Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
25-04-2024 16:35
Static task
static1
Behavioral task
behavioral1
Sample
CREDIT NOTE.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
CREDIT NOTE.exe
Resource
win10v2004-20240412-en
General
-
Target
CREDIT NOTE.exe
-
Size
827KB
-
MD5
44b581457172335dd3903c5bf659a035
-
SHA1
9415e8affeae395c04046a9189414b4787291f14
-
SHA256
8b3133696ef1e7609974f8084f6ca977ab74db7c688fa7b8df83b2e9231f1764
-
SHA512
e76c5f05cc83f43f6adfe490df29e6514c1f5b8428ac878a92300b36053fcef1bd987969ddcc8c3ea7c25ffa58cf287456b462f1cbba39f5e3392cc65403035a
-
SSDEEP
12288:T9CF9WMGkyCehy9LdriuW3hny6SNZX2/paka16cMRTjfxwNGNUt842vB8x8xqirq:ZC2MreQLMrF/pa1yRTbNey42vudgZM
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.unitechautomations.com - Port:
587 - Username:
[email protected] - Password:
Unitech@123 - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
CREDIT NOTE.exedescription pid process target process PID 1880 set thread context of 2780 1880 CREDIT NOTE.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
CREDIT NOTE.exepowershell.exepowershell.exepid process 1880 CREDIT NOTE.exe 1880 CREDIT NOTE.exe 1880 CREDIT NOTE.exe 2600 powershell.exe 2244 powershell.exe 1880 CREDIT NOTE.exe 1880 CREDIT NOTE.exe 1880 CREDIT NOTE.exe 1880 CREDIT NOTE.exe 1880 CREDIT NOTE.exe 1880 CREDIT NOTE.exe 1880 CREDIT NOTE.exe 1880 CREDIT NOTE.exe 1880 CREDIT NOTE.exe 1880 CREDIT NOTE.exe 1880 CREDIT NOTE.exe 1880 CREDIT NOTE.exe 1880 CREDIT NOTE.exe 1880 CREDIT NOTE.exe 1880 CREDIT NOTE.exe 1880 CREDIT NOTE.exe 1880 CREDIT NOTE.exe 1880 CREDIT NOTE.exe 1880 CREDIT NOTE.exe 1880 CREDIT NOTE.exe 1880 CREDIT NOTE.exe 1880 CREDIT NOTE.exe 1880 CREDIT NOTE.exe 1880 CREDIT NOTE.exe 1880 CREDIT NOTE.exe 1880 CREDIT NOTE.exe 1880 CREDIT NOTE.exe 1880 CREDIT NOTE.exe 1880 CREDIT NOTE.exe 1880 CREDIT NOTE.exe 1880 CREDIT NOTE.exe 1880 CREDIT NOTE.exe 1880 CREDIT NOTE.exe 1880 CREDIT NOTE.exe 1880 CREDIT NOTE.exe 1880 CREDIT NOTE.exe 1880 CREDIT NOTE.exe 1880 CREDIT NOTE.exe 1880 CREDIT NOTE.exe 1880 CREDIT NOTE.exe 1880 CREDIT NOTE.exe 1880 CREDIT NOTE.exe 1880 CREDIT NOTE.exe 1880 CREDIT NOTE.exe 1880 CREDIT NOTE.exe 1880 CREDIT NOTE.exe 1880 CREDIT NOTE.exe 1880 CREDIT NOTE.exe 1880 CREDIT NOTE.exe 1880 CREDIT NOTE.exe 1880 CREDIT NOTE.exe 1880 CREDIT NOTE.exe 1880 CREDIT NOTE.exe 1880 CREDIT NOTE.exe 1880 CREDIT NOTE.exe 1880 CREDIT NOTE.exe 1880 CREDIT NOTE.exe 1880 CREDIT NOTE.exe 1880 CREDIT NOTE.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
CREDIT NOTE.exepowershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 1880 CREDIT NOTE.exe Token: SeDebugPrivilege 2600 powershell.exe Token: SeDebugPrivilege 2244 powershell.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
CREDIT NOTE.exedescription pid process target process PID 1880 wrote to memory of 2244 1880 CREDIT NOTE.exe powershell.exe PID 1880 wrote to memory of 2244 1880 CREDIT NOTE.exe powershell.exe PID 1880 wrote to memory of 2244 1880 CREDIT NOTE.exe powershell.exe PID 1880 wrote to memory of 2244 1880 CREDIT NOTE.exe powershell.exe PID 1880 wrote to memory of 2600 1880 CREDIT NOTE.exe powershell.exe PID 1880 wrote to memory of 2600 1880 CREDIT NOTE.exe powershell.exe PID 1880 wrote to memory of 2600 1880 CREDIT NOTE.exe powershell.exe PID 1880 wrote to memory of 2600 1880 CREDIT NOTE.exe powershell.exe PID 1880 wrote to memory of 2712 1880 CREDIT NOTE.exe schtasks.exe PID 1880 wrote to memory of 2712 1880 CREDIT NOTE.exe schtasks.exe PID 1880 wrote to memory of 2712 1880 CREDIT NOTE.exe schtasks.exe PID 1880 wrote to memory of 2712 1880 CREDIT NOTE.exe schtasks.exe PID 1880 wrote to memory of 2780 1880 CREDIT NOTE.exe RegSvcs.exe PID 1880 wrote to memory of 2780 1880 CREDIT NOTE.exe RegSvcs.exe PID 1880 wrote to memory of 2780 1880 CREDIT