Analysis
-
max time kernel
131s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
28-03-2024 19:16
Static task
static1
Behavioral task
behavioral1
Sample
REMITTANCE COPY.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
REMITTANCE COPY.exe
Resource
win10v2004-20240226-en
General
-
Target
REMITTANCE COPY.exe
-
Size
935KB
-
MD5
c4c5220498e9618df1443285a8bcd048
-
SHA1
e8f0b41c0eb27aaa8f3a552513ca7145a241fe91
-
SHA256
99f730c18a5d4a5bb442c5b7045bf38f2aa183a7c9121ee60ce7bb345510557f
-
SHA512
cf9515514500c7ec674390aa30cdfb15960167dbe99164de757762b5d0fda913e442be2cfd4420b2c2f5a942c9ebdb5efb5619010245cfc93b83aec741a03b59
-
SSDEEP
6144:bCw9AapDnOzrN9J6Uq4/TC8lDBjyaMqr4zyUHVIB8NafdOUJq3WC1NfCBmCrnrIK:b59p91Ubr1WlqTiV1NnUJq3WQfCGcT3
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.westviewcargos.com - Port:
587 - Username:
[email protected] - Password:
Choice@@@12345
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4056-16-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla -
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
Processes:
REMITTANCE COPY.exedescription ioc process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Oracle\VirtualBox Guest Additions REMITTANCE COPY.exe -
Looks for VMWare Tools registry key 2 TTPs 1 IoCs
Processes:
REMITTANCE COPY.exedescription ioc process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\VMware, Inc.\VMware Tools REMITTANCE COPY.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
REMITTANCE COPY.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion REMITTANCE COPY.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion REMITTANCE COPY.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
REMITTANCE COPY.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation REMITTANCE COPY.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
REMITTANCE COPY.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 REMITTANCE COPY.exe Key opened \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 REMITTANCE COPY.exe Key opened \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 REMITTANCE COPY.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
REMITTANCE COPY.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lyNwef = "C:\\Users\\Admin\\AppData\\Roaming\\lyNwef\\lyNwef.exe" REMITTANCE COPY.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
REMITTANCE COPY.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum REMITTANCE COPY.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 REMITTANCE COPY.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
REMITTANCE COPY.exedescription pid process target process PID 1040 set thread context of 4056 1040 REMITTANCE COPY.exe REMITTANCE COPY.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
REMITTANCE COPY.exeREMITTANCE COPY.exepid process 1040 REMITTANCE COPY.exe 4056 REMITTANCE COPY.exe 4056 REMITTANCE COPY.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
REMITTANCE COPY.exeREMITTANCE COPY.exedescription pid process Token: SeDebugPrivilege 1040 REMITTANCE COPY.exe Token: SeDebugPrivilege 4056 REMITTANCE COPY.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
REMITTANCE COPY.exepid process 4056 REMITTANCE COPY.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
REMITTANCE COPY.exedescription pid process target process PID 1040 wrote to memory of 1144 1040 REMITTANCE COPY.exe schtasks.exe PID 1040 wrote to memory of 1144 1040 REMITTANCE COPY.exe schtasks.exe PID 1040 wrote to memory of 1144 1040 REMITTANCE COPY.exe schtasks.exe PID 1040 wrote to memory of 4056 1040 REMITTANCE COPY.exe REMITTANCE COPY.exe PID 1040 wrote to memory of 4056 1040 REMITTANCE COPY.exe REMITTANCE COPY.exe PID 1040 wrote to memory of 4056 1040 REMITTANCE COPY.exe REMITTANCE COPY.exe PID 1040 wrote to memory of 4056 1040 REMITTANCE COPY.exe REMITTANCE COPY.exe PID 1040 wrote to memory of 4056 1040 REMITTANCE COPY.exe REMITTANCE COPY.exe PID 1040 wrote to memory of 4056 1040 REMITTANCE COPY.exe REMITTANCE COPY.exe PID 1040 wrote to memory of 4056 1040 REMITTANCE COPY.exe REMITTANCE COPY.exe PID 1040 wrote to memory of 4056 1040 REMITTANCE COPY.exe REMITTANCE COPY.exe -
