Analysis
-
max time kernel
141s -
max time network
105s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
17/05/2024, 17:45
Static task
static1
Behavioral task
behavioral1
Sample
PAYMENT.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
PAYMENT.exe
Resource
win10v2004-20240508-en
General
-
Target
PAYMENT.exe
-
Size
678KB
-
MD5
ef6b7128c7786f40111e700d38f10b8f
-
SHA1
14738e7b2c7cc9a6a2ec3c7a850807623225df32
-
SHA256
24d8632d58bfa7019f691346f9715cef64dc11887fc5140054ecf5b422f1f68d
-
SHA512
7a0eaacfd36959ae68d60936be911b4cd6e81e5575150e2399cfac60df3cb817168f676f5efd09b74af5be296ccd9decf0af94e5b026b44f1c0e078566dd061a
-
SSDEEP
12288:S9+UFSbzwd6xyFjH8H1NDNCqovrO4OsOjk8pXcivm:k+pbzwIxk4VdoqmOztG
Malware Config
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload 6 IoCs
resource yara_rule behavioral2/memory/888-6-0x0000000000400000-0x0000000000484000-memory.dmp family_agenttesla behavioral2/memory/888-12-0x0000000000400000-0x0000000000484000-memory.dmp family_agenttesla behavioral2/memory/888-11-0x0000000000400000-0x0000000000484000-memory.dmp family_agenttesla behavioral2/memory/888-10-0x0000000000820000-0x000000000085C000-memory.dmp family_agenttesla behavioral2/memory/888-24-0x0000000000400000-0x0000000000484000-memory.dmp family_agenttesla behavioral2/memory/888-9-0x0000000000820000-0x000000000085C000-memory.dmp family_agenttesla -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral2/memory/888-3-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/888-6-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/888-5-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/888-12-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/888-11-0x0000000000400000-0x0000000000484000-memory.dmp upx -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 PAYMENT.exe Key opened \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 PAYMENT.exe Key opened \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 PAYMENT.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 17 api.ipify.org 18 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4952 set thread context of 888 4952 PAYMENT.exe 82 -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4952 PAYMENT.exe 4952 PAYMENT.exe 888 PAYMENT.exe 888 PAYMENT.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 4952 PAYMENT.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 888 PAYMENT.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4952 wrote to memory of 888 4952 PAYMENT.exe 82 PID 4952 wrote to memory of 888 4952 PAYMENT.exe 82 PID 4952 wrote to memory of 888 4952 PAYMENT.exe 82 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 PAYMENT.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 PAYMENT.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PAYMENT.exe"C:\Users\Admin\AppData\Local\Temp\PAYMENT.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\PAYMENT.exe"C:\Users\Admin\AppData\Local\Temp\PAYMENT.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:888
-