Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
26-04-2024 06:54
Static task
static1
Behavioral task
behavioral1
Sample
CREDIT NOTES.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
CREDIT NOTES.exe
Resource
win10v2004-20240412-en
General
-
Target
CREDIT NOTES.exe
-
Size
949KB
-
MD5
a94578e1a694ba09dc9ed5dc7df60fcc
-
SHA1
8ea85a39e4e456e79db46abfe00f9be73c8e254e
-
SHA256
b06ef71a820a829fc010a3bc33b6c630282b94d831e25f972b7173f0783b76c9
-
SHA512
ab3277ca5e074100cc9323234ee257816261154bcd6da3b00c56a83b0f0923575649ec9c3272e5ac8da6bd4ae08f6757d7cd15147a15963d144b99be92a30565
-
SSDEEP
24576:8+17qWKvIj9RR5BGNn5BZj6ZNaJ312Zw471:t5AvIj9VB+j6naJl2iK1
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.unitechautomations.com - Port:
587 - Username:
[email protected] - Password:
Unitech@123 - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
CREDIT NOTES.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\Control Panel\International\Geo\Nation CREDIT NOTES.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
RegSvcs.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GUIVTme = "C:\\Users\\Admin\\AppData\\Roaming\\GUIVTme\\GUIVTme.exe" RegSvcs.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
CREDIT NOTES.exedescription pid process target process PID 4304 set thread context of 5016 4304 CREDIT NOTES.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
CREDIT NOTES.exepowershell.exepowershell.exeRegSvcs.exepid process 4304 CREDIT NOTES.exe 4304 CREDIT NOTES.exe 4304 CREDIT NOTES.exe 4368 powershell.exe 4368 powershell.exe 1068 powershell.exe 1068 powershell.exe 4304 CREDIT NOTES.exe 4304 CREDIT NOTES.exe 5016 RegSvcs.exe 5016 RegSvcs.exe 5016 RegSvcs.exe 4368 powershell.exe 1068 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
CREDIT NOTES.exepowershell.exepowershell.exeRegSvcs.exedescription pid process Token: SeDebugPrivilege 4304 CREDIT NOTES.exe Token: SeDebugPrivilege 1068 powershell.exe Token: SeDebugPrivilege 4368 powershell.exe Token: SeDebugPrivilege 5016 RegSvcs.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
CREDIT NOTES.exedescription pid process target process PID 4304 wrote to memory of 1068 4304 CREDIT NOTES.exe powershell.exe PID 4304 wrote to memory of 1068 4304 CREDIT NOTES.exe powershell.exe PID 4304 wrote to memory of 1068 4304 CREDIT NOTES.exe powershell.exe PID 4304 wrote to memory of 4368 4304 CREDIT NOTES.exe powershell.exe PID 4304 wrote to memory of 4368 4304 CREDIT NOTES.exe powershell.exe PID 4304 wrote to memory of 4368 4304 CREDIT NOTES.exe powershell.exe PID 4304 wrote to memory of 1520 4304 CREDIT NOTES.exe schtasks.exe PID 4304 wrote to memory of 1520 4304 CREDIT NOTES.exe schtasks.exe PID 4304 wrote to memory of 1520 4304 CREDIT NOTES.exe schtasks.exe PID 4304 wrote to memory of 5016 4304 CREDIT NOTES.exe RegSvcs.exe PID 4304 wrote to memory of 5016 4304 CREDIT NOTES.exe RegSvcs.exe PID 4304 wrote to memory of 5016 4304 CREDIT NOTES.exe RegSvcs.exe PID 4304 wrote to memory of 5016 4304 CREDIT NOTES.exe RegSvcs.exe PID 4304 wrote to memory of 5016 4304 CREDIT NOTES.exe RegSvcs.exe PID 4304 wrote to memory of 5016 4304 CREDIT NOTES.exe RegSvcs.exe PID 4304 wrote to memory of 5016 4304 CREDIT NOTES.exe RegSvcs.exe PID 4304 wrote to memory of 5016 4304 CREDIT NOTES.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\CREDIT NOTES.exe"C:\Users\Admin\AppData\Local\Temp\CREDIT NOTES.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\CREDIT NOTES.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1068 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\XblPOAvPsrUQv.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4368 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\XblPOAvPsrUQv" /XML "C:\Users\Admin\AppData\Local\Temp\tmp637D.tmp"2⤵
- Creates scheduled task(s)
PID:1520 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5016
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD59701b5b11d376bb8c4c594fd5c86bc81
SHA1608c154bc1d4456e1c451ac966fa8403e12d42fa
SHA256e07c15e77ae17046739312ddb126168be210640c66265870331799339186adc9
SHA5123a186b43397c6540feaddee3aedaea2a99cefbf650cfd4107857809f41ce35e0b5efdae97e26e787531f4cfd5a647663b4e444b5211ab34abeac59008382454d
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2akcn4uy.xpw.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\tmp637D.tmpFilesize
1KB
MD5099f3599730a752116f37b6c21dff40b
