Analysis
-
max time kernel
132s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231130-en -
resource tags
arch:x64arch:x86image:win7-20231130-enlocale:en-usos:windows7-x64system -
submitted
05-12-2023 18:21
Static task
static1
Behavioral task
behavioral1
Sample
payment status.exe
Resource
win7-20231130-en
Behavioral task
behavioral2
Sample
payment status.exe
Resource
win10v2004-20231130-en
General
-
Target
payment status.exe
-
Size
611KB
-
MD5
b3cb7b5092ec2f49be062a87a6335041
-
SHA1
273ee251d431823cc65e1b9e177c34b36da3b578
-
SHA256
8fc8d08ac95f945b863195ee3556c1e756754faff354db781a67a9323b4c06fc
-
SHA512
04b1751627bd0d63cf9aa137738a7c28f0c5d827d2d69dfce45d3075321af5f25d09b51b10203d103ce585ae288f8a2cb3826f9fa780a1f630c8c0cd135e6f5b
-
SSDEEP
12288:suod5zlZmSVaFl3LLTIhbH5TtOBoLFv0X1iMM0pwsNdRjH1y92Tneg:kzOSEXL/IhbHnuMF8X1iFsFH1y92ag
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.bezzleauto.com - Port:
587 - Username:
[email protected] - Password:
kex#-rHjHM4qKk52 - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Drops startup file 1 IoCs
Processes:
payment status.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdf.vbs payment status.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
payment status.exedescription pid process target process PID 3052 set thread context of 1488 3052 payment status.exe RegAsm.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
Processes:
ipconfig.exeipconfig.exepid process 2700 ipconfig.exe 3064 ipconfig.exe -
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-2058106572-1146578376-825901627-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2058106572-1146578376-825901627-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2058106572-1146578376-825901627-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006ada02fffb05344dbbebb32fd2687d5f000000000200000000001066000000010000200000008687f40080d6b5f06c92dcf0ac614562ad70489b5ca45d9d87e61c48e075ad31000000000e8000000002000020000000ea078531cd018d8c1b1450341454fd9eb8cb6ddd8c92587213f584ca45d69a8f20000000098ee07d5ca83582e6535e87be92266def47aeb45b811a86686d9d4c5851fd9d400000009b711062d0d1a20e1c28bb074202b5a5ab7cca4edf7b83e53a9db05c04269dab839ced9c5491c4fc4ed582999a934d59fc6f18416a2077a91d8c3dd6c63c3a09 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2058106572-1146578376-825901627-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0581016a827da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2058106572-1146578376-825901627-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2058106572-1146578376-825901627-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2058106572-1146578376-825901627-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2058106572-1146578376-825901627-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2058106572-1146578376-825901627-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2058106572-1146578376-825901627-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2058106572-1146578376-825901627-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2058106572-1146578376-825901627-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3081C911-939B-11EE-B26B-520AA4D1BDD0} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2058106572-1146578376-825901627-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2058106572-1146578376-825901627-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "407962414" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2058106572-1146578376-825901627-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2058106572-1146578376-825901627-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2058106572-1146578376-825901627-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2058106572-1146578376-825901627-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2058106572-1146578376-825901627-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2058106572-1146578376-825901627-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2058106572-1146578376-825901627-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2058106572-1146578376-825901627-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2058106572-1146578376-825901627-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2058106572-1146578376-825901627-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2058106572-1146578376-825901627-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006ada02fffb05344dbbebb32fd2687d5f00000000020000000000106600000001000020000000619c1a76e6b9d77a9732b7d112866d317f5aafeb3ff2b6696710fcb0298626bb000000000e8000000002000020000000d064e813fbae135f5ed0ab0079c8cbe3057b6994ccd5cd9749bff63a9f6d3b04900000004d1ff9cc7777a7b89aab89cdbaebd4aa3b9a7e687f9038e3698bc58f16f321a12faf42efc3f398525d0616b9badd2081db3b1b924f6fb962d0816d8ae659c4aa9125f9a54b2d73cdbf31481f7548c0b1b6d90817faaee9b87cad44cdc9b01f7ca0a27a4a63bde4af0bdac8e115b7a16119ff75fb7376be79ef61594d7044b13eae08cf5ae6d4789144037b7c4d9812de400000004b39ec7591ad5c84c3444caaca5989232473c16a142400635072d7964e389fae14d84e4c5547582b918b1b8312c57a3a2b7464694936651a37d7dea710918217 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2058106572-1146578376-825901627-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2058106572-1146578376-825901627-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2058106572-1146578376-825901627-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2058106572-1146578376-825901627-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2058106572-1146578376-825901627-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2058106572-1146578376-825901627-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2058106572-1146578376-825901627-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2058106572-1146578376-825901627-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2058106572-1146578376-825901627-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
payment status.exepowershell.exeRegAsm.exepid process 3052 payment status.exe 2572 powershell.exe 1488 RegAsm.exe 1488 RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
payment status.exepowershell.exeRegAsm.exedescription pid process Token: SeDebugPrivilege 3052 payment status.exe Token: SeDebugPrivilege 2572 powershell.exe Token: SeDebugPrivilege 1488 RegAsm.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 2604 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 2604 iexplore.exe 2604 iexplore.exe 2516 IEXPLORE.EXE 2516 IEXPLORE.EXE 2516 IEXPLORE.EXE 2516 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 40 IoCs
Processes:
payment status.execmd.execmd.exepowershell.exeiexplore.exedescription pid process target process PID 3052 wrote to memory of 2100 3052 payment status.exe cmd.exe PID 3052 wrote to memory of 2100 3052 payment status.exe cmd.exe PID 3052 wrote to memory of 2100 3052 payment status.exe cmd.exe PID 3052 wrote to memory of 2100 3052 payment status.exe cmd.exe PID 2100 wrote to memory of 3064 2100 cmd.exe ipconfig.exe PID 2100 wrote to memory of 3064 2100 cmd.exe ipconfig.exe PID 2100 wrote to memory of 3064 2100 cmd.exe ipconfig.exe PID 2100 wrote to memory of 3064 2100 cmd.exe ipconfig.exe PID 3052 wrote to memory of 2572 3052 payment status.exe powershell.exe PID 3052 wrote to memory of 2572 3052 payment status.exe powershell.exe PID 3052 wrote to memory of 2572 3052 payment status.exe powershell.exe PID 3052 wrote to memory of 2572 3052 payment status.exe powershell.exe PID 3052 wrote to memory of 2596 3052 payment status.exe cmd.exe PID 3052 wrote to memory of 2596 3052 payment status.exe cmd.exe PID 3052 wrote to memory of 2596 3052 payment status.exe cmd.exe PID 3052 wrote to memory of 2596 3052 payment status.exe cmd.exe PID 2596 wrote to memory of 2700 2596 cmd.exe ipconfig.exe PID 2596 wrote to memory of 2700 2596 cmd.exe ipconfig.exe PID 2596 wrote to memory of 2700 2596 cmd.exe ipconfig.exe PID 2596 wrote to memory of 2700 2596 cmd.exe ipconfig.exe PID 2572 wrote to memory of 2604 2572 powershell.exe iexplore.exe PID 2572 wrote to memory of 2604 2572 powershell.exe iexplore.exe PID 2572 wrote to memory of 2604 2572 powershell.exe iexplore.exe PID 2572 wrote to memory of 2604 2572 powershell.exe iexplore.exe PID 2604 wrote to memory of 2516 2604 iexplore.exe IEXPLORE.EXE PID 2604 wrote to memory of 2516 2604 iexplore.exe IEXPLORE.EXE PID 2604 wrote to memory of 2516 2604 iexplore.exe IEXPLORE.EXE PID 2604 wrote to memory of 2516 2604 iexplore.exe IEXPLORE.EXE PID 3052 wrote to memory of 1488 3052 payment status.exe RegAsm.exe PID 3052 wrote to memory of 1488 3052 payment status.exe RegAsm.exe PID 3052 wrote to memory of 1488 3052 payment status.exe RegAsm.exe PID 3052 wrote to memory of 1488 3052 payment status.exe RegAsm.exe PID 3052 wrote to memory of 1488 3052 payment status.exe RegAsm.exe PID 3052 wrote to memory of 1488 3052 payment status.exe RegAsm.exe PID 3052 wrote to memory of 1488 3052 payment status.exe RegAsm.exe PID 3052 wrote to memory of 1488 3052 payment status.exe RegAsm.exe PID 3052 wrote to memory of 1488 3052 payment status.exe RegAsm.exe PID 3052 wrote to memory of 1488 3052 payment status.exe RegAsm.exe PID 3052 wrote to memory of 1488 3052 payment status.exe RegAsm.exe PID 3052 wrote to memory of 1488 3052 payment status.exe RegAsm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\payment status.exe"C:\Users\Admin\AppData\Local\Temp\payment status.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ipconfig /release2⤵
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACcAaAB0AHQAcABzADoALwAvAGcAbwBvAGcAbABlAC4AYwBvAG0AJwA=2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://google.com/3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2604 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2516 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ipconfig /renew2⤵
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Windows\SysWOW64\ipconfig.exeipconfig /renew3⤵
- Gathers network information
PID:2700 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1488
-
C:\Windows\SysWOW64\ipconfig.exeipconfig /release1⤵
- Gathers network information
PID:3064