Analysis
-
max time kernel
67s -
max time network
49s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
29-04-2024 14:05
Static task
static1
Behavioral task
behavioral1
Sample
TNT Original Invoice.scr
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
TNT Original Invoice.scr
Resource
win10v2004-20240419-en
General
-
Target
TNT Original Invoice.scr
-
Size
697KB
-
MD5
4aa63ea35a6a68252888080722f2b403
-
SHA1
63ecde53df066919f84d35926dbea4efc1610b00
-
SHA256
8f26ff4683a2d8c5dda6b8aff8c4d6b95ffe97c2432b413e0f8f0a0c16c96d32
-
SHA512
a36aa7db91c5a98964b9285e85d07b255b4449dfd361ef09d8c4a8239c80adf895756c048f9ddc5ef9e35481a490005ace3aa36d1f93a0d59e80edae50ee8aa3
-
SSDEEP
12288:2+DbgRB778QekIKVkQv77DBpPMJ3aofMw98A/wR0Q+bnEimiQZWOWiP6ZtZbUqu9:vgRB1HbGHfMv0wR0vEJN6vpR+
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot5239412158:AAHXn8rC3uvBHy_kv77GtIcxcuvBuXcKD_8/
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
TNT Original Invoice.scrdescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation TNT Original Invoice.scr -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
TNT Original Invoice.scrdescription pid process target process PID 4356 set thread context of 2140 4356 TNT Original Invoice.scr TNT Original Invoice.scr -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 15 IoCs
Processes:
TNT Original Invoice.scrpowershell.exepowershell.exeTNT Original Invoice.scrpid process 4356 TNT Original Invoice.scr 4356 TNT Original Invoice.scr 4356 TNT Original Invoice.scr 4356 TNT Original Invoice.scr 4356 TNT Original Invoice.scr 4356 TNT Original Invoice.scr 3356 powershell.exe 1876 powershell.exe 4356 TNT Original Invoice.scr 4356 TNT Original Invoice.scr 4356 TNT Original Invoice.scr 3356 powershell.exe 2140 TNT Original Invoice.scr 2140 TNT Original Invoice.scr 1876 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
TNT Original Invoice.scrpowershell.exepowershell.exeTNT Original Invoice.scrdescription pid process Token: SeDebugPrivilege 4356 TNT Original Invoice.scr Token: SeDebugPrivilege 3356 powershell.exe Token: SeDebugPrivilege 1876 powershell.exe Token: SeDebugPrivilege 2140 TNT Original Invoice.scr -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
TNT Original Invoice.scrpid process 2140 TNT Original Invoice.scr -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
TNT Original Invoice.scrdescription pid process target process PID 4356 wrote to memory of 3356 4356 TNT Original Invoice.scr powershell.exe PID 4356 wrote to memory of 3356 4356 TNT Original Invoice.scr powershell.exe PID 4356 wrote to memory of 3356 4356 TNT Original Invoice.scr powershell.exe PID 4356 wrote to memory of 1876 4356 TNT Original Invoice.scr powershell.exe PID 4356 wrote to memory of 1876 4356 TNT Original Invoice.scr powershell.exe PID 4356 wrote to memory of 1876 4356 TNT Original Invoice.scr powershell.exe PID 4356 wrote to memory of 2372 4356 TNT Original Invoice.scr schtasks.exe PID 4356 wrote to memory of 2372 4356 TNT Original Invoice.scr schtasks.exe PID 4356 wrote to memory of 2372 4356 TNT Original Invoice.scr schtasks.exe PID 4356 wrote to memory of 3580 4356 TNT Original Invoice.scr TNT Original Invoice.scr PID 4356 wrote to memory of 3580 4356 TNT Original Invoice.scr TNT Original Invoice.scr PID 4356 wrote to memory of 3580 4356 TNT Original Invoice.scr TNT Original Invoice.scr PID 4356 wrote to memory of 2140 4356 TNT Original Invoice.scr TNT Original Invoice.scr PID 4356 wrote to memory of 2140 4356 TNT Original Invoice.scr TNT Original Invoice.scr PID 4356 wrote to memory of 2140 4356 TNT Original Invoice.scr TNT Original Invoice.scr PID 4356 wrote to memory of 2140 4356 TNT Original Invoice.scr TNT Original Invoice.scr PID 4356 wrote to memory of 2140 4356 TNT Original Invoice.scr TNT Original Invoice.scr PID 4356 wrote to memory of 2140 4356 TNT Original Invoice.scr TNT Original Invoice.scr PID 4356 wrote to memory of 2140 4356 TNT Original Invoice.scr TNT Original Invoice.scr PID 4356 wrote to memory of 2140 4356 TNT Original Invoice.scr TNT Original Invoice.scr
Processes
-
C:\Users\Admin\AppData\Local\Temp\TNT Original Invoice.scr"C:\Users\Admin\AppData\Local\Temp\TNT Original Invoice.scr" /S1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\TNT Original Invoice.scr"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\QKidaN.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\QKidaN" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9942.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\TNT Original Invoice.scr"C:\Users\Admin\AppData\Local\Temp\TNT Original Invoice.scr"2⤵
-
C:\Users\Admin\AppData\Local\Temp\TNT Original Invoice.scr"C:\Users\Admin\AppData\Local\Temp\TNT Original Invoice.scr"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bdudyxe2.dhg.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\tmp9942.tmpFilesize
1KB
MD54e927273e3895847c2425befcaa2f29a
SHA108cecc6d060153a8432af203217cb5b66b3c3b18
SHA25617b3063f23b360a31816029b537b5b7a8349fcc48a9ec2eb649214f820bfe205
SHA51218f7573b27f6e7e8ec30368892be22ce008c12ef40cf87320cf0aded47a58a194359b8c1602783670792acc9fa2ee935dee72694573808e793beef0d7f9ae883
-
memory/1876-75-0x0000000006BF0000-0x0000000006C93000-memory.dmpFilesize
652KB
-
memory/1876-64-0x0000000006B80000-0x0000000006B9E000-memory.dmpFilesize
120KB
-
memory/1876-83-0x0000000007060000-0x000000000707A000-memory.dmpFilesize
104KB
-
memory/1876-80-0x0000000006F20000-0x0000000006F31000-memory.dmpFilesize
68KB
-
memory/1876-78-0x0000000006D90000-0x0000000006D9A000-memory.dmpFilesize
40KB
-
memory/1876-77-0x0000000006D20000-0x0000000006D3A000-memory.dmpFilesize
104KB
-
memory/1876-23-0x00000000746A0000-0x0000000074E50000-memory.dmpFilesize
7.7MB
-
memory/1876-84-0x0000000007040000-0x0000000007048000-memory.dmpFilesize
32KB
-
memory/1876-53-0x0000000006BA0000-0x0000000006BD2000-memory.dmpFilesize
200KB
-
memory/1876-54-0x000000006FBD0000-0x000000006FC1C000-memory.dmpFilesize
304KB
-
memory/1876-24-0x0000000004690000-0x00000000046A0000-memory.dmpFilesize
64KB
-
memory/1876-20-0x0000000004690000-0x00000000046A0000-memory.dmpFilesize
64KB
-
memory/1876-88-0x00000000746A0000-0x0000000074E50000-memory.dmpFilesize
7.7MB
-
memory/2140-89-0x0000000006310000-0x0000000006360000-memory.dmpFilesize
320KB
-
memory/2140-48-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/3356-76-0x00000000078B0000-0x0000000007F2A000-memory.dmpFilesize
6.5MB
-
memory/3356-79-0x00000000074E0000-0x0000000007576000-memory.dmpFilesize
600KB
-
memory/3356-18-0x00000000746A0000-0x0000000074E50000-memory.dmpFilesize
7.7MB
-
memory/3356-21-0x0000000002680000-0x0000000002690000-memory.dmpFilesize
64KB
-
memory/3356-26-0x0000000004F80000-0x0000000004FA2000-memory.dmpFilesize
136KB
-
memory/3356-28-0x0000000005800000-0x0000000005866000-memory.dmpFilesize
408KB
-
memory/3356-87-0x00000000746A0000-0x0000000074E50000-memory.dmpFilesize
7.7MB
-
memory/3356-27-0x0000000005020000-0x0000000005086000-memory.dmpFilesize
408KB
-
memory/3356-38-0x0000000005A70000-0x0000000005DC4000-memory.dmpFilesize
3.3MB
-
memory/3356-16-0x0000000005120000-0x0000000005748000-memory.dmpFilesize
6.2MB
-
memory/3356-82-0x00000000074A0000-0x00000000074B4000-memory.dmpFilesize
80KB
-
memory/3356-50-0x0000000005F30000-0x0000000005F4E000-memory.dmpFilesize
120KB
-
memory/3356-81-0x0000000007490000-0x000000000749E000-memory.dmpFilesize
56KB
-
memory/3356-52-0x00000000064A0000-0x00000000064EC000-memory.dmpFilesize
304KB
-
memory/3356-15-0x0000000002610000-0x0000000002646000-memory.dmpFilesize
216KB
-
memory/3356-19-0x0000000002680000-0x0000000002690000-memory.dmpFilesize
64KB
-
memory/3356-65-0x000000006FBD0000-0x000000006FC1C000-memory.dmpFilesize
304KB
-
memory/4356-5-0x0000000004DE0000-0x0000000004DEA000-memory.dmpFilesize
40KB
-
memory/4356-9-0x0000000006160000-0x00000000061E4000-memory.dmpFilesize
528KB
-
memory/4356-0-0x0000000000370000-0x0000000000424000-memory.dmpFilesize
720KB
-
memory/4356-7-0x0000000005220000-0x000000000522E000-memory.dmpFilesize
56KB
-
memory/4356-6-0x00000000051F0000-0x0000000005208000-memory.dmpFilesize
96KB
-
memory/4356-10-0x0000000008880000-0x000000000891C000-memory.dmpFilesize
624KB
-
memory/4356-8-0x0000000005230000-0x0000000005246000-memory.dmpFilesize
88KB
-
memory/4356-51-0x00000000746A0000-0x0000000074E50000-memory.dmpFilesize
7.7MB
-
memory/4356-3-0x0000000004EA0000-0x0000000004F32000-memory.dmpFilesize
584KB
-
memory/4356-4-0x00000000050D0000-0x00000000050E0000-memory.dmpFilesize
64KB
-
memory/4356-17-0x00000000746A0000-0x0000000074E50000-memory.dmpFilesize
7.7MB
-
memory/4356-22-0x00000000050D0000-0x00000000050E0000-memory.dmpFilesize
64KB
-
memory/4356-2-0x00000000053B0000-0x0000000005954000-memory.dmpFilesize
5.6MB
-
memory/4356-1-0x00000000746A0000-0x0000000074E50000-memory.dmpFilesize
7.7MB