Analysis
-
max time kernel
117s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
01-12-2023 10:30
Static task
static1
Behavioral task
behavioral1
Sample
payment status.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
payment status.exe
Resource
win10v2004-20231127-en
General
-
Target
payment status.exe
-
Size
840KB
-
MD5
aa2bbdd4f76e86b8a34746c29602982e
-
SHA1
65afd6aa0bf71c64cbaa3076dee472d696dd5566
-
SHA256
391085720087ca47539076781ecfb5e4027f3c89bb19097b0c3d9e599cc6b6cd
-
SHA512
c6888740e55c03ab9c494cc0a9e0d7271ecc009393274f332566090c0932ec5848349b803ced84c5f1bdb3a873b739c4b2058971552f195e2c9d5d850fe9135f
-
SSDEEP
12288:S3f5A6IOwgTt0Pkua0p0lZXRYQlBTPNPqt99EUU5kLQTYCS51fn7dyx:YTaslk0l1RYmFqt95dsMCS5l7Mx
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.bezzleauto.com - Port:
587 - Username:
[email protected] - Password:
Kene123456789 - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
payment status.exedescription pid process target process PID 1568 set thread context of 2316 1568 payment status.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
RegSvcs.exepowershell.exepowershell.exepid process 2316 RegSvcs.exe 2316 RegSvcs.exe 2688 powershell.exe 2724 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
RegSvcs.exepowershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 2316 RegSvcs.exe Token: SeDebugPrivilege 2688 powershell.exe Token: SeDebugPrivilege 2724 powershell.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
payment status.exedescription pid process target process PID 1568 wrote to memory of 2724 1568 payment status.exe powershell.exe PID 1568 wrote to memory of 2724 1568 payment status.exe powershell.exe PID 1568 wrote to memory of 2724 1568 payment status.exe powershell.exe PID 1568 wrote to memory of 2724 1568 payment status.exe powershell.exe PID 1568 wrote to memory of 2688 1568 payment status.exe powershell.exe PID 1568 wrote to memory of 2688 1568 payment status.exe powershell.exe PID 1568 wrote to memory of 2688 1568 payment status.exe powershell.exe PID 1568 wrote to memory of 2688 1568 payment status.exe powershell.exe PID 1568 wrote to memory of 2864 1568 payment status.exe schtasks.exe PID 1568 wrote to memory of 2864 1568 payment status.exe schtasks.exe PID 1568 wrote to memory of 2864 1568 payment status.exe schtasks.exe PID 1568 wrote to memory of 2864 1568 payment status.exe schtasks.exe PID 1568 wrote to memory of 2316 1568 payment status.exe RegSvcs.exe PID 1568 wrote to memory of 2316 1568 payment status.exe RegSvcs.exe PID 1568 wrote to memory of 2316 1568 payment status.exe RegSvcs.exe PID 1568 wrote to memory of 2316 1568 payment status.exe RegSvcs.exe PID 1568 wrote to memory of 2316 1568 payment status.exe RegSvcs.exe PID 1568 wrote to memory of 2316 1568 payment status.exe RegSvcs.exe PID 1568 wrote to memory of 2316 1568 payment status.exe RegSvcs.exe PID 1568 wrote to memory of 2316 1568 payment status.exe RegSvcs.exe PID 1568 wrote to memory of 2316 1568 payment status.exe RegSvcs.exe PID 1568 wrote to memory of 2316 1568 payment status.exe RegSvcs.exe PID 1568 wrote to memory of 2316 1568 payment status.exe RegSvcs.exe PID 1568 wrote to memory of 2316 1568 payment status.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\payment status.exe"C:\Users\Admin\AppData\Local\Temp\payment status.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1568 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\payment status.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2724 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ZPYGuWlgLiAnJ.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2688 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ZPYGuWlgLiAnJ" /XML "C:\Users\Admin\AppData\Local\Temp\tmpDCE7.tmp"2⤵
- Creates scheduled task(s)
PID:2864 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2316
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5492b0e190ff627f03cfec2ebbfde5e19
SHA157f8f88b8ab1b64b90a779aaa0a4c61536a9ce56
SHA25682be30bbf6549d81d16918f355e8815cffa489097a7658df37018fe283745eca
SHA512d354c9e624a9cbf10b4e7150dd3ceb3ac799ac3f6fa29a2e8f2b498482e50a00a4a218e9720ddc35cf2753e1102a2ba1fd93a0fd616b42fe708bf81700f89037
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\NQ2BFFHI192DKUMKT0CI.temp
Filesize7KB
MD51870b01f38c041b489e6fbd1c5624325
SHA1fbbfd210f4ea550a7d330ff585ed186eb0bc2c9c
SHA2565757325a095bed34a9f5e080ad0036403696d986898e56a6e147b6dcdc8a0352
SHA512f627907ded3ce96d4d62c8eb32c6df5364ec169e70edc4090b62ad8ca42a6b34054295345d431daa2e446448367c93a64996c814fe67572ced608aadb701e607
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize7KB
MD51870b01f38c041b489e6fbd1c5624325
SHA1fbbfd210f4ea550a7d330ff585ed186eb0bc2c9c
SHA2565757325a095bed34a9f5e080ad0036403696d986898e56a6e147b6dcdc8a0352
SHA512f627907ded3ce96d4d62c8eb32c6df5364ec169e70edc4090b62ad8ca42a6b34054295345d431daa2e446448367c93a64996c814fe67572ced608aadb701e607