Analysis
-
max time kernel
118s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
29-03-2024 02:17
Static task
static1
Behavioral task
behavioral1
Sample
BILLING REPORT..exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
BILLING REPORT..exe
Resource
win10v2004-20240226-en
General
-
Target
BILLING REPORT..exe
-
Size
670KB
-
MD5
82ed2d50defbaa3056e1216f7a04fd29
-
SHA1
b0c53c84b62236adb6dbe7adad055e13c6ff58cd
-
SHA256
5367bdd7476c6a1d2ac38b0d8efcbaba0c74176f86cc0f76e925407e62605071
-
SHA512
550d35d6c2dae4cf1d818a5d6d77d9359cdf4420d1dcd831cd39c179bacaf441800afe11d0961f8affe718f349d0aed92816c4b8d0c15a95231a7dad453e9356
-
SSDEEP
12288:sme0YOwq0IDzlpnjRSsrj65vGdaM6Ge/zqdrAamH8Wss:+O70I3lbBaZo6a3Wb
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.shivomrealty.com - Port:
587 - Username:
[email protected] - Password:
Priya1982# - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
BILLING REPORT..exedescription pid process target process PID 2372 set thread context of 2848 2372 BILLING REPORT..exe BILLING REPORT..exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
BILLING REPORT..exeBILLING REPORT..exepowershell.exepowershell.exepid process 2372 BILLING REPORT..exe 2372 BILLING REPORT..exe 2372 BILLING REPORT..exe 2848 BILLING REPORT..exe 2848 BILLING REPORT..exe 2532 powershell.exe 2596 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
BILLING REPORT..exeBILLING REPORT..exepowershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 2372 BILLING REPORT..exe Token: SeDebugPrivilege 2848 BILLING REPORT..exe Token: SeDebugPrivilege 2532 powershell.exe Token: SeDebugPrivilege 2596 powershell.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
BILLING REPORT..exedescription pid process target process PID 2372 wrote to memory of 2532 2372 BILLING REPORT..exe powershell.exe PID 2372 wrote to memory of 2532 2372 BILLING REPORT..exe powershell.exe PID 2372 wrote to memory of 2532 2372 BILLING REPORT..exe powershell.exe PID 2372 wrote to memory of 2532 2372 BILLING REPORT..exe powershell.exe PID 2372 wrote to memory of 2596 2372 BILLING REPORT..exe powershell.exe PID 2372 wrote to memory of 2596 2372 BILLING REPORT..exe powershell.exe PID 2372 wrote to memory of 2596 2372 BILLING REPORT..exe powershell.exe PID 2372 wrote to memory of 2596 2372 BILLING REPORT..exe powershell.exe PID 2372 wrote to memory of 2656 2372 BILLING REPORT..exe schtasks.exe PID 2372 wrote to memory of 2656 2372 BILLING REPORT..exe schtasks.exe PID 2372 wrote to memory of 2656 2372 BILLING REPORT..exe schtasks.exe PID 2372 wrote to memory of 2656 2372 BILLING REPORT..exe schtasks.exe PID 2372 wrote to memory of 2848 2372 BILLING REPORT..exe BILLING REPORT..exe PID 2372 wrote to memory of 2848 2372 BILLING REPORT..exe BILLING REPORT..exe PID 2372 wrote to memory of 2848 2372 BILLING REPORT..exe BILLING REPORT..exe PID 2372 wrote to memory of 2848 2372 BILLING REPORT..exe BILLING REPORT..exe PID 2372 wrote to memory of 2848 2372 BILLING REPORT..exe BILLING REPORT..exe PID 2372 wrote to memory of 2848 2372 BILLING REPORT..exe BILLING REPORT..exe PID 2372 wrote to memory of 2848 2372 BILLING REPORT..exe BILLING REPORT..exe PID 2372 wrote to memory of 2848 2372 BILLING REPORT..exe BILLING REPORT..exe PID 2372 wrote to memory of 2848 2372 BILLING REPORT..exe BILLING REPORT..exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\BILLING REPORT..exe"C:\Users\Admin\AppData\Local\Temp\BILLING REPORT..exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\BILLING REPORT..exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\azSeNNFbJYW.