Analysis
-
max time kernel
140s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
17/05/2024, 17:45
Static task
static1
Behavioral task
behavioral1
Sample
PAYMENT.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
PAYMENT.exe
Resource
win10v2004-20240508-en
General
-
Target
PAYMENT.exe
-
Size
678KB
-
MD5
ef6b7128c7786f40111e700d38f10b8f
-
SHA1
14738e7b2c7cc9a6a2ec3c7a850807623225df32
-
SHA256
24d8632d58bfa7019f691346f9715cef64dc11887fc5140054ecf5b422f1f68d
-
SHA512
7a0eaacfd36959ae68d60936be911b4cd6e81e5575150e2399cfac60df3cb817168f676f5efd09b74af5be296ccd9decf0af94e5b026b44f1c0e078566dd061a
-
SSDEEP
12288:S9+UFSbzwd6xyFjH8H1NDNCqovrO4OsOjk8pXcivm:k+pbzwIxk4VdoqmOztG
Malware Config
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload 8 IoCs
resource yara_rule behavioral1/memory/2140-12-0x0000000000400000-0x0000000000484000-memory.dmp family_agenttesla behavioral1/memory/2140-23-0x0000000000400000-0x0000000000484000-memory.dmp family_agenttesla behavioral1/memory/2140-25-0x0000000000400000-0x0000000000484000-memory.dmp family_agenttesla behavioral1/memory/2140-24-0x0000000000400000-0x0000000000484000-memory.dmp family_agenttesla behavioral1/memory/2140-11-0x00000000002A0000-0x00000000002DC000-memory.dmp family_agenttesla behavioral1/memory/2140-10-0x00000000002A0000-0x00000000002DC000-memory.dmp family_agenttesla behavioral1/memory/2140-9-0x0000000000400000-0x0000000000484000-memory.dmp family_agenttesla behavioral1/memory/2140-8-0x0000000000400000-0x0000000000484000-memory.dmp family_agenttesla -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral1/memory/2140-12-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral1/memory/2140-9-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral1/memory/2140-6-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral1/memory/2140-8-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral1/memory/2140-3-0x0000000000400000-0x0000000000484000-memory.dmp upx -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 PAYMENT.exe Key opened \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 PAYMENT.exe Key opened \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 PAYMENT.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 api.ipify.org 5 api.ipify.org 6 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2420 set thread context of 2140 2420 PAYMENT.exe 28 -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2420 PAYMENT.exe 2140 PAYMENT.exe 2140 PAYMENT.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2420 PAYMENT.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2140 PAYMENT.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2420 wrote to memory of 2140 2420 PAYMENT.exe 28 PID 2420 wrote to memory of 2140 2420 PAYMENT.exe 28 PID 2420 wrote to memory of 2140 2420 PAYMENT.exe 28 PID 2420 wrote to memory of 2140 2420 PAYMENT.exe 28 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 PAYMENT.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 PAYMENT.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PAYMENT.exe"C:\Users\Admin\AppData\Local\Temp\PAYMENT.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\PAYMENT.exe"C:\Users\Admin\AppData\Local\Temp\PAYMENT.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:2140
-