Analysis
-
max time kernel
120s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system -
submitted
01-12-2023 10:41
Static task
static1
Behavioral task
behavioral1
Sample
payment status.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
payment status.exe
Resource
win10v2004-20231127-en
General
-
Target
payment status.exe
-
Size
840KB
-
MD5
aa2bbdd4f76e86b8a34746c29602982e
-
SHA1
65afd6aa0bf71c64cbaa3076dee472d696dd5566
-
SHA256
391085720087ca47539076781ecfb5e4027f3c89bb19097b0c3d9e599cc6b6cd
-
SHA512
c6888740e55c03ab9c494cc0a9e0d7271ecc009393274f332566090c0932ec5848349b803ced84c5f1bdb3a873b739c4b2058971552f195e2c9d5d850fe9135f
-
SSDEEP
12288:S3f5A6IOwgTt0Pkua0p0lZXRYQlBTPNPqt99EUU5kLQTYCS51fn7dyx:YTaslk0l1RYmFqt95dsMCS5l7Mx
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.bezzleauto.com - Port:
587 - Username:
[email protected] - Password:
Kene123456789 - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
payment status.exedescription pid process target process PID 2736 set thread context of 2284 2736 payment status.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
powershell.exepowershell.exeRegSvcs.exepid process 2556 powershell.exe 2560 powershell.exe 2284 RegSvcs.exe 2284 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
powershell.exepowershell.exeRegSvcs.exedescription pid process Token: SeDebugPrivilege 2556 powershell.exe Token: SeDebugPrivilege 2560 powershell.exe Token: SeDebugPrivilege 2284 RegSvcs.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
payment status.exedescription pid process target process PID 2736 wrote to memory of 2560 2736 payment status.exe powershell.exe PID 2736 wrote to memory of 2560 2736 payment status.exe powershell.exe PID 2736 wrote to memory of 2560 2736 payment status.exe powershell.exe PID 2736 wrote to memory of 2560 2736 payment status.exe powershell.exe PID 2736 wrote to memory of 2556 2736 payment status.exe powershell.exe PID 2736 wrote to memory of 2556 2736 payment status.exe powershell.exe PID 2736 wrote to memory of 2556 2736 payment status.exe powershell.exe PID 2736 wrote to memory of 2556 2736 payment status.exe powershell.exe PID 2736 wrote to memory of 2444 2736 payment status.exe schtasks.exe PID 2736 wrote to memory of 2444 2736 payment status.exe schtasks.exe PID 2736 wrote to memory of 2444 2736 payment status.exe schtasks.exe PID 2736 wrote to memory of 2444 2736 payment status.exe schtasks.exe PID 2736 wrote to memory of 2284 2736 payment status.exe RegSvcs.exe PID 2736 wrote to memory of 2284 2736 payment status.exe RegSvcs.exe PID 2736 wrote to memory of 2284 2736 payment status.exe RegSvcs.exe PID 2736 wrote to memory of 2284 2736 payment status.exe RegSvcs.exe PID 2736 wrote to memory of 2284 2736 payment status.exe RegSvcs.exe PID 2736 wrote to memory of 2284 2736 payment status.exe RegSvcs.exe PID 2736 wrote to memory of 2284 2736 payment status.exe RegSvcs.exe PID 2736 wrote to memory of 2284 2736 payment status.exe RegSvcs.exe PID 2736 wrote to memory of 2284 2736 payment status.exe RegSvcs.exe PID 2736 wrote to memory of 2284 2736 payment status.exe RegSvcs.exe PID 2736 wrote to memory of 2284 2736 payment status.exe RegSvcs.exe PID 2736 wrote to memory of 2284 2736 payment status.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\payment status.exe"C:\Users\Admin\AppData\Local\Temp\payment status.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\payment status.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2560 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ZPYGuWlgLiAnJ.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2556 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ZPYGuWlgLiAnJ" /XML "C:\Users\Admin\AppData\Local\Temp\tmpFF74.tmp"2⤵
- Creates scheduled task(s)
PID:2444 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2284
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5948f51e80cf33d830ff315bc884c8f0c
SHA16f2a61cbc606ffcd2469a8a39cc39f729cd6a524
SHA25609dd7cdadc7560a9004425ea182452daf0653e7698b78226f16c0708c6f6fbd8
SHA51284e375f986c50ff71b20cb85f286ced9df157b2d709e8e04dd80d5db856cc822b86bc766394c41ff506c1f89f8438d8cce4d7d2e99e09f57e4b5013b2df71fde
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\9AO0MTUF7JOXXKVMMG5S.temp
Filesize7KB
MD51bf1fd65b790506e2e5d4f2ea330c499
SHA1281b17b17a400be97b0dc5a6ae81b38e6c1beace
SHA256b101ed559641db9bd99dabb3b87c685bc52824737666b76c8843dd9fe86b3fa2
SHA512c73f865bab03697e5723f1c41994e618718d4480c483de061d7e5f52826d3fe55eab148a24ec25b6866653fa7f529ecb3ee5abbed1336603b5a074d7438d9e4d
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize7KB
MD51bf1fd65b790506e2e5d4f2ea330c499
SHA1281b17b17a400be97b0dc5a6ae81b38e6c1beace
SHA256b101ed559641db9bd99dabb3b87c685bc52824737666b76c8843dd9fe86b3fa2
SHA512c73f865bab03697e5723f1c41994e618718d4480c483de061d7e5f52826d3fe55eab148a24ec25b6866653fa7f529ecb3ee5abbed1336603b5a074d7438d9e4d