NOTE.exe RegSvcs.exe PID 1880 wrote to memory of 2780 1880 CREDIT NOTE.exe RegSvcs.exe PID 1880 wrote to memory of 2780 1880 CREDIT NOTE.exe RegSvcs.exe PID 1880 wrote to memory of 2780 1880 CREDIT NOTE.exe RegSvcs.exe PID 1880 wrote to memory of 2780 1880 CREDIT NOTE.exe RegSvcs.exe PID 1880 wrote to memory of 2780 1880 CREDIT NOTE.exe RegSvcs.exe PID 1880 wrote to memory of 2780 1880 CREDIT NOTE.exe RegSvcs.exe PID 1880 wrote to memory of 2780 1880 CREDIT NOTE.exe RegSvcs.exe PID 1880 wrote to memory of 2780 1880 CREDIT NOTE.exe RegSvcs.exe PID 1880 wrote to memory of 2780 1880 CREDIT NOTE.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\CREDIT NOTE.exe"C:\Users\Admin\AppData\Local\Temp\CREDIT NOTE.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\CREDIT NOTE.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2244 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\itqsdfDZLZo.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2600 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\itqsdfDZLZo" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4F48.tmp"2⤵
- Creates scheduled task(s)
PID:2712 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵PID:2780
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp4F48.tmpFilesize
1KB
MD59f2b5910f77c72babeccaf6003c6b9dd
SHA154415dc449fd6ec2ab7fd022eada95c6dc6e746a
SHA256fde7a1bc093022b2d5e0b5c69aa350dcafbeeb57395079b8eb1db62bedab8ebe
SHA512de8d61a3bfc4e5ac2a39fdd8aa02c8354fbb493429648aeccd849505c67942b5fe61ae95cf5b591dc5473867c65493716ffcb3494ff3346f336383f792436f72
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msFilesize
7KB
MD58336550bfff7f05fc4e72629cb55fa62
SHA18d2f734450f8ca06b250cdd2d5d67d945a344a9d
SHA256f87060d9f872b311999b9c46af13f48fc9770fb42b3ce796d3335a5561a66b44
SHA512f5415e4176e6455155e716e281e7e920f9b6505b61147fe39513c5b0ca8f59cf5b220c09681b95d984fd2cbbdd24901ce18743e87941aed526f69688df9f3b60
-
memory/1880-4-0x0000000000620000-0x000000000062E000-memory.dmpFilesize
56KB
-
memory/1880-1-0x00000000742C0000-0x00000000749AE000-memory.dmpFilesize
6.9MB
-
memory/1880-3-0x0000000000600000-0x0000000000618000-memory.dmpFilesize
96KB
-
memory/1880-5-0x0000000000630000-0x0000000000644000-memory.dmpFilesize
80KB
-
memory/1880-6-0x00000000049E0000-0x0000000004A64000-memory.dmpFilesize
528KB
-
memory/1880-2-0x0000000000660000-0x00000000006A0000-memory.dmpFilesize
256KB
-
memory/1880-0-0x0000000001330000-0x0000000001404000-memory.dmpFilesize
848KB
-
memory/1880-38-0x00000000742C0000-0x00000000749AE000-memory.dmpFilesize
6.9MB
-
memory/1880-39-0x0000000000660000-0x00000000006A0000-memory.dmpFilesize
256KB
-
memory/2244-20-0x000000006E2F0000-0x000000006E89B000-memory.dmpFilesize
5.7MB
-
memory/2244-31-0x0000000002C60000-0x0000000002CA0000-memory.dmpFilesize
256KB
-
memory/2244-28-0x000000006E2F0000-0x000000006E89B000-memory.dmpFilesize
5.7MB
-
memory/2244-36-0x000000006E2F0000-0x000000006E89B000-memory.dmpFilesize
5.7MB
-
memory/2244-33-0x0000000002C60000-0x0000000002CA0000-memory.dmpFilesize
256KB
-
memory/2600-26-0x000000006E2F0000-0x000000006E89B000-memory.dmpFilesize
5.7MB
-
memory/2600-30-0x0000000000220000-0x0000000000260000-memory.dmpFilesize
256KB
-
memory/2600-37-0x000000006E2F0000-0x000000006E89B000-memory.dmpFilesize
5.7MB
-
memory/2600-24-0x0000000000220000-0x0000000000260000-memory.dmpFilesize
256KB
-
memory/2600-22-0x000000006E2F0000-0x000000006E89B000-memory.dmpFilesize
5.7MB
-
memory/2780-35-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2780-27-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2780-25-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2780-23-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2780-19-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2780-32-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB