Analysis
-
max time kernel
122s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
27-03-2024 09:58
Static task
static1
Behavioral task
behavioral1
Sample
new invoice.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
new invoice.exe
Resource
win10v2004-20231215-en
General
-
Target
new invoice.exe
-
Size
743KB
-
MD5
f52a3af798452ba8064246c1c05fca48
-
SHA1
66327142382aac09b7b954a860a778e8921f3bfc
-
SHA256
1ed60fc77b07f949a7cc3ced2dd0e0de84ce806a5ebb71d7fc51f31323f2b928
-
SHA512
8520039308ec25ad01a08395bf875757d060ed4702561c001cd57430a660924afaedee8ac441148fce32562bd68fbecdd9675066842e2091a24800ccaee2fa12
-
SSDEEP
12288:yBCAygw0Jxx2Nhy5BZvSkFleJSQEiqC1cS7Zx2DRZL6mJ5DTCa0mY:yRj3xky5vFIVqC19ZxsCmXCsY
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
sg3plcpnl0020.prod.sin3.secureserver.net - Port:
587 - Username:
[email protected] - Password:
gaging@2022 - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 api.ipify.org 5 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
new invoice.exedescription pid process target process PID 2044 set thread context of 1436 2044 new invoice.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
new invoice.exepowershell.exepowershell.exeRegSvcs.exepid process 2044 new invoice.exe 1668 powershell.exe 1396 powershell.exe 2044 new invoice.exe 1436 RegSvcs.exe 1436 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
new invoice.exepowershell.exepowershell.exeRegSvcs.exedescription pid process Token: SeDebugPrivilege 2044 new invoice.exe Token: SeDebugPrivilege 1668 powershell.exe Token: SeDebugPrivilege 1396 powershell.exe Token: SeDebugPrivilege 1436 RegSvcs.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
new invoice.exedescription pid process target process PID 2044 wrote to memory of 1396 2044 new invoice.exe powershell.exe PID 2044 wrote to memory of 1396 2044 new invoice.exe powershell.exe PID 2044 wrote to memory of 1396 2044 new invoice.exe powershell.exe PID 2044 wrote to memory of 1396 2044 new invoice.exe powershell.exe PID 2044 wrote to memory of 1668 2044 new invoice.exe powershell.exe PID 2044 wrote to memory of 1668 2044 new invoice.exe powershell.exe PID 2044 wrote to memory of 1668 2044 new invoice.exe powershell.exe PID 2044 wrote to memory of 1668 2044 new invoice.exe powershell.exe PID 2044 wrote to memory of 1968 2044 new invoice.exe schtasks.exe PID 2044 wrote to memory of 1968 2044 new invoice.exe schtasks.exe PID 2044 wrote to memory of 1968 2044 new invoice.exe schtasks.exe PID 2044 wrote to memory of 1968 2044 new invoice.exe schtasks.exe PID 2044 wrote to memory of 1436 2044 new invoice.exe RegSvcs.exe PID 2044 wrote to memory of 1436 2044 new invoice.exe RegSvcs.exe PID 2044 wrote to memory of 1436 2044 new invoice.exe RegSvcs.exe PID 2044 wrote to memory of 1436 2044 new invoice.exe RegSvcs.exe PID 2044 wrote to memory of 1436 2044 new invoice.exe RegSvcs.exe PID 2044 wrote to memory of 1436 2044 new invoice.exe RegSvcs.exe PID 2044 wrote to memory of 1436 2044 new invoice.exe RegSvcs.exe PID 2044 wrote to memory of 1436 2044 new invoice.exe RegSvcs.exe PID 2044 wrote to memory of 1436 2044 new invoice.exe RegSvcs.exe PID 2044 wrote to memory of 1436 2044 new invoice.exe RegSvcs.exe PID 2044 wrote to memory of 1436 2044 new invoice.exe RegSvcs.exe PID 2044 wrote to memory of 1436 2044 new invoice.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\new invoice.exe"C:\Users\Admin\AppData\Local\Temp\new invoice.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\new invoice.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\LuPGIUTRrkvtes.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\LuPGIUTRrkvtes" /XML "C:\Users\Admin\AppData\Local\Temp\tmp7EF0.tmp"2⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp7EF0.tmpFilesize
1KB
MD5e6ec6a971c90e6f350ef613bee3081ab
SHA1ec77d130ad52a7b1ff5b3aa9e3adf0ba4b25b98d
SHA2564feb88d2b3282c7f0d881a87cd6084beb0dc746588e4c60fb2ea59c7adbb0c7d
SHA512f4318742c949461ac5dc86c3e4c6818f390c67bb03beeb303387838f5aa505534c7afb811935ec422182127ff178bc40f4e075623d992eef0bc34aed4c85de4f
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\1RH2G0H2FHU1V30GIR16.tempFilesize
7KB
MD560518d7dc00f51c2f44cb86fff8cb5ea
SHA121524877bd3a6596a9f83a11e1e16dbb067d1a4a
SHA256d2ca2fbcb4f8b7fbc65261fe4f0b33dff1d094b0be908d1cf39efff8b15ba909
SHA5124c4731fd3cfeb7c9f578986433cb9f1eac22d5b5430ba16628b33eb228322fbc6b94d5a0b3ad780f19925e8dce059a6f6fa5171b32bfd50ac3e34418b007ac57
-
memory/1396-39-0x000000006FD50000-0x00000000702FB000-memory.dmpFilesize
5.7MB
-
memory/1396-23-0x000000006FD50000-0x00000000702FB000-memory.dmpFilesize
5.7MB
-
memory/1396-20-0x000000006FD50000-0x00000000702FB000-memory.dmpFilesize
5.7MB
-
memory/1436-24-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/1436-33-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/1436-41-0x0000000074ED0000-0x00000000755BE000-memory.dmpFilesize
6.9MB
-
memory/1436-38-0x0000000004250000-0x0000000004290000-memory.dmpFilesize
256KB
-
memory/1436-29-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/1436-37-0x0000000074ED0000-0x00000000755BE000-memory.dmpFilesize
6.9MB
-
memory/1436-35-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/1436-31-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/1436-25-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/1436-27-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/1436-26-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/1668-22-0x00000000024B0000-0x00000000024F0000-memory.dmpFilesize
256KB
-
memory/1668-21-0x000000006FD50000-0x00000000702FB000-memory.dmpFilesize
5.7MB
-
memory/1668-19-0x00000000024B0000-0x00000000024F0000-memory.dmpFilesize
256KB
-
memory/1668-18-0x000000006FD50000-0x00000000702FB000-memory.dmpFilesize
5.7MB
-
memory/1668-40-0x000000006FD50000-0x00000000702FB000-memory.dmpFilesize
5.7MB
-
memory/2044-0-0x0000000000BA0000-0x0000000000C60000-memory.dmpFilesize
768KB
-
memory/2044-2-0x0000000004E00000-0x0000000004E40000-memory.dmpFilesize
256KB
-
memory/2044-36-0x0000000074ED0000-0x00000000755BE000-memory.dmpFilesize
6.9MB
-
memory/2044-5-0x0000000005400000-0x0000000005482000-memory.dmpFilesize
520KB
-
memory/2044-3-0x00000000008B0000-0x00000000008C2000-memory.dmpFilesize
72KB
-
memory/2044-1-0x0000000074ED0000-0x00000000755BE000-memory.dmpFilesize
6.9MB
-
memory/2044-4-0x0000000000940000-0x000000000094C000-memory.dmpFilesize
48KB