Analysis
-
max time kernel
143s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231130-en -
resource tags
arch:x64arch:x86image:win10v2004-20231130-enlocale:en-usos:windows10-2004-x64system -
submitted
05-12-2023 09:56
Static task
static1
Behavioral task
behavioral1
Sample
Invoive Ningbo.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
Invoive Ningbo.exe
Resource
win10v2004-20231130-en
General
-
Target
Invoive Ningbo.exe
-
Size
1.1MB
-
MD5
a3fab3e88799e72baefbc47e35beea4c
-
SHA1
fd2dd3ead13b5dba83bcc923102e29fda19ef273
-
SHA256
d11d805c3dab49566aad8dfe6d9bbd1c206918980870792ed9d496e8836aefe6
-
SHA512
bd4f26df04ee36788ca0f4db22604f72d9a99ea4b59f25b3d9afab56b9538cdf647e4bfb7595882ef35a8f82f487d7dbfe2b86b4b7fb1f6b67185e8603965122
-
SSDEEP
24576:kWgtD/61INy65I1JByDr/YsR2s8vqiQrUTOqofIlhChgdgm:Q6KNbqBirXwvqzrUT7ofIlohsgm
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.bezzleauto.com - Port:
587 - Username:
[email protected] - Password:
Kene123456789 - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Invoive Ningbo.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1791582586-1997866593-3795608343-1000\Control Panel\International\Geo\Nation Invoive Ningbo.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Invoive Ningbo.exedescription pid process target process PID 2164 set thread context of 4612 2164 Invoive Ningbo.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3112 4612 WerFault.exe RegSvcs.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
powershell.exepowershell.exeRegSvcs.exepid process 3768 powershell.exe 3752 powershell.exe 4612 RegSvcs.exe 4612 RegSvcs.exe 3768 powershell.exe 3752 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
powershell.exepowershell.exeRegSvcs.exedescription pid process Token: SeDebugPrivilege 3768 powershell.exe Token: SeDebugPrivilege 3752 powershell.exe Token: SeDebugPrivilege 4612 RegSvcs.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
Invoive Ningbo.exedescription pid process target process PID 2164 wrote to memory of 3768 2164 Invoive Ningbo.exe powershell.exe PID 2164 wrote to memory of 3768 2164 Invoive Ningbo.exe powershell.exe PID 2164 wrote to memory of 3768 2164 Invoive Ningbo.exe powershell.exe PID 2164 wrote to memory of 3752 2164 Invoive Ningbo.exe powershell.exe PID 2164 wrote to memory of 3752 2164 Invoive Ningbo.exe powershell.exe PID 2164 wrote to memory of 3752 2164 Invoive Ningbo.exe powershell.exe PID 2164 wrote to memory of 1028 2164 Invoive Ningbo.exe schtasks.exe PID 2164 wrote to memory of 1028 2164 Invoive Ningbo.exe schtasks.exe PID 2164 wrote to memory of 1028 2164 Invoive Ningbo.exe schtasks.exe PID 2164 wrote to memory of 4612 2164 Invoive Ningbo.exe RegSvcs.exe PID 2164 wrote to memory of 4612 2164 Invoive Ningbo.exe RegSvcs.exe PID 2164 wrote to memory of 4612 2164 Invoive Ningbo.exe RegSvcs.exe PID 2164 wrote to memory of 4612 2164 Invoive Ningbo.exe RegSvcs.exe PID 2164 wrote to memory of 4612 2164 Invoive Ningbo.exe RegSvcs.exe PID 2164 wrote to memory of 4612 2164 Invoive Ningbo.exe RegSvcs.exe PID 2164 wrote to memory of 4612 2164 Invoive Ningbo.exe RegSvcs.exe PID 2164 wrote to memory of 4612 2164 Invoive Ningbo.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Invoive Ningbo.exe"C:\Users\Admin\AppData\Local\Temp\Invoive Ningbo.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Invoive Ningbo.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3768 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\BQrTsZTbHtxOU.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3752 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\BQrTsZTbHtxOU" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9AF8.tmp"2⤵
- Creates scheduled task(s)
PID:1028 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4612 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4612 -s 14283⤵
- Program crash
PID:3112
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4612 -ip 46121⤵PID:1768
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD53d086a433708053f9bf9523e1d87a4e8
SHA1b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA2566f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
SHA512931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd
-
Filesize
18KB
MD5f674c87be24f8d7b43d6417427942666
SHA19f49bc1c72f19e7a68949410df7e4dbd2711b1d2
SHA25614815dc0a750647c129bbef9b95c622cfec8b5853c059a617af5d49eea261db4
SHA51287126237e60980a51961ed44e2be85027432a341036d55aa1d788a900a7c1ac4d9595ca06f76692c40a606b98badea5b28c261a7e1347176d0c4bd5e6911cd2d
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
1KB
MD522836e54e77cb06efb7687ccf7c0d3e2
SHA17257763541b5fa7b2f5164b019b38780e86621cd
SHA2560ab264d1e8472fd4fad1b227d834633652acfb24b73bd526d3f4be41be644d93
SHA512d59a7a60ee6516edb089d876cfe9bfd9231ef34cff73df74ec47441696eecd850b5f0b78aaa3145c01d12e77750f0b97fe0389caf34e6c0146e94182cf25197d