Analysis
-
max time kernel
120s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
24-04-2024 04:08
Static task
static1
Behavioral task
behavioral1
Sample
CREDIT NOTE.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
CREDIT NOTE.exe
Resource
win10v2004-20240412-en
General
-
Target
CREDIT NOTE.exe
-
Size
827KB
-
MD5
44b581457172335dd3903c5bf659a035
-
SHA1
9415e8affeae395c04046a9189414b4787291f14
-
SHA256
8b3133696ef1e7609974f8084f6ca977ab74db7c688fa7b8df83b2e9231f1764
-
SHA512
e76c5f05cc83f43f6adfe490df29e6514c1f5b8428ac878a92300b36053fcef1bd987969ddcc8c3ea7c25ffa58cf287456b462f1cbba39f5e3392cc65403035a
-
SSDEEP
12288:T9CF9WMGkyCehy9LdriuW3hny6SNZX2/paka16cMRTjfxwNGNUt842vB8x8xqirq:ZC2MreQLMrF/pa1yRTbNey42vudgZM
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.unitechautomations.com - Port:
587 - Username:
[email protected] - Password:
Unitech@123 - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
RegSvcs.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\GUIVTme = "C:\\Users\\Admin\\AppData\\Roaming\\GUIVTme\\GUIVTme.exe" RegSvcs.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
CREDIT NOTE.exedescription pid process target process PID 1284 set thread context of 2696 1284 CREDIT NOTE.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
CREDIT NOTE.exeRegSvcs.exepowershell.exepowershell.exepid process 1284 CREDIT NOTE.exe 1284 CREDIT NOTE.exe 1284 CREDIT NOTE.exe 1284 CREDIT NOTE.exe 2696 RegSvcs.exe 2696 RegSvcs.exe 2656 powershell.exe 2576 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
CREDIT NOTE.exeRegSvcs.exepowershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 1284 CREDIT NOTE.exe Token: SeDebugPrivilege 2696 RegSvcs.exe Token: SeDebugPrivilege 2656 powershell.exe Token: SeDebugPrivilege 2576 powershell.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
CREDIT NOTE.exedescription pid process target process PID 1284 wrote to memory of 2576 1284 CREDIT NOTE.exe powershell.exe PID 1284 wrote to memory of 2576 1284 CREDIT NOTE.exe powershell.exe PID 1284 wrote to memory of 2576 1284 CREDIT NOTE.exe powershell.exe PID 1284 wrote to memory of 2576 1284 CREDIT NOTE.exe powershell.exe PID 1284 wrote to memory of 2656 1284 CREDIT NOTE.exe powershell.exe PID 1284 wrote to memory of 2656 1284 CREDIT NOTE.exe powershell.exe PID 1284 wrote to memory of 2656 1284 CREDIT NOTE.exe powershell.exe PID 1284 wrote to memory of 2656 1284 CREDIT NOTE.exe powershell.exe PID 1284 wrote to memory of 2432 1284 CREDIT NOTE.exe schtasks.exe PID 1284 wrote to memory of 2432 1284 CREDIT NOTE.exe schtasks.exe PID 1284 wrote to memory of 2432 1284 CREDIT NOTE.exe schtasks.exe PID 1284 wrote to memory of 2432 1284 CREDIT NOTE.exe schtasks.exe PID 1284 wrote to memory of 2696 1284 CREDIT NOTE.exe RegSvcs.exe PID 1284 wrote to memory of 2696 1284 CREDIT NOTE.exe RegSvcs.exe PID 1284 wrote to memory of 2696 1284 CREDIT NOTE.exe RegSvcs.exe PID 1284 wrote to memory of 2696 1284 CREDIT NOTE.exe RegSvcs.exe PID 1284 wrote to memory of 2696 1284 CREDIT NOTE.exe RegSvcs.exe PID 1284 wrote to memory of 2696 1284 CREDIT NOTE.exe RegSvcs.exe PID 1284 wrote to memory of 2696 1284 CREDIT NOTE.exe RegSvcs.exe PID 1284 wrote to memory of 2696 1284 CREDIT NOTE.exe RegSvcs.exe PID 1284 wrote to memory of 2696 1284 CREDIT NOTE.exe RegSvcs.exe PID 1284 wrote to memory of 2696 1284 CREDIT NOTE.exe RegSvcs.exe PID 1284 wrote to memory of 2696 1284 CREDIT NOTE.exe RegSvcs.exe PID 1284 wrote to memory of 2696 1284 CREDIT NOTE.