Analysis
-
max time kernel
140s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
24-04-2024 04:08
Static task
static1
Behavioral task
behavioral1
Sample
CREDIT NOTE.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
CREDIT NOTE.exe
Resource
win10v2004-20240412-en
General
-
Target
CREDIT NOTE.exe
-
Size
827KB
-
MD5
44b581457172335dd3903c5bf659a035
-
SHA1
9415e8affeae395c04046a9189414b4787291f14
-
SHA256
8b3133696ef1e7609974f8084f6ca977ab74db7c688fa7b8df83b2e9231f1764
-
SHA512
e76c5f05cc83f43f6adfe490df29e6514c1f5b8428ac878a92300b36053fcef1bd987969ddcc8c3ea7c25ffa58cf287456b462f1cbba39f5e3392cc65403035a
-
SSDEEP
12288:T9CF9WMGkyCehy9LdriuW3hny6SNZX2/paka16cMRTjfxwNGNUt842vB8x8xqirq:ZC2MreQLMrF/pa1yRTbNey42vudgZM
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.unitechautomations.com - Port:
587 - Username:
[email protected] - Password:
Unitech@123 - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
CREDIT NOTE.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\Control Panel\International\Geo\Nation CREDIT NOTE.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
RegSvcs.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GUIVTme = "C:\\Users\\Admin\\AppData\\Roaming\\GUIVTme\\GUIVTme.exe" RegSvcs.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
CREDIT NOTE.exedescription pid process target process PID 184 set thread context of 1316 184 CREDIT NOTE.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 18 IoCs
Processes:
CREDIT NOTE.exepowershell.exepowershell.exeRegSvcs.exepid process 184 CREDIT NOTE.exe 184 CREDIT NOTE.exe 184 CREDIT NOTE.exe 184 CREDIT NOTE.exe 184 CREDIT NOTE.exe 184 CREDIT NOTE.exe 1536 powershell.exe 1536 powershell.exe 184 CREDIT NOTE.exe 184 CREDIT NOTE.exe 5092 powershell.exe 5092 powershell.exe 184 CREDIT NOTE.exe 1316 RegSvcs.exe 1316 RegSvcs.exe 1316 RegSvcs.exe 1536 powershell.exe 5092 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
CREDIT NOTE.exepowershell.exepowershell.exeRegSvcs.exedescription pid process Token: SeDebugPrivilege 184 CREDIT NOTE.exe Token: SeDebugPrivilege 1536 powershell.exe Token: SeDebugPrivilege 5092 powershell.exe Token: SeDebugPrivilege 1316 RegSvcs.exe -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
CREDIT NOTE.exedescription pid process target process PID 184 wrote to memory of 1536 184 CREDIT NOTE.exe powershell.exe PID 184 wrote to memory of 1536 184 CREDIT NOTE.exe powershell.exe PID 184 wrote to memory of 1536 184 CREDIT NOTE.exe powershell.exe PID 184 wrote to memory of 5092 184 CREDIT NOTE.exe powershell.exe PID 184 wrote to memory of 5092 184 CREDIT NOTE.exe powershell.exe PID 184 wrote to memory of 5092 184 CREDIT NOTE.exe powershell.exe PID 184 wrote to memory of 3044 184 CREDIT NOTE.exe schtasks.exe PID 184 wrote to memory of 3044 184 CREDIT NOTE.exe schtasks.exe PID 184 wrote to memory of 3044 184 CREDIT NOTE.exe schtasks.exe PID 184 wrote to memory of 4640 184 CREDIT NOTE.exe RegSvcs.exe PID 184 wrote to memory of 4640 184 CREDIT NOTE.exe RegSvcs.exe PID 184 wrote to memory of 4640 184 CREDIT NOTE.exe RegSvcs.exe PID 184 wrote to memory of 2060 184 CREDIT NOTE.exe RegSvcs.exe PID 184 wrote to memory of 2060 184 CREDIT