Analysis
-
max time kernel
117s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231025-en -
resource tags
arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system -
submitted
01-12-2023 10:27
Static task
static1
Behavioral task
behavioral1
Sample
payment status.exe
Resource
win7-20231025-en
Behavioral task
behavioral2
Sample
payment status.exe
Resource
win10v2004-20231127-en
General
-
Target
payment status.exe
-
Size
840KB
-
MD5
aa2bbdd4f76e86b8a34746c29602982e
-
SHA1
65afd6aa0bf71c64cbaa3076dee472d696dd5566
-
SHA256
391085720087ca47539076781ecfb5e4027f3c89bb19097b0c3d9e599cc6b6cd
-
SHA512
c6888740e55c03ab9c494cc0a9e0d7271ecc009393274f332566090c0932ec5848349b803ced84c5f1bdb3a873b739c4b2058971552f195e2c9d5d850fe9135f
-
SSDEEP
12288:S3f5A6IOwgTt0Pkua0p0lZXRYQlBTPNPqt99EUU5kLQTYCS51fn7dyx:YTaslk0l1RYmFqt95dsMCS5l7Mx
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.bezzleauto.com - Port:
587 - Username:
[email protected] - Password:
Kene123456789 - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
payment status.exedescription pid process target process PID 1940 set thread context of 2548 1940 payment status.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
powershell.exepowershell.exeRegSvcs.exepid process 2776 powershell.exe 2764 powershell.exe 2548 RegSvcs.exe 2548 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
powershell.exepowershell.exeRegSvcs.exedescription pid process Token: SeDebugPrivilege 2776 powershell.exe Token: SeDebugPrivilege 2764 powershell.exe Token: SeDebugPrivilege 2548 RegSvcs.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
payment status.exedescription pid process target process PID 1940 wrote to memory of 2764 1940 payment status.exe powershell.exe PID 1940 wrote to memory of 2764 1940 payment status.exe powershell.exe PID 1940 wrote to memory of 2764 1940 payment status.exe powershell.exe PID 1940 wrote to memory of 2764 1940 payment status.exe powershell.exe PID 1940 wrote to memory of 2776 1940 payment status.exe powershell.exe PID 1940 wrote to memory of 2776 1940 payment status.exe powershell.exe PID 1940 wrote to memory of 2776 1940 payment status.exe powershell.exe PID 1940 wrote to memory of 2776 1940 payment status.exe powershell.exe PID 1940 wrote to memory of 2652 1940 payment status.exe schtasks.exe PID 1940 wrote to memory of 2652 1940 payment status.exe schtasks.exe PID 1940 wrote to memory of 2652 1940 payment status.exe schtasks.exe PID 1940 wrote to memory of 2652 1940 payment status.exe schtasks.exe PID 1940 wrote to memory of 2548 1940 payment status.exe RegSvcs.exe PID 1940 wrote to memory of 2548 1940 payment status.exe RegSvcs.exe PID 1940 wrote to memory of 2548 1940 payment status.exe RegSvcs.exe PID 1940 wrote to memory of 2548 1940 payment status.exe RegSvcs.exe PID 1940 wrote to memory of 2548 1940 payment status.exe RegSvcs.exe PID 1940 wrote to memory of 2548 1940 payment status.exe RegSvcs.exe PID 1940 wrote to memory of 2548 1940 payment status.exe RegSvcs.exe PID 1940 wrote to memory of 2548 1940 payment status.exe RegSvcs.exe PID 1940 wrote to memory of 2548 1940 payment status.exe RegSvcs.exe PID 1940 wrote to memory of 2548 1940 payment status.exe RegSvcs.exe PID 1940 wrote to memory of 2548 1940 payment status.exe RegSvcs.exe PID 1940 wrote to memory of 2548 1940 payment status.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\payment status.exe"C:\Users\Admin\AppData\Local\Temp\payment status.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\payment status.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2764 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ZPYGuWlgLiAnJ.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2776 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ZPYGuWlgLiAnJ" /XML "C:\Users\Admin\AppData\Local\Temp\tmpADDC.tmp"2⤵
- Creates scheduled task(s)
PID:2652 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2548
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5d44126ff35532d06f927cb7c8d58656d
SHA1dc876937f2f846ab8395f3b30a54f95193243d45
SHA25667a606b3b177b87935c9c54856b536218fbdbe92ee652abd90b9cc0ba6e9192d
SHA5120fc7ef53e0a163d761deb874010a92cc634d8799c90e2e8449ef7862ff8740401e5ce2673a5f2ec883feab399493ef4180d2934deab87072df1dd0aeb1ac1be9
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\KPSWAAT1OD051XN358TF.temp
Filesize7KB
MD50ebe921f40d5c2ffe6fa90d7e7d0eb9f
SHA1744768592ae521f63b2df131268068ecd18d6c87
SHA2569bb0875f38f8768a1b56b794cb4003db06fb90648cdd3eca98466a40d6bf9a90
SHA51227ac7f499c7aecda07ad020fed19921a027a057b345afa6e9a860f6938006b70ebc6fc27efee899c85f734e9047739fc2d37710497f046ea96cb86bb5ebfbe51
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize7KB
MD50ebe921f40d5c2ffe6fa90d7e7d0eb9f
SHA1744768592ae521f63b2df131268068ecd18d6c87
SHA2569bb0875f38f8768a1b56b794cb4003db06fb90648cdd3eca98466a40d6bf9a90
SHA51227ac7f499c7aecda07ad020fed19921a027a057b345afa6e9a860f6938006b70ebc6fc27efee899c85f734e9047739fc2d37710497f046ea96cb86bb5ebfbe51