Overview

overview

10

Static

static

1

Remittance...24.exe

windows7-x64

10

Remittance...24.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    139s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-04-2024 08:06

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Remittance_Advice 26042024.exe

  • Size

    837KB

  • MD5

    f78fac7fbb75ddcc67dd7cb5b6b6ea97

  • SHA1

    a9b9c8f3121cb128882d3e59b7ba2b045ce0792f

  • SHA256

    cd3e530bfaf604d4e59e78d8d8761ab63f0d3d57beff38c1f4802993226af6bb

  • SHA512

    ec39ce438175b8e431f28ec559f707fd631c66f7e9c4160e28639e12930be14163439b2f03b834433cf1cebcad0e87fa93028ce70148103bff09ee664970341c

  • SSDEEP

    12288:9bqnHvjNIrpf9rN/mc/CbTrMSrJjxddkDEb8LjkyUtGWpGwvNqKdzPjzow4bkR:9uPjKr5BNDKvBn0kySRpGwoKFzow7

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    mail.innomedjsc.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    s]~5ai)IFpr-

Extracted

Family

agenttesla

Credentials

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

    spywarestealer
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Remittance_Advice 26042024.exe
    "C:\Users\Admin\AppData\Local\Temp\Remittance_Advice 26042024.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3132
    • C:\Users\Admin\AppData\Local\Temp\Remittance_Advice 26042024.exe
      "C:\Users\Admin\AppData\Local\Temp\Remittance_Advice 26042024.exe"
      2⤵
        PID:2772
      • C:\Users\Admin\AppData\Local\Temp\Remittance_Advice 26042024.exe
        "C:\Users\Admin\AppData\Local\Temp\Remittance_Advice 26042024.exe"
        2⤵
          PID:3892
        • C:\Users\Admin\AppData\Local\Temp\Remittance_Advice 26042024.exe
          "C:\Users\Admin\AppData\Local\Temp\Remittance_Advice 26042024.exe"
          2⤵
            PID:2912
          • C:\Users\Admin\AppData\Local\Temp\Remittance_Advice 26042024.exe
            "C:\Users\Admin\AppData\Local\Temp\Remittance_Advice 26042024.exe"
            2⤵
              PID:3720
            • C:\Users\Admin\AppData\Local\Temp\Remittance_Advice 26042024.exe
              "C:\Users\Admin\AppData\Local\Temp\Remittance_Advice 26042024.exe"
              2⤵
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of SetWindowsHookEx
              PID:4480

          Network

          MITRE ATT&CK Matrix ATT&CK v13

          Initial Access

          Execution

          Persistence

          Privilege Escalation

          Defense Evasion

          Credential Access

          Unsecured Credentials

          4
          T1552

          Credentials In Files

          3
          T1552.001

          Credentials in Registry

          1
          T1552.002

          Discovery

          Lateral Movement

          Collection

          Data from Local System

          4
          T1005

          Exfiltration

          Command and Control

          Impact

          Resource Development

          Reconnaissance

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Remittance_Advice 26042024.exe.log
            Filesize

            1KB

            MD5

            8ec831f3e3a3f77e4a7b9cd32b48384c

            SHA1

            d83f09fd87c5bd86e045873c231c14836e76a05c

            SHA256

            7667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982

            SHA512

            26bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3

            Download Submit
          • memory/3132-8-0x0000000009810000-0x0000000009894000-memory.dmp
            Filesize

            528KB

            Download
          • memory/3132-5-0x0000000005B10000-0x0000000005B1A000-memory.dmp
            Filesize

            40KB

            Download
          • memory/3132-9-0x000000000C930000-0x000000000C9CC000-memory.dmp
            Filesize

            624KB

            Download
          • memory/3132-4-0x00000000058F0000-0x0000000005900000-memory.dmp
            Filesize

            64KB

            Download
          • memory/3132-1-0x0000000074560000-0x0000000074D10000-memory.dmp
            Filesize

            7.7MB

            Download
          • memory/3132-6-0x0000000005D10000-0x0000000005D30000-memory.dmp
            Filesize

            128KB

            Download
          • memory/3132-7-0x0000000005E00000-0x0000000005E14000-memory.dmp
            Filesize

            80KB

            Download
          • memory/3132-14-0x0000000074560000-0x0000000074D10000-memory.dmp
            Filesize

            7.7MB

            Download
          • memory/3132-3-0x0000000005950000-0x00000000059E2000-memory.dmp
            Filesize

            584KB

            Download
          • memory/3132-2-0x0000000005E20000-0x00000000063C4000-memory.dmp
            Filesize

            5.6MB

            Download
          • memory/3132-0-0x0000000000EA0000-0x0000000000F74000-memory.dmp
            Filesize

            848KB

            Download
          • memory/4480-15-0x0000000005770000-0x00000000057D6000-memory.dmp
            Filesize

            408KB

            Download
          • memory/4480-16-0x0000000005850000-0x0000000005860000-memory.dmp
            Filesize

            64KB

            Download
          • memory/4480-10-0x0000000000400000-0x0000000000442000-memory.dmp
            Filesize

            264KB

            Download
          • memory/4480-13-0x0000000074560000-0x0000000074D10000-memory.dmp
            Filesize

            7.7MB

            Download
          • memory/4480-17-0x0000000006680000-0x00000000066D0000-memory.dmp
            Filesize

            320KB

            Download
          • memory/4480-18-0x0000000074560000-0x0000000074D10000-memory.dmp
            Filesize

            7.7MB

            Download