NOTE.exe RegSvcs.exe PID 184 wrote to memory of 2060 184 CREDIT NOTE.exe RegSvcs.exe PID 184 wrote to memory of 1316 184 CREDIT NOTE.exe RegSvcs.exe PID 184 wrote to memory of 1316 184 CREDIT NOTE.exe RegSvcs.exe PID 184 wrote to memory of 1316 184 CREDIT NOTE.exe RegSvcs.exe PID 184 wrote to memory of 1316 184 CREDIT NOTE.exe RegSvcs.exe PID 184 wrote to memory of 1316 184 CREDIT NOTE.exe RegSvcs.exe PID 184 wrote to memory of 1316 184 CREDIT NOTE.exe RegSvcs.exe PID 184 wrote to memory of 1316 184 CREDIT NOTE.exe RegSvcs.exe PID 184 wrote to memory of 1316 184 CREDIT NOTE.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\CREDIT NOTE.exe"C:\Users\Admin\AppData\Local\Temp\CREDIT NOTE.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:184 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\CREDIT NOTE.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1536 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\itqsdfDZLZo.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5092 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\itqsdfDZLZo" /XML "C:\Users\Admin\AppData\Local\Temp\tmp49F.tmp"2⤵
- Creates scheduled task(s)
PID:3044 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵PID:4640
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵PID:2060
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1316
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD53d086a433708053f9bf9523e1d87a4e8
SHA1b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA2566f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
SHA512931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD5c09e26596ca62dc1a16986ee7c89d1ec
SHA1ff66560d678be50d0641103af721796aceef5c84
SHA256123995fb94bfb542ddd4560727e5200425605e31c67517d310e07fe318c6c3db
SHA51252b2023087c30b310a09fd1bbaae2f080211fd83c2e8eb812b30fd6af32bde27ac189225c8a91c49fcbfbe373ea36039a4a967df734dcea1823c47882f161917
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gne4gz3t.4sf.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\tmp49F.tmpFilesize
1KB
MD5a5fc4e5ce22cb09dae043500f0d641bf
SHA157c8a4ac0971dd3c6ea5b85afd1ccaf137e04ce2
SHA256e64d1ae50b4e46849525feba83b5cca1a699ea09b6b7a846004b945826c3ed84
SHA5125d8824f3000975042818247169b504357f4de5a9e783dfa9440f30a33f5cb1fca0a33b05e8079401ea4764adadc4d77f1388cba47b320dcc7e6330cea79d4bd9
-
memory/184-8-0x0000000006140000-0x000000000614E000-memory.dmpFilesize
56KB
-
memory/184-11-0x000000000D110000-0x000000000D1AC000-memory.dmpFilesize
624KB
-
memory/184-6-0x0000000004E10000-0x0000000004E1A000-memory.dmpFilesize
40KB
-
memory/184-7-0x0000000007980000-0x0000000007998000-memory.dmpFilesize
96KB
-
memory/184-4-0x0000000004EC0000-0x0000000005214000-memory.dmpFilesize
3.3MB
-
memory/184-9-0x0000000006150000-0x0000000006164000-memory.dmpFilesize
80KB
-
memory/184-10-0x0000000009FF0000-0x000000000A074000-memory.dmpFilesize
528KB
-
memory/184-5-0x0000000004EB0000-0x0000000004EC0000-memory.dmpFilesize
64KB
-
memory/184-49-0x0000000075060000-0x0000000075810000-memory.dmpFilesize
7.7MB
-
memory/184-1-0x0000000075060000-0x0000000075810000-memory.dmpFilesize
7.7MB
-
memory/184-3-0x0000000004C10000-0x0000000004CA2000-memory.dmpFilesize
