Analysis
-
max time kernel
119s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20231025-en -
resource tags
arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system -
submitted
12-12-2023 20:42
Static task
static1
Behavioral task
behavioral1
Sample
payment copy.exe
Resource
win7-20231025-en
General
-
Target
payment copy.exe
-
Size
668KB
-
MD5
e50f7c3cc61113fa9007f36f6562c654
-
SHA1
b43b2434f4aad4970143dab912e4f047faa4e4a9
-
SHA256
27d672cb71c052ba0379590d9fa4ad1253f9b2c12692586bf5829ed0b8d94431
-
SHA512
f1776fc6935971b57a5cd5f20bd2728d0bd78102327541924f958da7654916b6457893fd32228fa1214ec3e536ac4e4cf55fc04e797e1fe1c34fb1eb65dc3c02
-
SSDEEP
12288:immc+4WpAETy8agvmAWu+Ttcv47vMiPn3eQA2MqJe4SZ2sFYtbYu6Ff8+:GpAEJagv0u+OwT3C8e4ZpY
Malware Config
Extracted
Protocol: smtp- Host:
mail.helikhodro.com - Port:
587 - Username:
[email protected] - Password:
@Ii9121070423
Extracted
agenttesla
Protocol: smtp- Host:
mail.helikhodro.com - Port:
587 - Username:
[email protected] - Password:
@Ii9121070423 - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Detect ZGRat V1 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1676-3-0x0000000000500000-0x0000000000518000-memory.dmp family_zgrat_v1 -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 api.ipify.org 5 api.ipify.org 6 ip-api.com -
Suspicious use of SetThreadContext 1 IoCs
Processes:
payment copy.exedescription pid process target process PID 1676 set thread context of 2908 1676 payment copy.exe RegSvcs.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
payment copy.exeRegSvcs.exepid process 1676 payment copy.exe 1676 payment copy.exe 2908 RegSvcs.exe 2908 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
payment copy.exeRegSvcs.exedescription pid process Token: SeDebugPrivilege 1676 payment copy.exe Token: SeDebugPrivilege 2908 RegSvcs.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
payment copy.exedescription pid process target process PID 1676 wrote to memory of 2908 1676 payment copy.exe RegSvcs.exe PID 1676 wrote to memory of 2908 1676 payment copy.exe RegSvcs.exe PID 1676 wrote to memory of 2908 1676 payment copy.exe RegSvcs.exe PID 1676 wrote to memory of 2908 1676 payment copy.exe RegSvcs.exe PID 1676 wrote to memory of 2908 1676 payment copy.exe RegSvcs.exe PID 1676 wrote to memory of 2908 1676 payment copy.exe RegSvcs.exe PID 1676 wrote to memory of 2908 1676 payment copy.exe RegSvcs.exe PID 1676 wrote to memory of 2908 1676 payment copy.exe RegSvcs.exe PID 1676 wrote to memory of 2908 1676 payment copy.exe RegSvcs.exe PID 1676 wrote to memory of 2908 1676 payment copy.exe RegSvcs.exe PID 1676 wrote to memory of 2908 1676 payment copy.exe RegSvcs.exe PID 1676 wrote to memory of 2908 1676 payment copy.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\payment copy.exe"C:\Users\Admin\AppData\Local\Temp\payment copy.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2908
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5989d5cc9700b09763f26b46c0bfedaa2
SHA13d89fad8afb41b305bcad47c71947cf557f514ea
SHA25619194dfe81c6c1ef2c237fb7dd6283dec58b29f9cf58d5e5b54d08f38517fc17
SHA5124e66ee4b206aa0042af74ea771e6be18e3b551f5d01b4393a73b174c087dad111ef761bc471df18a3d57bbf603be3ae8bb5b6e4b96bd6c26a7999b0854b38a04
-
Filesize
61KB
MD5f3441b8572aae8801c04f3060b550443
SHA14ef0a35436125d6821831ef36c28ffaf196cda15
SHA2566720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf
SHA5125ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06