Analysis
-
max time kernel
139s -
max time network
162s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
29-03-2024 01:55
Static task
static1
Behavioral task
behavioral1
Sample
Bank slip.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Bank slip.exe
Resource
win10v2004-20240226-en
General
-
Target
Bank slip.exe
-
Size
810KB
-
MD5
dfa4d69d102efe18603b643e03cd916f
-
SHA1
104857721a2a10211bf4638fc1aac4f01026839d
-
SHA256
ae7f2736fd9aa11676e139b0d89f702cd2fab6660b9b589c1feddc4898520c41
-
SHA512
0e248fc8bbc5db13db05c266b46a0bbd4900de17c5208c881fc66ff0732cd67af50000936da1a1b198fefa9e9407388fdf9ff78116b5b2abdaa02817a67f46fe
-
SSDEEP
12288:GfpsApRsBWD84RF1RSaXXqftMwjfBCQr60ijTLGSCB8rBCg09poeV:GtpRse40MvCVTGhBoCX9
Malware Config
Extracted
Protocol: smtp- Host:
mail.kabeercommodities.com - Port:
587 - Username:
[email protected] - Password:
w{A6H.o&sz%g
Extracted
agenttesla
Protocol: smtp- Host:
mail.kabeercommodities.com - Port:
587 - Username:
[email protected] - Password:
w{A6H.o&sz%g - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Bank slip.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation Bank slip.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 44 api.ipify.org 45 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Bank slip.exedescription pid process target process PID 3184 set thread context of 1492 3184 Bank slip.exe Bank slip.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 18 IoCs
Processes:
Bank slip.exeBank slip.exepowershell.exepowershell.exepid process 3184 Bank slip.exe 3184 Bank slip.exe 3184 Bank slip.exe 3184 Bank slip.exe 3184 Bank slip.exe 3184 Bank slip.exe 3184 Bank slip.exe 3184 Bank slip.exe 3184 Bank slip.exe 1492 Bank slip.exe 1492 Bank slip.exe 1492 Bank slip.exe 1608 powershell.exe 5796 powershell.exe 1608 powershell.exe 5796 powershell.exe 5796 powershell.exe 1608 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
Bank slip.exepowershell.exepowershell.exeBank slip.exedescription pid process Token: SeDebugPrivilege 3184 Bank slip.exe Token: SeDebugPrivilege 1608 powershell.exe Token: SeDebugPrivilege 5796 powershell.exe Token: SeDebugPrivilege 1492 Bank slip.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
Bank slip.exedescription pid process target process PID 3184 wrote to memory of 1608 3184 Bank slip.exe powershell.exe PID 3184 wrote to memory of 1608 3184 Bank slip.exe powershell.exe PID 3184 wrote to memory of 1608 3184 Bank slip.exe powershell.exe PID 3184 wrote to memory of 5796 3184 Bank slip.exe powershell.exe PID 3184 wrote to memory of 5796 3184 Bank slip.exe powershell.exe PID 3184 wrote to memory of 5796 3184 Bank slip.exe powershell.exe PID 3184 wrote to memory of 2776 3184 Bank slip.exe schtasks.exe PID 3184 wrote to memory of 2776 3184 Bank slip.exe schtasks.exe PID 3184 wrote to memory of 2776 3184 Bank slip.exe schtasks.exe PID 3184 wrote to memory of 1492 3184 Bank slip.exe Bank slip.exe PID 3184 wrote to memory of 1492 3184 Bank slip.exe Bank slip.exe PID 3184 wrote to memory of 1492 3184 Bank slip.exe Bank slip.exe PID 3184 wrote to memory of 1492 3184 Bank slip.exe Bank slip.exe PID 3184 wrote to memory of 1492 3184 Bank slip.exe Bank slip.exe PID 3184 wrote to memory of 1492 3184 Bank slip.exe Bank slip.exe PID 3184 wrote to memory of 1492 3184 Bank slip.exe Bank slip.exe PID 3184 wrote to memory of 1492 3184 Bank slip.exe Bank slip.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Bank slip.exe"C:\Users\Admin\AppData\Local\Temp\Bank slip.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Bank slip.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\uhoFDbAUHRPNgj.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\uhoFDbAUHRPNgj" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5C30.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\Bank slip.exe"C:\Users\Admin\AppData\Local\Temp\Bank slip.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4028 --field-trial-handle=2280,i,1836084024518340990,18250262151825427757,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bwnc0cnd.ibn.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\tmp5C30.tmpFilesize
1KB
MD5538fef1b478a57fccfcb3f2d12d4a68f
SHA17ff9817c1a345bd6b43c1e1cb9c0683f8ecdbe49
SHA2566c8106038ca73037931a0e65b43211421eba24382132f79b964f1385de6db1b5
SHA512d2f5300256cfa92adf8e9c0a504436710f11ab6c6cdd0307525f509d36349e9a8d5a0e9004942a8ae599b987fe305396e2ef48dc2236b2044d5dd75151b55e40
-
memory/1492-90-0x0000000005B00000-0x0000000005B10000-memory.dmpFilesize
