General
-
Target
Invoice.exe
-
Size
822KB
-
Sample
240426-lns54adf8y
-
MD5
df0a67f2a0c162c5a5dee0a8fcd8ab22
-
SHA1
07981693f5b38fa99a88aca0e13ba5b6022b1465
-
SHA256
e62255f98543e0bb1abf017af13fd483e1382158021b7edde65fa55c1ad290cf
-
SHA512
b62ea9a4710dfc855cfd47f2c0cb8787c9ea6b1159387431d1cc70b5989dd59086aaadd62e42fea9b21d28834b6ece20dc1715245762d026e48e315544529f75
-
SSDEEP
12288:zPqnHvjNIrpf9rN/mc/CQw5PXdFPemY3kI26WE+34DO2IOxzV2SYm9nEix9H82rF:zyPjKr5BNDuXvfY0RfmIkzLNP5rJ
Static task
static1
Behavioral task
behavioral1
Sample
Invoice.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Invoice.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.starmech.net - Port:
587 - Username:
electronics@starmech.net - Password:
nics123 - Email To:
godwingodwin397@gmail.com
Extracted
Protocol: smtp- Host:
mail.starmech.net - Port:
587 - Username:
electronics@starmech.net - Password:
nics123
Targets
-
-
Target
Invoice.exe
-
Size
822KB
-
MD5
df0a67f2a0c162c5a5dee0a8fcd8ab22
-
SHA1
07981693f5b38fa99a88aca0e13ba5b6022b1465
-
SHA256
e62255f98543e0bb1abf017af13fd483e1382158021b7edde65fa55c1ad290cf
-
SHA512
b62ea9a4710dfc855cfd47f2c0cb8787c9ea6b1159387431d1cc70b5989dd59086aaadd62e42fea9b21d28834b6ece20dc1715245762d026e48e315544529f75
-
SSDEEP
12288:zPqnHvjNIrpf9rN/mc/CQw5PXdFPemY3kI26WE+34DO2IOxzV2SYm9nEix9H82rF:zyPjKr5BNDuXvfY0RfmIkzLNP5rJ
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1