0000000000A00000-0x0000000000A1A000-memory.dmpFilesize
104KB
-
memory/2032-58-0x0000000008A30000-0x0000000008AC2000-memory.dmpFilesize
584KB
-
memory/2032-65-0x0000000004180000-0x00000000041B0000-memory.dmpFilesize
192KB
-
memory/2032-83-0x0000000004C90000-0x0000000004CD0000-memory.dmpFilesize
256KB
-
memory/2032-84-0x0000000004C90000-0x0000000004CD0000-memory.dmpFilesize
256KB