Analysis
-
max time kernel
122s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
29-03-2024 01:14
Static task
static1
Behavioral task
behavioral1
Sample
PURCHASE ORDER.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
PURCHASE ORDER.exe
Resource
win10v2004-20240226-en
General
-
Target
PURCHASE ORDER.exe
-
Size
670KB
-
MD5
82ed2d50defbaa3056e1216f7a04fd29
-
SHA1
b0c53c84b62236adb6dbe7adad055e13c6ff58cd
-
SHA256
5367bdd7476c6a1d2ac38b0d8efcbaba0c74176f86cc0f76e925407e62605071
-
SHA512
550d35d6c2dae4cf1d818a5d6d77d9359cdf4420d1dcd831cd39c179bacaf441800afe11d0961f8affe718f349d0aed92816c4b8d0c15a95231a7dad453e9356
-
SSDEEP
12288:sme0YOwq0IDzlpnjRSsrj65vGdaM6Ge/zqdrAamH8Wss:+O70I3lbBaZo6a3Wb
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.shivomrealty.com - Port:
587 - Username:
[email protected] - Password:
Priya1982# - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
PURCHASE ORDER.exedescription pid process target process PID 1940 set thread context of 2532 1940 PURCHASE ORDER.exe PURCHASE ORDER.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
PURCHASE ORDER.exePURCHASE ORDER.exepowershell.exepowershell.exepid process 1940 PURCHASE ORDER.exe 1940 PURCHASE ORDER.exe 1940 PURCHASE ORDER.exe 2532 PURCHASE ORDER.exe 2532 PURCHASE ORDER.exe 2636 powershell.exe 2528 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
PURCHASE ORDER.exePURCHASE ORDER.exepowershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 1940 PURCHASE ORDER.exe Token: SeDebugPrivilege 2532 PURCHASE ORDER.exe Token: SeDebugPrivilege 2636 powershell.exe Token: SeDebugPrivilege 2528 powershell.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
PURCHASE ORDER.exedescription pid process target process PID 1940 wrote to memory of 2636 1940 PURCHASE ORDER.exe powershell.exe PID 1940 wrote to memory of 2636 1940 PURCHASE ORDER.exe powershell.exe PID 1940 wrote to memory of 2636 1940 PURCHASE ORDER.exe powershell.exe PID 1940 wrote to memory of 2636 1940 PURCHASE ORDER.exe powershell.exe PID 1940 wrote to memory of 2528 1940 PURCHASE ORDER.exe powershell.exe PID 1940 wrote to memory of 2528 1940 PURCHASE ORDER.exe powershell.exe PID 1940 wrote to memory of 2528 1940 PURCHASE ORDER.exe powershell.exe PID 1940 wrote to memory of 2528 1940 PURCHASE ORDER.exe powershell.exe PID 1940 wrote to memory of 2428 1940 PURCHASE ORDER.exe schtasks.exe PID 1940 wrote to memory of 2428 1940 PURCHASE ORDER.exe schtasks.exe PID 1940 wrote to memory of 2428 1940 PURCHASE ORDER.exe schtasks.exe PID 1940 wrote to memory of 2428 1940 PURCHASE ORDER.exe schtasks.exe PID 1940 wrote to memory of 2532 1940 PURCHASE ORDER.exe PURCHASE ORDER.exe PID 1940 wrote to memory of 2532 1940 PURCHASE ORDER.exe PURCHASE ORDER.exe PID 1940 wrote to memory of 2532 1940 PURCHASE ORDER.exe PURCHASE ORDER.exe PID 1940 wrote to memory of 2532 1940 PURCHASE ORDER.exe PURCHASE ORDER.exe PID 1940 wrote to memory of 2532 1940 PURCHASE ORDER.exe PURCHASE ORDER.exe PID 1940 wrote to memory of 2532 1940 PURCHASE ORDER.exe PURCHASE ORDER.exe PID 1940 wrote to memory of 2532 1940 PURCHASE ORDER.exe PURCHASE ORDER.exe PID 1940 wrote to memory of 2532 1940 PURCHASE ORDER.exe PURCHASE ORDER.exe PID 1940 wrote to memory of 2532 1940 PURCHASE ORDER.exe PURCHASE ORDER.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDER.exe"C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDER.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDER.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\azSeNNFbJYW.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\azSeNNFbJYW" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8150.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDER.exe"C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDER.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp8150.tmpFilesize
1KB
MD5f5e06fca263c9857a4af70451fb0034a
SHA1142c3a0d55b3cca3ffa1e365cdb5d806126dd49a
SHA2561b0e8caf808d8301730ae96bf10510ad69d3de9f122e63a5483ba25ce303a283
SHA51213baf6bc1922c9915a1ce1c9ab75a88da4b0dc7265d2e39f93a083e60408b14fb908bd77f73f786bd8942f6e49ab9f368c9a70b307bf9a09ea73a12b4707b144
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msFilesize
7KB
MD52d6a848e36f91f82afd5aefc25ec11ce
SHA1e3eb76a6d86f0fa004da99404c1bc975d359a682
SHA256288b126beb9c2b3fa164ee590fb428a05833b6f8cb5f8abe113693290d689fb0
SHA512fc39f7f90fb78488695de85c96ed9316f435d0da3d89b69163ee385cc1251d084d9d91e4455cb57c98a1494b252f55348be9239c77c44ba647f8c005e996a04d
-
memory/1940-30-0x0000000073CA0000-0x000000007438E000-memory.dmpFilesize
6.9MB
-
memory/1940-1-0x0000000073CA0000-0x000000007438E000-memory.dmpFilesize
6.9MB
-
memory/1940-2-0x0000000001160000-0x00000000011A0000-memory.dmpFilesize
256KB
-
memory/1940-3-0x0000000000490000-0x00000000004AA000-memory.dmpFilesize
104KB
-
memory/1940-4-0x00000000004C0000-0x00000000004CC000-memory.dmpFilesize
48KB
-
memory/1940-5-0x0000000005440000-0x00000000054C2000-memory.dmpFilesize
520KB
-
memory/1940-0-0x00000000011D0000-0x000000000127E000-memory.dmpFilesize
696KB
-
memory/2528-37-0x000000006EB10000-0x000000006F0BB000-memory.dmpFilesize
5.7MB
-
memory/2528-35-0x000000006EB10000-0x000000006F0BB000-memory.dmpFilesize
5.7MB
-
memory/2532-24-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/2532-28-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/2532-31-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/2532-26-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2532-33-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/2532-22-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/2532-20-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/2636-34-0x000000006EB10000-0x000000006F0BB000-memory.dmpFilesize
5.7MB
-
memory/2636-36-0x0000000002360000-0x00000000023A0000-memory.dmpFilesize
256KB
-
memory/2636-38-0x000000006EB10000-0x000000006F0BB000-memory.dmpFilesize
5.7MB