Analysis
-
max time kernel
119s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
27-03-2024 09:53
Static task
static1
Behavioral task
behavioral1
Sample
new invoice.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
new invoice.exe
Resource
win10v2004-20240226-en
General
-
Target
new invoice.exe
-
Size
743KB
-
MD5
f52a3af798452ba8064246c1c05fca48
-
SHA1
66327142382aac09b7b954a860a778e8921f3bfc
-
SHA256
1ed60fc77b07f949a7cc3ced2dd0e0de84ce806a5ebb71d7fc51f31323f2b928
-
SHA512
8520039308ec25ad01a08395bf875757d060ed4702561c001cd57430a660924afaedee8ac441148fce32562bd68fbecdd9675066842e2091a24800ccaee2fa12
-
SSDEEP
12288:yBCAygw0Jxx2Nhy5BZvSkFleJSQEiqC1cS7Zx2DRZL6mJ5DTCa0mY:yRj3xky5vFIVqC19ZxsCmXCsY
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
sg3plcpnl0020.prod.sin3.secureserver.net - Port:
587 - Username:
[email protected] - Password:
gaging@2022 - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 api.ipify.org 5 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
new invoice.exedescription pid process target process PID 2872 set thread context of 2400 2872 new invoice.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
new invoice.exeRegSvcs.exepowershell.exepowershell.exepid process 2872 new invoice.exe 2872 new invoice.exe 2400 RegSvcs.exe 2400 RegSvcs.exe 2644 powershell.exe 2484 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
new invoice.exeRegSvcs.exepowershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 2872 new invoice.exe Token: SeDebugPrivilege 2400 RegSvcs.exe Token: SeDebugPrivilege 2644 powershell.exe Token: SeDebugPrivilege 2484 powershell.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
new invoice.exedescription pid process target process PID 2872 wrote to memory of 2484 2872 new invoice.exe powershell.exe PID 2872 wrote to memory of 2484 2872 new invoice.exe powershell.exe PID 2872 wrote to memory of 2484 2872 new invoice.exe powershell.exe PID 2872 wrote to memory of 2484 2872 new invoice.exe powershell.exe PID 2872 wrote to memory of 2644 2872 new invoice.exe powershell.exe PID 2872 wrote to memory of 2644 2872 new invoice.exe powershell.exe PID 2872 wrote to memory of 2644 2872 new invoice.exe powershell.exe PID 2872 wrote to memory of 2644 2872 new invoice.exe powershell.exe PID 2872 wrote to memory of 2500 2872 new invoice.exe schtasks.exe PID 2872 wrote to memory of 2500 2872 new invoice.exe schtasks.exe PID 2872 wrote to memory of 2500 2872 new invoice.exe schtasks.exe PID 2872 wrote to memory of 2500 2872 new invoice.exe schtasks.exe PID 2872 wrote to memory of 2400 2872 new invoice.exe RegSvcs.exe PID 2872 wrote to memory of 2400 2872 new invoice.exe RegSvcs.exe PID 2872 wrote to memory of 2400 2872 new invoice.exe RegSvcs.exe PID 2872 wrote to memory of 2400 2872 new invoice.exe RegSvcs.exe PID 2872 wrote to memory of 2400 2872 new invoice.exe RegSvcs.exe PID 2872 wrote to memory of 2400 2872 new invoice.exe RegSvcs.exe PID 2872 wrote to memory of 2400 2872 new invoice.exe RegSvcs.exe PID 2872 wrote to memory of 2400 2872 new invoice.exe RegSvcs.exe PID 2872 wrote to memory of 2400 2872 new invoice.exe RegSvcs.exe PID 2872 wrote to memory of 2400 2872 new invoice.exe RegSvcs.exe PID 2872 wrote to memory of 2400 2872 new invoice.exe RegSvcs.exe PID 2872 wrote to memory of 2400 2872 new invoice.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\new invoice.exe"C:\Users\Admin\AppData\Local\Temp\new invoice.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\new invoice.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\LuPGIUTRrkvtes.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\LuPGIUTRrkvtes" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC330.tmp"2⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpC330.tmpFilesize
1KB
MD5e6ec6a971c90e6f350ef613bee3081ab
SHA1ec77d130ad52a7b1ff5b3aa9e3adf0ba4b25b98d
SHA2564feb88d2b3282c7f0d881a87cd6084beb0dc746588e4c60fb2ea59c7adbb0c7d
SHA512f4318742c949461ac5dc86c3e4c6818f390c67bb03beeb303387838f5aa505534c7afb811935ec422182127ff178bc40f4e075623d992eef0bc34aed4c85de4f
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msFilesize
7KB
MD515121f3655125a815d6a08296713795e
SHA14bc3810ad2d2c6977a39180be709dbac5cd884fd
SHA25617b484821d4cebdef71b851fc25ca727149cdc292fa0bcf24c8be69eb3b9ca40
SHA51201331d66c441f26285ad3a96754abf51d3a08e5a904379b8ca96d7985c74ba633301479a9c23d475c636bb5f93dff478c25b4c62c4a47320253dd322bd673d1b
-
memory/2400-40-0x0000000004770000-0x00000000047B0000-memory.dmpFilesize
256KB
-
memory/2400-27-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2400-39-0x0000000074330000-0x0000000074A1E000-memory.dmpFilesize
6.9MB
-
memory/2400-37-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2400-46-0x0000000074330000-0x0000000074A1E000-memory.dmpFilesize
6.9MB
-
memory/2400-47-0x0000000004770000-0x00000000047B0000-memory.dmpFilesize
256KB
-
memory/2400-29-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2400-35-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2400-33-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2400-21-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2400-24-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2400-31-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2484-18-0x000000006DE50000-0x000000006E3FB000-memory.dmpFilesize
5.7MB
-
memory/2484-41-0x0000000002340000-0x0000000002380000-memory.dmpFilesize
256KB
-
memory/2484-45-0x000000006DE50000-0x000000006E3FB000-memory.dmpFilesize
5.7MB
-
memory/2484-23-0x000000006DE50000-0x000000006E3FB000-memory.dmpFilesize
5.7MB
-
memory/2484-20-0x0000000002340000-0x0000000002380000-memory.dmpFilesize
256KB
-
memory/2484-43-0x0000000002340000-0x0000000002380000-memory.dmpFilesize
256KB
-
memory/2644-42-0x0000000002730000-0x0000000002770000-memory.dmpFilesize
256KB
-
memory/2644-19-0x000000006DE50000-0x000000006E3FB000-memory.dmpFilesize
5.7MB
-
memory/2644-28-0x0000000002730000-0x0000000002770000-memory.dmpFilesize
256KB
-
memory/2644-26-0x000000006DE50000-0x000000006E3FB000-memory.dmpFilesize
5.7MB
-
memory/2644-44-0x000000006DE50000-0x000000006E3FB000-memory.dmpFilesize
5.7MB
-
memory/2872-38-0x0000000074330000-0x0000000074A1E000-memory.dmpFilesize
6.9MB
-
memory/2872-5-0x0000000005360000-0x00000000053E2000-memory.dmpFilesize
520KB
-
memory/2872-4-0x0000000000540000-0x000000000054C000-memory.dmpFilesize
48KB
-
memory/2872-3-0x00000000004E0000-0x00000000004F2000-memory.dmpFilesize
72KB
-
memory/2872-0-0x0000000000CE0000-0x0000000000DA0000-memory.dmpFilesize
768KB
-
memory/2872-2-0x0000000000C10000-0x0000000000C50000-memory.dmpFilesize
256KB
-
memory/2872-1-0x0000000074330000-0x0000000074A1E000-memory.dmpFilesize
6.9MB