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\azSeNNFbJYW" /XML "C:\Users\Admin\AppData\Local\Temp\tmp40C8.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\BILLING REPORT..exe"C:\Users\Admin\AppData\Local\Temp\BILLING REPORT..exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp40C8.tmpFilesize
1KB
MD5f3ee2de4e36b74a5bcc0f628c822a7ee
SHA10b8bb153aa03c2cb368e50f51ce42798fe6d8ff3
SHA256d6eab13413cdb26d9ec8e3bdf415d45bb647b691aea5fcc39fd811123259317b
SHA512441bcc7dc5067f722a342f023ace84327d856a217d59f056a115a47c901b3e779505ac2fedb0dedd839882f443eea31c04091ddbcb60397b5d074cf7c90476bc
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\81XB9LG2AWIWJEDQQFU3.tempFilesize
7KB
MD5158f0db869616c7345c99857ef7fcb23
SHA1a4b5ae8e0755b0ebea289d20ab2b2c44cb877bf3
SHA25640f93644a95b046ffbd9b260668d9d7c2cf35c3f81a60954462ef69ffa6ae418
SHA5124777842c0ad0e307a38741d34e98321505787b28a452f865613ecb7bf363d6671b98767612dd06f3ef360aa0ac66e8540f9bbf3abfb93f94789de7c6e50aa175
-
memory/2372-30-0x00000000744D0000-0x0000000074BBE000-memory.dmpFilesize
6.9MB
-
memory/2372-1-0x00000000744D0000-0x0000000074BBE000-memory.dmpFilesize
6.9MB
-
memory/2372-2-0x0000000004D90000-0x0000000004DD0000-memory.dmpFilesize
256KB
-
memory/2372-3-0x0000000000540000-0x000000000055A000-memory.dmpFilesize
104KB
-
memory/2372-4-0x00000000003C0000-0x00000000003CC000-memory.dmpFilesize
48KB
-
memory/2372-5-0x00000000051C0000-0x0000000005242000-memory.dmpFilesize
520KB
-
memory/2372-0-0x0000000000F30000-0x0000000000FDE000-memory.dmpFilesize
696KB
-
memory/2532-36-0x000000006F090000-0x000000006F63B000-memory.dmpFilesize
5.7MB
-
memory/2532-32-0x000000006F090000-0x000000006F63B000-memory.dmpFilesize
5.7MB
-
memory/2532-42-0x000000006F090000-0x000000006F63B000-memory.dmpFilesize
5.7MB
-
memory/2532-39-0x0000000002A50000-0x0000000002A90000-memory.dmpFilesize
256KB
-
memory/2532-34-0x0000000002A50000-0x0000000002A90000-memory.dmpFilesize
256KB
-
memory/2596-40-0x0000000001DA0000-0x0000000001DE0000-memory.dmpFilesize
256KB
-
memory/2596-43-0x000000006F090000-0x000000006F63B000-memory.dmpFilesize
5.7MB
-
memory/2596-38-0x0000000001DA0000-0x0000000001DE0000-memory.dmpFilesize
256KB
-
memory/2596-35-0x000000006F090000-0x000000006F63B000-memory.dmpFilesize
5.7MB
-
memory/2596-33-0x000000006F090000-0x000000006F63B000-memory.dmpFilesize
5.7MB
-
memory/2848-26-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/2848-28-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/2848-19-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/2848-37-0x0000000004A30000-0x0000000004A70000-memory.dmpFilesize
256KB
-
memory/2848-31-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/2848-24-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2848-20-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/2848-41-0x0000000073030000-0x000000007371E000-memory.dmpFilesize
6.9MB
-
memory/2848-18-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/2848-22-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/2848-44-0x0000000004A30000-0x0000000004A70000-memory.dmpFilesize
256KB
-
memory/2848-45-0x0000000073030000-0x000000007371E000-memory.dmpFilesize
6.9MB