64KB
-
memory/1492-61-0x0000000074D00000-0x00000000754B0000-memory.dmpFilesize
7.7MB
-
memory/1492-59-0x0000000006FF0000-0x0000000007040000-memory.dmpFilesize
320KB
-
memory/1492-28-0x0000000005B10000-0x0000000005B76000-memory.dmpFilesize
408KB
-
memory/1492-26-0x0000000005B00000-0x0000000005B10000-memory.dmpFilesize
64KB
-
memory/1492-25-0x0000000074D00000-0x00000000754B0000-memory.dmpFilesize
7.7MB
-
memory/1492-23-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/1608-51-0x0000000074D00000-0x00000000754B0000-memory.dmpFilesize
7.7MB
-
memory/1608-86-0x0000000006FA0000-0x0000000007043000-memory.dmpFilesize
652KB
-
memory/1608-99-0x0000000074D00000-0x00000000754B0000-memory.dmpFilesize
7.7MB
-
memory/1608-12-0x0000000074D00000-0x00000000754B0000-memory.dmpFilesize
7.7MB
-
memory/1608-13-0x00000000023A0000-0x00000000023B0000-memory.dmpFilesize
64KB
-
memory/1608-16-0x0000000002420000-0x0000000002456000-memory.dmpFilesize
216KB
-
memory/1608-93-0x0000000006210000-0x000000000621E000-memory.dmpFilesize
56KB
-
memory/1608-91-0x0000000007350000-0x00000000073E6000-memory.dmpFilesize
600KB
-
memory/1608-89-0x0000000007140000-0x000000000714A000-memory.dmpFilesize
40KB
-
memory/1608-87-0x0000000007720000-0x0000000007D9A000-memory.dmpFilesize
6.5MB
-
memory/1608-66-0x0000000070D00000-0x0000000070D4C000-memory.dmpFilesize
304KB
-
memory/1608-63-0x000000007F930000-0x000000007F940000-memory.dmpFilesize
64KB
-
memory/1608-64-0x00000000063A0000-0x00000000063D2000-memory.dmpFilesize
200KB
-
memory/1608-56-0x00000000023A0000-0x00000000023B0000-memory.dmpFilesize
64KB
-
memory/1608-54-0x00000000023A0000-0x00000000023B0000-memory.dmpFilesize
64KB
-
memory/1608-29-0x0000000004DB0000-0x0000000004DD2000-memory.dmpFilesize
136KB
-
memory/1608-30-0x0000000004A40000-0x0000000004AA6000-memory.dmpFilesize
408KB
-
memory/1608-53-0x00000000023A0000-0x00000000023B0000-memory.dmpFilesize
64KB
-
memory/1608-49-0x0000000005870000-0x0000000005BC4000-memory.dmpFilesize
3.3MB
-
memory/1608-52-0x0000000005E10000-0x0000000005E5C000-memory.dmpFilesize
304KB
-
memory/3184-1-0x0000000000450000-0x0000000000520000-memory.dmpFilesize
832KB
-
memory/3184-5-0x0000000004EF0000-0x0000000004F00000-memory.dmpFilesize
64KB
-
memory/3184-8-0x0000000004EF0000-0x0000000004F00000-memory.dmpFilesize
64KB
-
memory/3184-4-0x0000000074D00000-0x00000000754B0000-memory.dmpFilesize
7.7MB
-
memory/3184-11-0x000000000A680000-0x000000000A71C000-memory.dmpFilesize
624KB
-
memory/3184-27-0x0000000074D00000-0x00000000754B0000-memory.dmpFilesize
7.7MB
-
memory/3184-0-0x0000000074D00000-0x00000000754B0000-memory.dmpFilesize
7.7MB
-
memory/3184-9-0x0000000007B70000-0x0000000007B7C000-memory.dmpFilesize
48KB
-
memory/3184-3-0x0000000004F40000-0x0000000004FD2000-memory.dmpFilesize
584KB
-
memory/3184-10-0x0000000007EF0000-0x0000000007F72000-memory.dmpFilesize
520KB
-
memory/3184-2-0x0000000005450000-0x00000000059F4000-memory.dmpFilesize
5.6MB
-
memory/3184-6-0x0000000004F20000-0x0000000004F2A000-memory.dmpFilesize
40KB
-
memory/3184-7-0x0000000007B50000-0x0000000007B6A000-memory.dmpFilesize
104KB
-
memory/5796-100-0x0000000074D00000-0x00000000754B0000-memory.dmpFilesize
7.7MB
-
memory/5796-60-0x0000000004A70000-0x0000000004A80000-memory.dmpFilesize
64KB
-
memory/5796-62-0x000000007FB40000-0x000000007FB50000-memory.dmpFilesize
64KB
-
memory/5796-76-0x00000000065E0000-0x00000000065FE000-memory.dmpFilesize
120KB
-
memory/5796-50-0x0000000005E40000-0x0000000005E5E000-memory.dmpFilesize
120KB
-
memory/5796-22-0x00000000050B0000-0x00000000056D8000-memory.dmpFilesize
6.2MB
-
memory/5796-88-0x0000000007330000-0x000000000734A000-memory.dmpFilesize
104KB
-
memory/5796-92-0x0000000007530000-0x0000000007541000-memory.dmpFilesize
68KB
-
memory/5796-20-0x0000000004A70000-0x0000000004A80000-memory.dmpFilesize
64KB
-
memory/5796-57-0x0000000074D00000-0x00000000754B0000-memory.dmpFilesize
7.7MB
-
memory/5796-65-0x0000000070D00000-0x0000000070D4C000-memory.dmpFilesize
304KB
-
memory/5796-19-0x0000000074D00000-0x00000000754B0000-memory.dmpFilesize
7.7MB
-
memory/5796-94-0x0000000006430000-0x0000000006444000-memory.dmpFilesize
80KB
-
memory/5796-95-0x0000000007670000-0x000000000768A000-memory.dmpFilesize
104KB
-
memory/5796-96-0x0000000007650000-0x0000000007658000-memory.dmpFilesize
32KB
-
memory/5796-55-0x0000000004A70000-0x0000000004A80000-memory.dmpFilesize
64KB
-
memory/5796-58-0x0000000004A70000-0x0000000004A80000-memory.dmpFilesize
64KB