Analysis
-
max time kernel
147s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
28-03-2024 19:16
Static task
static1
Behavioral task
behavioral1
Sample
REMITTANCE COPY.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
REMITTANCE COPY.exe
Resource
win10v2004-20240226-en
General
-
Target
REMITTANCE COPY.exe
-
Size
935KB
-
MD5
c4c5220498e9618df1443285a8bcd048
-
SHA1
e8f0b41c0eb27aaa8f3a552513ca7145a241fe91
-
SHA256
99f730c18a5d4a5bb442c5b7045bf38f2aa183a7c9121ee60ce7bb345510557f
-
SHA512
cf9515514500c7ec674390aa30cdfb15960167dbe99164de757762b5d0fda913e442be2cfd4420b2c2f5a942c9ebdb5efb5619010245cfc93b83aec741a03b59
-
SSDEEP
6144:bCw9AapDnOzrN9J6Uq4/TC8lDBjyaMqr4zyUHVIB8NafdOUJq3WC1NfCBmCrnrIK:b59p91Ubr1WlqTiV1NnUJq3WQfCGcT3
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.westviewcargos.com - Port:
587 - Username:
[email protected] - Password:
Choice@@@12345
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/2192-15-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla behavioral1/memory/2192-14-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla behavioral1/memory/2192-18-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla behavioral1/memory/2192-22-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla behavioral1/memory/2192-20-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla behavioral1/memory/2192-28-0x0000000004850000-0x0000000004890000-memory.dmp family_agenttesla -
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
Processes:
REMITTANCE COPY.exedescription ioc process Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Oracle\VirtualBox Guest Additions REMITTANCE COPY.exe -
Looks for VMWare Tools registry key 2 TTPs 1 IoCs
Processes:
REMITTANCE COPY.exedescription ioc process Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools REMITTANCE COPY.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
REMITTANCE COPY.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion REMITTANCE COPY.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion REMITTANCE COPY.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
REMITTANCE COPY.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 REMITTANCE COPY.exe Key opened \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 REMITTANCE COPY.exe Key opened \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 REMITTANCE COPY.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
REMITTANCE COPY.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\lyNwef = "C:\\Users\\Admin\\AppData\\Roaming\\lyNwef\\lyNwef.exe" REMITTANCE COPY.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
REMITTANCE COPY.exedescription ioc process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 REMITTANCE COPY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum REMITTANCE COPY.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
REMITTANCE COPY.exedescription pid process target process PID 2384 set thread context of 2192 2384 REMITTANCE COPY.exe REMITTANCE COPY.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
REMITTANCE COPY.exeREMITTANCE COPY.exepid process 2384 REMITTANCE COPY.exe 2192 REMITTANCE COPY.exe 2192 REMITTANCE COPY.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
REMITTANCE COPY.exeREMITTANCE COPY.exedescription pid process Token: SeDebugPrivilege 2384 REMITTANCE COPY.exe Token: SeDebugPrivilege 2192 REMITTANCE COPY.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
REMITTANCE COPY.exepid process 2192 REMITTANCE COPY.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
REMITTANCE COPY.exedescription pid process target process PID 2384 wrote to memory of 2716 2384 REMITTANCE COPY.exe schtasks.exe PID 2384 wrote to memory of 2716 2384 REMITTANCE COPY.exe schtasks.exe PID 2384 wrote to memory of 2716 2384 REMITTANCE COPY.exe schtasks.exe PID 2384 wrote to memory of 2716 2384 REMITTANCE COPY.exe schtasks.exe PID 2384 wrote to memory of 2192 2384 REMITTANCE COPY.exe REMITTANCE COPY.exe PID 2384 wrote to memory of 2192 2384 REMITTANCE COPY.exe REMITTANCE COPY.exe PID 2384 wrote to memory of 2192 2384 REMITTANCE COPY.exe REMITTANCE COPY.exe PID 2384 wrote to memory of 2192 2384 REMITTANCE COPY.exe REMITTANCE COPY.exe PID 2384 wrote to memory of 2192 2384 REMITTANCE COPY.exe REMITTANCE COPY.exe PID 2384 wrote to memory of 2192 2384 REMITTANCE COPY.exe REMITTANCE COPY.exe PID 2384 wrote to memory of 2192 2384 REMITTANCE COPY.exe REMITTANCE COPY.exe PID 2384 wrote to memory of 2192 2384 REMITTANCE COPY.exe REMITTANCE COPY.exe PID 2384 wrote to memory of 2192 2384 REMITTANCE COPY.exe REMITTANCE COPY.exe -
outlook_office_path 1 IoCs
Processes:
REMITTANCE COPY.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 REMITTANCE COPY.exe -
outlook_win_path 1 IoCs
Processes:
REMITTANCE COPY.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 REMITTANCE COPY.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\REMITTANCE COPY.exe"C:\Users\Admin\AppData\Local\Temp\REMITTANCE COPY.exe"1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\zcvmximsXc" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA821.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\REMITTANCE COPY.exe"{path}"2⤵
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Credential Access
Unsecured Credentials
4Credentials In Files
3Credentials in Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpA821.tmpFilesize
1KB
MD5550d320609b775c7a5388139ddb33099
SHA1b9ac411b85050dbe4d308d71f1b1c8f8f1caff06
SHA2565181b7a413ee3551ca24c93737993d62103ad71209a146e8233082fe56963134
SHA512fa1242f57f7555ec1b9c81315610e6413557443c3540819a994800c299943adf269ff99587dec1137c025e3e8d82948399cc89bae5948a0372ac4cc8e8216a07
-
memory/2192-24-0x0000000073FC0000-0x00000000746AE000-memory.dmpFilesize
6.9MB
-
memory/2192-30-0x0000000004850000-0x0000000004890000-memory.dmpFilesize
256KB
-
memory/2192-28-0x0000000004850000-0x0000000004890000-memory.dmpFilesize
256KB
-
memory/2192-27-0x0000000073FC0000-0x00000000746AE000-memory.dmpFilesize
6.9MB
-
memory/2192-25-0x0000000004850000-0x0000000004890000-memory.dmpFilesize
256KB
-
memory/2192-22-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/2192-20-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/2192-29-0x0000000004850000-0x0000000004890000-memory.dmpFilesize
256KB
-
memory/2192-11-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/2192-13-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/2192-15-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/2192-14-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/2192-16-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2192-18-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/2384-6-0x00000000052C0000-0x0000000005344000-memory.dmpFilesize
528KB
-
memory/2384-7-0x0000000001EC0000-0x0000000001EFE000-memory.dmpFilesize
248KB
-
memory/2384-0-0x0000000000990000-0x0000000000A80000-memory.dmpFilesize
960KB
-
memory/2384-23-0x0000000073FC0000-0x00000000746AE000-memory.dmpFilesize
6.9MB
-
memory/2384-5-0x00000000020B0000-0x00000000020F0000-memory.dmpFilesize
256KB
-
memory/2384-4-0x0000000073FC0000-0x00000000746AE000-memory.dmpFilesize
6.9MB
-
memory/2384-3-0x0000000000280000-0x0000000000294000-memory.dmpFilesize
80KB
-
memory/2384-2-0x00000000020B0000-0x00000000020F0000-memory.dmpFilesize
256KB
-
memory/2384-1-0x0000000073FC0000-0x00000000746AE000-memory.dmpFilesize
6.9MB