outlook_office_path 1 IoCs
Processes:
REMITTANCE COPY.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 REMITTANCE COPY.exe -
outlook_win_path 1 IoCs
Processes:
REMITTANCE COPY.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 REMITTANCE COPY.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\REMITTANCE COPY.exe"C:\Users\Admin\AppData\Local\Temp\REMITTANCE COPY.exe"1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Checks computer location settings
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\zcvmximsXc" /XML "C:\Users\Admin\AppData\Local\Temp\tmpDE79.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\REMITTANCE COPY.exe"{path}"2⤵
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Credential Access
Unsecured Credentials
4Credentials In Files
3Credentials in Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\REMITTANCE COPY.exe.logFilesize
1KB
MD53aea5c16a0e7b995983bd1771d5ea11d
SHA15ce845c82ace7946cec271a8bac45572b977419c
SHA2568d7143472e7cf3a40f46c6346251661e10fe3a932321cff14190648ee3d9c02f
SHA5124d0949cc3c0b7bc19b94a7166fb1a528c5833773b4b577f1730c4aab93ec03f3d72714ebf8a103f2a6ab4f97abef2945e78c91d464885fb4f1f9c584d7a1b243
-
C:\Users\Admin\AppData\Local\Temp\tmpDE79.tmpFilesize
1KB
MD53c874168781ea0d17ccd085ebd823380
SHA1e019fd2c4452629423893d93841d01c99ee5f195
SHA25624a278bce57414357f504a010f479f938fd3dc21e994b622eb2ef2ba93baaadf
SHA512aaf20825cc5ef2990421caea9edc8ef7df7196c56056ea5270b0e02adb85c8b504a58c15d5d359b700b6de442e24f7fde44a1c142825985a23fd6a4e92107cff
-
memory/1040-12-0x000000000E970000-0x000000000E9D6000-memory.dmpFilesize
408KB
-
memory/1040-4-0x0000000004FA0000-0x000000000503C000-memory.dmpFilesize
624KB
-
memory/1040-2-0x00000000054B0000-0x0000000005A54000-memory.dmpFilesize
5.6MB
-
memory/1040-5-0x0000000005150000-0x0000000005160000-memory.dmpFilesize
64KB
-
memory/1040-6-0x0000000004ED0000-0x0000000004EDA000-memory.dmpFilesize
40KB
-
memory/1040-7-0x0000000004850000-0x0000000004864000-memory.dmpFilesize
80KB
-
memory/1040-8-0x0000000075380000-0x0000000075B30000-memory.dmpFilesize
7.7MB
-
memory/1040-9-0x0000000005150000-0x0000000005160000-memory.dmpFilesize
64KB
-
memory/1040-0-0x0000000000350000-0x0000000000440000-memory.dmpFilesize
960KB
-
memory/1040-11-0x00000000074D0000-0x000000000750E000-memory.dmpFilesize
248KB
-
memory/1040-20-0x0000000075380000-0x0000000075B30000-memory.dmpFilesize
7.7MB
-
memory/1040-3-0x0000000004E10000-0x0000000004EA2000-memory.dmpFilesize
584KB
-
memory/1040-10-0x0000000006450000-0x00000000064D4000-memory.dmpFilesize
528KB
-
memory/1040-1-0x0000000075380000-0x0000000075B30000-memory.dmpFilesize
7.7MB
-
memory/4056-19-0x0000000075380000-0x0000000075B30000-memory.dmpFilesize
7.7MB
-
memory/4056-27-0x0000000005690000-0x00000000056A0000-memory.dmpFilesize
64KB
-
memory/4056-21-0x0000000005690000-0x00000000056A0000-memory.dmpFilesize
64KB
-
memory/4056-22-0x0000000005670000-0x0000000005688000-memory.dmpFilesize
96KB
-
memory/4056-24-0x0000000075380000-0x0000000075B30000-memory.dmpFilesize
7.7MB
-
memory/4056-25-0x0000000005690000-0x00000000056A0000-memory.dmpFilesize
64KB
-
memory/4056-26-0x00000000068F0000-0x0000000006940000-memory.dmpFilesize
320KB
-
memory/4056-16-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB