Analysis
-
max time kernel
118s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
29-04-2024 09:27
Static task
static1
Behavioral task
behavioral1
Sample
Overdue Account.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Overdue Account.exe
Resource
win10v2004-20240419-en
General
-
Target
Overdue Account.exe
-
Size
672KB
-
MD5
8858954bbf2c3f1525ca1f6d07788ba3
-
SHA1
5b7d021ebb6e64abbdc51a5c0469f6287f1924f1
-
SHA256
57cfb4702d6902a5848f4c9536381f46e1b1b4870f5df749ba4d3f15660e8947
-
SHA512
7e542f25518fa023c844b3924c73ab5e65ff15ddc8731a8af5b34ce30aa53f87fdee78b7c53a8e968240d73c5cadcb76a05a5374dea072c6e259e989dbc7c70d
-
SSDEEP
12288:kRkB778QH82WS8U9AadmiotMCi3uQiXD0gNVT8d0W4Ubk0ILqRKs8i3W6BvxBkR:KkBR82vZ9An9pZQg0qZW00MqRKiG69+
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.plsco.org - Port:
587 - Username:
[email protected] - Password:
fghbnm@PLS# - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
RegSvcs.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\boqXv = "C:\\Users\\Admin\\AppData\\Roaming\\boqXv\\boqXv.exe" RegSvcs.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Overdue Account.exedescription pid process target process PID 2084 set thread context of 1612 2084 Overdue Account.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 11 IoCs
Processes:
Overdue Account.exepowershell.exepowershell.exeRegSvcs.exepid process 2084 Overdue Account.exe 2084 Overdue Account.exe 2084 Overdue Account.exe 2084 Overdue Account.exe 2084 Overdue Account.exe 2084 Overdue Account.exe 2864 powershell.exe 2848 powershell.exe 2084 Overdue Account.exe 1612 RegSvcs.exe 1612 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
Overdue Account.exepowershell.exepowershell.exeRegSvcs.exedescription pid process Token: SeDebugPrivilege 2084 Overdue Account.exe Token: SeDebugPrivilege 2864 powershell.exe Token: SeDebugPrivilege 2848 powershell.exe Token: SeDebugPrivilege 1612 RegSvcs.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
Overdue Account.exedescription pid process target process PID 2084 wrote to memory of 2864 2084 Overdue Account.exe powershell.exe PID 2084 wrote to memory of 2864 2084 Overdue Account.exe powershell.exe PID 2084 wrote to memory of 2864 2084 Overdue Account.exe powershell.exe PID 2084 wrote to memory of 2864 2084 Overdue Account.exe powershell.exe PID 2084 wrote to memory of 2848 2084 Overdue Account.exe powershell.exe PID 2084 wrote to memory of 2848 2084 Overdue Account.exe powershell.exe PID 2084 wrote to memory of 2848 2084 Overdue Account.exe powershell.exe PID 2084 wrote to memory of 2848 2084 Overdue Account.exe powershell.exe PID 2084 wrote to memory of 2568 2084 Overdue Account.exe schtasks.exe PID 2084 wrote to memory of 2568 2084 Overdue Account.exe schtasks.exe PID 2084 wrote to memory of 2568 2084 Overdue Account.exe schtasks.exe PID 2084 wrote to memory of 2568 2084 Overdue Account.exe schtasks.exe PID 2084 wrote to memory of 1612 2084 Overdue Account.exe RegSvcs.exe PID 2084 wrote to memory of 1612 2084 Overdue Account.exe RegSvcs.exe PID 2084 wrote to memory of 1612 2084 Overdue Account.exe RegSvcs.exe PID 2084 wrote to memory of 1612 2084 Overdue Account.exe RegSvcs.exe PID 2084 wrote to memory of 1612 2084 Overdue Account.exe RegSvcs.exe PID 2084 wrote to memory of 1612 2084 Overdue Account.exe RegSvcs.exe PID 2084 wrote to memory of 1612 2084 Overdue Account.exe RegSvcs.exe PID 2084 wrote to memory of 1612 2084 Overdue Account.exe RegSvcs.exe PID 2084 wrote to memory of 1612 2084 Overdue Account.exe RegSvcs.exe PID 2084 wrote to memory of 1612 2084 Overdue Account.exe RegSvcs.exe PID 2084 wrote to memory of 1612 2084 Overdue Account.exe RegSvcs.exe PID 2084 wrote to memory of 1612 2084 Overdue Account.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Overdue Account.exe"C:\Users\Admin\AppData\Local\Temp\Overdue Account.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Overdue Account.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ujCdfdU.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ujCdfdU" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6519.tmp"2⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp6519.tmpFilesize
1KB
MD574da367d2d8890e36b5aa4fa7f04f0f6
SHA1114c4b911a906a3dc5a3fc5abad9840465515ba9
SHA256687d793422d6b5a7dd44cb8f6694f4c88fbb39efe8ae2b369938fc0d82df563a
SHA5123a4bdd89593537285ccd9fbbdc2c8acf1f80d4781e8a1b4ca0a63f83f0dfb4fa73edf58d797dba673a49df1716fe97e48957e1433f85a0eee1f4db262e3ec79a
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\O4JHI2HWGR9NGJCPXIXG.tempFilesize
7KB
MD5da44cf6419b950fc25a8c7eb3ee6de26
SHA1d1b373616c56b08eb0127b80802d52de5fd6004f
SHA256d006acff71a92a0875250e91834c6e99cf9c21e1d128a498c6d3e176f7718aeb
SHA51292afe4db1708efcd5e62ce86b9c420472aa9ec6acb66f195dccd537b9b90eb4ec5ce74bba8cb97a54d01277e0e99013cdc5f023b78c7b404bf52ec2357023008
-
memory/1612-29-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/1612-25-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/1612-28-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/1612-21-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/1612-23-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/1612-31-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/1612-27-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/1612-19-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2084-4-0x0000000000460000-0x000000000046E000-memory.dmpFilesize
56KB
-
memory/2084-6-0x0000000004870000-0x00000000048F2000-memory.dmpFilesize
520KB
-
memory/2084-32-0x0000000074BF0000-0x00000000752DE000-memory.dmpFilesize
6.9MB
-
memory/2084-5-0x00000000005E0000-0x00000000005F6000-memory.dmpFilesize
88KB
-
memory/2084-0-0x0000000000170000-0x000000000021A000-memory.dmpFilesize
680KB
-
memory/2084-3-0x00000000005B0000-0x00000000005C8000-memory.dmpFilesize
96KB
-
memory/2084-2-0x0000000004920000-0x0000000004960000-memory.dmpFilesize
256KB
-
memory/2084-1-0x0000000074BF0000-0x00000000752DE000-memory.dmpFilesize
6.9MB