584KB
-
memory/184-2-0x0000000005280000-0x0000000005824000-memory.dmpFilesize
5.6MB
-
memory/184-0-0x0000000000160000-0x0000000000234000-memory.dmpFilesize
848KB
-
memory/184-24-0x0000000004EB0000-0x0000000004EC0000-memory.dmpFilesize
64KB
-
memory/184-20-0x0000000075060000-0x0000000075810000-memory.dmpFilesize
7.7MB
-
memory/1316-98-0x0000000004AB0000-0x0000000004AC0000-memory.dmpFilesize
64KB
-
memory/1316-85-0x0000000005970000-0x00000000059C0000-memory.dmpFilesize
320KB
-
memory/1316-25-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/1316-97-0x0000000075060000-0x0000000075810000-memory.dmpFilesize
7.7MB
-
memory/1316-50-0x0000000004AB0000-0x0000000004AC0000-memory.dmpFilesize
64KB
-
memory/1316-39-0x0000000075060000-0x0000000075810000-memory.dmpFilesize
7.7MB
-
memory/1536-18-0x0000000002340000-0x0000000002350000-memory.dmpFilesize
64KB
-
memory/1536-88-0x0000000007290000-0x00000000072AA000-memory.dmpFilesize
104KB
-
memory/1536-38-0x0000000005740000-0x00000000057A6000-memory.dmpFilesize
408KB
-
memory/1536-26-0x0000000004E70000-0x0000000004E92000-memory.dmpFilesize
136KB
-
memory/1536-51-0x0000000005C00000-0x0000000005C1E000-memory.dmpFilesize
120KB
-
memory/1536-52-0x00000000061F0000-0x000000000623C000-memory.dmpFilesize
304KB
-
memory/1536-55-0x00000000758C0000-0x000000007590C000-memory.dmpFilesize
304KB
-
memory/1536-16-0x0000000002300000-0x0000000002336000-memory.dmpFilesize
216KB
-
memory/1536-17-0x0000000075060000-0x0000000075810000-memory.dmpFilesize
7.7MB
-
memory/1536-95-0x0000000075060000-0x0000000075810000-memory.dmpFilesize
7.7MB
-
memory/1536-67-0x00000000061B0000-0x00000000061CE000-memory.dmpFilesize
120KB
-
memory/1536-19-0x0000000004F20000-0x0000000005548000-memory.dmpFilesize
6.2MB
-
memory/1536-79-0x0000000006BF0000-0x0000000006C93000-memory.dmpFilesize
652KB
-
memory/1536-68-0x000000007FA90000-0x000000007FAA0000-memory.dmpFilesize
64KB
-
memory/1536-89-0x0000000007270000-0x0000000007278000-memory.dmpFilesize
32KB
-
memory/1536-81-0x0000000006F50000-0x0000000006F6A000-memory.dmpFilesize
104KB
-
memory/1536-32-0x0000000005560000-0x00000000055C6000-memory.dmpFilesize
408KB
-
memory/1536-83-0x00000000071D0000-0x0000000007266000-memory.dmpFilesize
600KB
-
memory/1536-84-0x0000000007150000-0x0000000007161000-memory.dmpFilesize
68KB
-
memory/1536-87-0x0000000007190000-0x00000000071A4000-memory.dmpFilesize
80KB
-
memory/1536-86-0x0000000007180000-0x000000000718E000-memory.dmpFilesize
56KB
-
memory/5092-22-0x0000000075060000-0x0000000075810000-memory.dmpFilesize
7.7MB
-
memory/5092-82-0x0000000007BE0000-0x0000000007BEA000-memory.dmpFilesize
40KB
-
memory/5092-80-0x00000000081B0000-0x000000000882A000-memory.dmpFilesize
6.5MB
-
memory/5092-23-0x0000000003160000-0x0000000003170000-memory.dmpFilesize
64KB
-
memory/5092-78-0x0000000003160000-0x0000000003170000-memory.dmpFilesize
64KB
-
memory/5092-96-0x0000000075060000-0x0000000075810000-memory.dmpFilesize
7.7MB
-
memory/5092-56-0x000000007FC80000-0x000000007FC90000-memory.dmpFilesize
64KB
-
memory/5092-57-0x00000000758C0000-0x000000007590C000-memory.dmpFilesize
304KB
-
memory/5092-54-0x0000000007A00000-0x0000000007A32000-memory.dmpFilesize
200KB