Analysis
-
max time kernel
119s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
25-04-2024 01:38
Static task
static1
Behavioral task
behavioral1
Sample
Payment swift copy INV 00932024 .exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
Payment swift copy INV 00932024 .exe
Resource
win10v2004-20240226-en
General
-
Target
Payment swift copy INV 00932024 .exe
-
Size
1.1MB
-
MD5
de22c7edfc6679da94c02225fcffa3fd
-
SHA1
77075abafc718772960a9863492f6184c7379f43
-
SHA256
466b0fbe2936dcfd9e09ae337bf2d6f77c636ca58150bdaf54d209a290dbeecf
-
SHA512
b200d4a9e7b6bbf177eba6b4426d9e045f23ca92e5733f0e9db736a8d9973f29cd6db99447936c0a7bb4c0dbc1603c62c1728cf975d8be37075ffa5f5c9ccd76
-
SSDEEP
24576:nAHnh+eWsN3skA4RV1Hom2KXMmHadKYqVYGr055:ah+ZkldoPK8YadKYQYuC
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
bezelety.top - Port:
587 - Username:
[email protected] - Password:
IxF(..bSed6k - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
Payment swift copy INV 00932024 .exedescription pid process target process PID 836 set thread context of 2808 836 Payment swift copy INV 00932024 .exe RegSvcs.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
RegSvcs.exepid process 2808 RegSvcs.exe 2808 RegSvcs.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
Payment swift copy INV 00932024 .exepid process 836 Payment swift copy INV 00932024 .exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RegSvcs.exedescription pid process Token: SeDebugPrivilege 2808 RegSvcs.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Payment swift copy INV 00932024 .exepid process 836 Payment swift copy INV 00932024 .exe 836 Payment swift copy INV 00932024 .exe -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Payment swift copy INV 00932024 .exepid process 836 Payment swift copy INV 00932024 .exe 836 Payment swift copy INV 00932024 .exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
Payment swift copy INV 00932024 .exedescription pid process target process PID 836 wrote to memory of 2808 836 Payment swift copy INV 00932024 .exe RegSvcs.exe PID 836 wrote to memory of 2808 836 Payment swift copy INV 00932024 .exe RegSvcs.exe PID 836 wrote to memory of 2808 836 Payment swift copy INV 00932024 .exe RegSvcs.exe PID 836 wrote to memory of 2808 836 Payment swift copy INV 00932024 .exe RegSvcs.exe PID 836 wrote to memory of 2808 836 Payment swift copy INV 00932024 .exe RegSvcs.exe PID 836 wrote to memory of 2808 836 Payment swift copy INV 00932024 .exe RegSvcs.exe PID 836 wrote to memory of 2808 836 Payment swift copy INV 00932024 .exe RegSvcs.exe PID 836 wrote to memory of 2808 836 Payment swift copy INV 00932024 .exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Payment swift copy INV 00932024 .exe"C:\Users\Admin\AppData\Local\Temp\Payment swift copy INV 00932024 .exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:836 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\Payment swift copy INV 00932024 .exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2808
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/836-10-0x00000000001E0000-0x00000000001E4000-memory.dmpFilesize
16KB
-
memory/2808-11-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/2808-13-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/2808-15-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/2808-16-0x00000000741A0000-0x000000007488E000-memory.dmpFilesize
6.9MB
-
memory/2808-17-0x00000000741A0000-0x000000007488E000-memory.dmpFilesize
6.9MB
-
memory/2808-18-0x00000000008B0000-0x00000000008F0000-memory.dmpFilesize
256KB