SHA15690231749a20b7401fd2f6f10caf45a9ca72d29
SHA2565169a170fa00c6951b1f76237e8269d1bc385f601e9af4ca3d2785607d49acb8
SHA5126f8bfda47f0dd7a9c97416888e40bb98e993695614d1f936460c368fb0f58b0785609aed6aa843dab54cd3e81d52d18315443fe5a9f96cc643965eba164a3f57
-
memory/1068-82-0x0000000007960000-0x000000000796A000-memory.dmpFilesize
40KB
-
memory/1068-35-0x0000000006040000-0x00000000060A6000-memory.dmpFilesize
408KB
-
memory/1068-88-0x0000000007C30000-0x0000000007C4A000-memory.dmpFilesize
104KB
-
memory/1068-52-0x00000000065F0000-0x000000000663C000-memory.dmpFilesize
304KB
-
memory/1068-81-0x00000000078F0000-0x000000000790A000-memory.dmpFilesize
104KB
-
memory/1068-67-0x0000000007530000-0x000000000754E000-memory.dmpFilesize
120KB
-
memory/1068-14-0x0000000005050000-0x0000000005086000-memory.dmpFilesize
216KB
-
memory/1068-15-0x0000000074F50000-0x0000000075700000-memory.dmpFilesize
7.7MB
-
memory/1068-17-0x0000000002C80000-0x0000000002C90000-memory.dmpFilesize
64KB
-
memory/1068-16-0x00000000056C0000-0x0000000005CE8000-memory.dmpFilesize
6.2MB
-
memory/1068-18-0x0000000002C80000-0x0000000002C90000-memory.dmpFilesize
64KB
-
memory/1068-55-0x00000000757B0000-0x00000000757FC000-memory.dmpFilesize
304KB
-
memory/1068-53-0x000000007EFF0000-0x000000007F000000-memory.dmpFilesize
64KB
-
memory/1068-54-0x0000000007550000-0x0000000007582000-memory.dmpFilesize
200KB
-
memory/1068-97-0x0000000074F50000-0x0000000075700000-memory.dmpFilesize
7.7MB
-
memory/4304-0-0x0000000000E30000-0x0000000000F24000-memory.dmpFilesize
976KB
-
memory/4304-6-0x0000000005F50000-0x0000000005F70000-memory.dmpFilesize
128KB
-
memory/4304-4-0x0000000005900000-0x0000000005910000-memory.dmpFilesize
64KB
-
memory/4304-3-0x0000000005910000-0x00000000059A2000-memory.dmpFilesize
584KB
-
memory/4304-1-0x0000000074F50000-0x0000000075700000-memory.dmpFilesize
7.7MB
-
memory/4304-47-0x0000000005900000-0x0000000005910000-memory.dmpFilesize
64KB
-
memory/4304-2-0x0000000005FA0000-0x0000000006544000-memory.dmpFilesize
5.6MB
-
memory/4304-5-0x00000000059D0000-0x00000000059DA000-memory.dmpFilesize
40KB
-
memory/4304-50-0x0000000074F50000-0x0000000075700000-memory.dmpFilesize
7.7MB
-
memory/4304-9-0x000000000C850000-0x000000000C8EC000-memory.dmpFilesize
624KB
-
memory/4304-8-0x0000000005350000-0x00000000053D2000-memory.dmpFilesize
520KB
-
memory/4304-7-0x0000000005F70000-0x0000000005F84000-memory.dmpFilesize
80KB
-
memory/4304-21-0x0000000074F50000-0x0000000075700000-memory.dmpFilesize
7.7MB
-
memory/4368-85-0x0000000006F90000-0x0000000006FA1000-memory.dmpFilesize
68KB
-
memory/4368-89-0x00000000070B0000-0x00000000070B8000-memory.dmpFilesize
32KB
-
memory/4368-20-0x0000000002170000-0x0000000002180000-memory.dmpFilesize
64KB
-
memory/4368-23-0x0000000074F50000-0x0000000075700000-memory.dmpFilesize
7.7MB
-
memory/4368-76-0x0000000002170000-0x0000000002180000-memory.dmpFilesize
64KB
-
memory/4368-78-0x0000000002170000-0x0000000002180000-memory.dmpFilesize
64KB
-
memory/4368-79-0x0000000006A50000-0x0000000006AF3000-memory.dmpFilesize
652KB
-
memory/4368-57-0x000000007F480000-0x000000007F490000-memory.dmpFilesize
64KB
-
memory/4368-80-0x00000000073D0000-0x0000000007A4A000-memory.dmpFilesize
6.5MB
-
memory/4368-51-0x0000000005A40000-0x0000000005A5E000-memory.dmpFilesize
120KB
-
memory/4368-84-0x0000000007010000-0x00000000070A6000-memory.dmpFilesize
600KB
-
memory/4368-96-0x0000000074F50000-0x0000000075700000-memory.dmpFilesize
7.7MB
-
memory/4368-87-0x0000000006FD0000-0x0000000006FE4000-memory.dmpFilesize
80KB
-
memory/4368-86-0x0000000006FC0000-0x0000000006FCE000-memory.dmpFilesize
56KB
-
memory/4368-56-0x00000000757B0000-0x00000000757FC000-memory.dmpFilesize
304KB
-
memory/4368-30-0x0000000004B40000-0x0000000004BA6000-memory.dmpFilesize
408KB
-
memory/4368-19-0x0000000002170000-0x0000000002180000-memory.dmpFilesize
64KB
-
memory/4368-24-0x0000000004AA0000-0x0000000004AC2000-memory.dmpFilesize
136KB
-
memory/4368-46-0x0000000005490000-0x00000000057E4000-memory.dmpFilesize
3.3MB
-
memory/5016-90-0x0000000005EC0000-0x0000000005F10000-memory.dmpFilesize
320KB
-
memory/5016-49-0x0000000074F50000-0x0000000075700000-memory.dmpFilesize
7.7MB
-
memory/5016-99-0x0000000004FB0000-0x0000000004FC0000-memory.dmpFilesize
64KB
-
memory/5016-98-0x0000000074F50000-0x0000000075700000-memory.dmpFilesize
7.7MB
-
memory/5016-45-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB