Analysis
-
max time kernel
118s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231025-en -
resource tags
arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system -
submitted
04-12-2023 09:26
Static task
static1
Behavioral task
behavioral1
Sample
YU SV Payment.exe
Resource
win7-20231025-en
Behavioral task
behavioral2
Sample
YU SV Payment.exe
Resource
win10v2004-20231127-en
General
-
Target
YU SV Payment.exe
-
Size
841KB
-
MD5
c9586b5ef698248e11c6fc904ccd1e6d
-
SHA1
3b2246ad338738d2d1dba1cbc7a751091149d338
-
SHA256
cde4e54eecb8d93a3bf01b328a33b998ef032becee8b0e375225cbce85c4a548
-
SHA512
114c617845d7061047db47893357e96703d70f576b4cd6d3c9822e94537a6efe8cea56babb22dae0181a0238b7595a49226780113810ad992a4bf1d2da38a2c9
-
SSDEEP
24576:3MPBrU7n0K+4iAVilgobPwXGYfpBhtD/:S1Ug54xQlJc2Y3
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
zqamcx.com - Port:
587 - Username:
[email protected] - Password:
Methodman991 - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
YU SV Payment.exedescription pid process target process PID 2944 set thread context of 2572 2944 YU SV Payment.exe YU SV Payment.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 16 IoCs
Processes:
YU SV Payment.exeYU SV Payment.exepowershell.exepowershell.exepid process 2944 YU SV Payment.exe 2944 YU SV Payment.exe 2944 YU SV Payment.exe 2944 YU SV Payment.exe 2944 YU SV Payment.exe 2944 YU SV Payment.exe 2944 YU SV Payment.exe 2944 YU SV Payment.exe 2944 YU SV Payment.exe 2944 YU SV Payment.exe 2944 YU SV Payment.exe 2944 YU SV Payment.exe 2572 YU SV Payment.exe 2572 YU SV Payment.exe 2656 powershell.exe 2584 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
YU SV Payment.exeYU SV Payment.exepowershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 2944 YU SV Payment.exe Token: SeDebugPrivilege 2572 YU SV Payment.exe Token: SeDebugPrivilege 2656 powershell.exe Token: SeDebugPrivilege 2584 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
YU SV Payment.exepid process 2572 YU SV Payment.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
YU SV Payment.exedescription pid process target process PID 2944 wrote to memory of 2656 2944 YU SV Payment.exe powershell.exe PID 2944 wrote to memory of 2656 2944 YU SV Payment.exe powershell.exe PID 2944 wrote to memory of 2656 2944 YU SV Payment.exe powershell.exe PID 2944 wrote to memory of 2656 2944 YU SV Payment.exe powershell.exe PID 2944 wrote to memory of 2584 2944 YU SV Payment.exe powershell.exe PID 2944 wrote to memory of 2584 2944 YU SV Payment.exe powershell.exe PID 2944 wrote to memory of 2584 2944 YU SV Payment.exe powershell.exe PID 2944 wrote to memory of 2584 2944 YU SV Payment.exe powershell.exe PID 2944 wrote to memory of 2576 2944 YU SV Payment.exe schtasks.exe PID 2944 wrote to memory of 2576 2944 YU SV Payment.exe schtasks.exe PID 2944 wrote to memory of 2576 2944 YU SV Payment.exe schtasks.exe PID 2944 wrote to memory of 2576 2944 YU SV Payment.exe schtasks.exe PID 2944 wrote to memory of 2572 2944 YU SV Payment.exe YU SV Payment.exe PID 2944 wrote to memory of 2572 2944 YU SV Payment.exe YU SV Payment.exe PID 2944 wrote to memory of 2572 2944 YU SV Payment.exe YU SV Payment.exe PID 2944 wrote to memory of 2572 2944 YU SV Payment.exe YU SV Payment.exe PID 2944 wrote to memory of 2572 2944 YU SV Payment.exe YU SV Payment.exe PID 2944 wrote to memory of 2572 2944 YU SV Payment.exe YU SV Payment.exe PID 2944 wrote to memory of 2572 2944 YU SV Payment.exe YU SV Payment.exe PID 2944 wrote to memory of 2572 2944 YU SV Payment.exe YU SV Payment.exe PID 2944 wrote to memory of 2572 2944 YU SV Payment.exe YU SV Payment.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\YU SV Payment.exe"C:\Users\Admin\AppData\Local\Temp\YU SV Payment.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\YU SV Payment.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2656 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\smltCUtWNLO.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2584 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\smltCUtWNLO" /XML "C:\Users\Admin\AppData\Local\Temp\tmpCDE9.tmp"2⤵
- Creates scheduled task(s)
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\YU SV Payment.exe"C:\Users\Admin\AppData\Local\Temp\YU SV Payment.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2572
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD52788a54620346792ace5861ff672f2df
SHA148e67fdd47fe77dd6c6b9ebd7b1922cafd6be681
SHA256a660bc2a80a23e7f273902f8a4b0be7049a44f1e23f15792517aca266176f611
SHA5128a2fdeeced9744801fcf2b26323062d222386d20b6f4056e3c9b81221e0eb15cccdf526cbd5a2892140ea8cef499435d32ed86566f2819c8875015c26fd2e6ec
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\RJD3Z8XI8O0LQANLSLVH.temp
Filesize7KB
MD57a809a59ffcd542b7883175eda06160c
SHA1805f8d12680667629fcbe63f268ac6a42165f71e
SHA25620a05437ae33590638127ea09333c58b030d4cacc78624923f42932d6e817f7d
SHA512801721459ef7b12368fa8c27db7b9d5b4d8fe762a2183318ec699baa721730ba3f686a649d082628adefc401db2cae31b13bf5a0be98923571c8901f6f585855
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize7KB
MD57a809a59ffcd542b7883175eda06160c
SHA1805f8d12680667629fcbe63f268ac6a42165f71e
SHA25620a05437ae33590638127ea09333c58b030d4cacc78624923f42932d6e817f7d
SHA512801721459ef7b12368fa8c27db7b9d5b4d8fe762a2183318ec699baa721730ba3f686a649d082628adefc401db2cae31b13bf5a0be98923571c8901f6f585855