Analysis

  • max time kernel
    118s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    21/05/2024, 03:45

General

  • Target

    Invoice KIK-1 P234478.exe

  • Size

    1.4MB

  • MD5

    30664b17b297bc3db34968f239360c6f

  • SHA1

    a4185b8ff9e045033d06701e200be57920753754

  • SHA256

    087f3c379a1f08fc51ba599872013c25ee442d1bfeb87ce93503239ea2a388fd

  • SHA512

    e178dd795f63ddf55ea4abbb9e9b44d493138a1be5b3b3c2928edfd59b8675e0192f223f986230854e1c8855d06041363f6f389d7d20390686e73be16acba0e1

  • SSDEEP

    24576:lsO7OVJ0W//bLLK6tsPdEZ+gqBnf5B1M8We20/ccvLpxBVtra:zixL7Z+gK28/lng

Malware Config

Extracted

Family

agenttesla

Credentials

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Invoice KIK-1 P234478.exe
    "C:\Users\Admin\AppData\Local\Temp\Invoice KIK-1 P234478.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1772
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1988
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 1772 -s 628
      2⤵
        PID:2240

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/1772-0-0x000007FEF6173000-0x000007FEF6174000-memory.dmp

            Filesize

            4KB

          • memory/1772-1-0x0000000000240000-0x000000000024E000-memory.dmp

            Filesize

            56KB

          • memory/1772-2-0x000007FEF6170000-0x000007FEF6B5C000-memory.dmp

            Filesize

            9.9MB

          • memory/1772-3-0x000007FEF6170000-0x000007FEF6B5C000-memory.dmp

            Filesize

            9.9MB

          • memory/1772-4-0x000007FEF6170000-0x000007FEF6B5C000-memory.dmp

            Filesize

            9.9MB

          • memory/1772-5-0x000007FEF6170000-0x000007FEF6B5C000-memory.dmp

            Filesize

            9.9MB

          • memory/1772-6-0x000000001ACC0000-0x000000001AD52000-memory.dmp

            Filesize

            584KB

          • memory/1772-24-0x000007FEF6170000-0x000007FEF6B5C000-memory.dmp

            Filesize

            9.9MB

          • memory/1772-23-0x000007FEF6173000-0x000007FEF6174000-memory.dmp

            Filesize

            4KB

          • memory/1988-18-0x0000000000400000-0x0000000000440000-memory.dmp

            Filesize

            256KB

          • memory/1988-9-0x0000000000400000-0x0000000000440000-memory.dmp

            Filesize

            256KB

          • memory/1988-16-0x0000000000400000-0x0000000000440000-memory.dmp

            Filesize

            256KB

          • memory/1988-15-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

            Filesize

            4KB

          • memory/1988-13-0x0000000000400000-0x0000000000440000-memory.dmp

            Filesize

            256KB

          • memory/1988-20-0x0000000000400000-0x0000000000440000-memory.dmp

            Filesize

            256KB

          • memory/1988-21-0x0000000074D2E000-0x0000000074D2F000-memory.dmp

            Filesize

            4KB

          • memory/1988-22-0x0000000074D20000-0x000000007540E000-memory.dmp

            Filesize

            6.9MB

          • memory/1988-11-0x0000000000400000-0x0000000000440000-memory.dmp

            Filesize

            256KB

          • memory/1988-7-0x0000000000400000-0x0000000000440000-memory.dmp

            Filesize

            256KB

          • memory/1988-25-0x0000000074D2E000-0x0000000074D2F000-memory.dmp

            Filesize

            4KB

          • memory/1988-26-0x0000000074D20000-0x000000007540E000-memory.dmp

            Filesize

            6.9MB