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\CREDIT NOTE.exe"C:\Users\Admin\AppData\Local\Temp\CREDIT NOTE.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\CREDIT NOTE.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2576 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\itqsdfDZLZo.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2656 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\itqsdfDZLZo" /XML "C:\Users\Admin\AppData\Local\Temp\tmpCEA5.tmp"2⤵
- Creates scheduled task(s)
PID:2432 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2696
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpCEA5.tmpFilesize
1KB
MD53a38ad5df90c9160aad7e4b5e85e5212
SHA1b3991f25fc7264b9ed4a6c38aa4fb47d7fd6238f
SHA256e217860168d51732c84be0d89bda51bc39c8ff0a4ea1f8ae51854a8140fcfbfe
SHA51214454d4615765c5dde92ace6680517390dbc0f588b1433b5f4e6125e39498b24179ab1d49c58fd23e6a99f3cf27e2e2ef2bdaefb7fbfa1d64f91b77bb0508ad9
-
memory/1284-6-0x00000000004C0000-0x0000000000544000-memory.dmpFilesize
528KB
-
memory/1284-2-0x0000000004B00000-0x0000000004B40000-memory.dmpFilesize
256KB
-
memory/1284-3-0x0000000000360000-0x0000000000378000-memory.dmpFilesize
96KB
-
memory/1284-4-0x00000000005B0000-0x00000000005BE000-memory.dmpFilesize
56KB
-
memory/1284-5-0x00000000005C0000-0x00000000005D4000-memory.dmpFilesize
80KB
-
memory/1284-30-0x00000000745E0000-0x0000000074CCE000-memory.dmpFilesize
6.9MB
-
memory/1284-1-0x00000000745E0000-0x0000000074CCE000-memory.dmpFilesize
6.9MB
-
memory/1284-0-0x0000000000A40000-0x0000000000B14000-memory.dmpFilesize
848KB
-
memory/2576-41-0x000000006E810000-0x000000006EDBB000-memory.dmpFilesize
5.7MB
-
memory/2576-40-0x00000000026D0000-0x0000000002710000-memory.dmpFilesize
256KB
-
memory/2576-37-0x00000000026D0000-0x0000000002710000-memory.dmpFilesize
256KB
-
memory/2576-33-0x000000006E810000-0x000000006EDBB000-memory.dmpFilesize
5.7MB
-
memory/2576-31-0x000000006E810000-0x000000006EDBB000-memory.dmpFilesize
5.7MB
-
memory/2656-35-0x000000006E810000-0x000000006EDBB000-memory.dmpFilesize
5.7MB
-
memory/2656-36-0x0000000001F50000-0x0000000001F90000-memory.dmpFilesize
256KB
-
memory/2656-42-0x000000006E810000-0x000000006EDBB000-memory.dmpFilesize
5.7MB
-
memory/2656-38-0x0000000001F50000-0x0000000001F90000-memory.dmpFilesize
256KB
-
memory/2656-32-0x000000006E810000-0x000000006EDBB000-memory.dmpFilesize
5.7MB
-
memory/2656-34-0x0000000001F50000-0x0000000001F90000-memory.dmpFilesize
256KB
-
memory/2696-21-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2696-29-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2696-23-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2696-25-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2696-19-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2696-39-0x00000000745E0000-0x0000000074CCE000-memory.dmpFilesize
6.9MB
-
memory/2696-18-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2696-27-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2696-17-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2696-44-0x00000000745E0000-0x0000000074CCE000-memory.dmpFilesize
6.9MB