Analysis
- max time kernel
145s - max time network
108s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
07/06/2024, 01:23
General
- Target Revised invoice.exe
- Size 1.1MB
- Sample240607-brwehsfb5s
- SHA256 0fd8da5d6fb04b52cfbc2074c9d5382a7b10ab501913b61e31408a2aa16a02e0
Malware Config
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Revised invoice.exe"C:\Users\Admin\AppData\Local\Temp\Revised invoice.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\Revised invoice.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1744 -s 7282⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1744 -ip 17441⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
aut4527.tmp
memory/1744-12-0x0000000000ED0000-0x0000000000ED4000-memory.dmp
memory/5100-13-0x0000000000400000-0x0000000000446000-memory.dmp
memory/5100-16-0x0000000000400000-0x0000000000446000-memory.dmp
memory/5100-15-0x0000000000400000-0x0000000000446000-memory.dmp
memory/5100-17-0x0000000073CAE000-0x0000000073CAF000-memory.dmp
memory/5100-14-0x0000000000400000-0x0000000000446000-memory.dmp
memory/5100-18-0x0000000004FF0000-0x0000000005044000-memory.dmp
memory/5100-19-0x0000000073CA0000-0x0000000074450000-memory.dmp
memory/5100-20-0x0000000005630000-0x0000000005BD4000-memory.dmp
memory/5100-21-0x00000000050C0000-0x0000000005114000-memory.dmp
memory/5100-22-0x0000000073CA0000-0x0000000074450000-memory.dmp
memory/5100-26-0x00000000050C0000-0x000000000510D000-memory.dmp
memory/5100-83-0x00000000050C0000-0x000000000510D000-memory.dmp
memory/5100-81-0x00000000050C0000-0x000000000510D000-memory.dmp
memory/5100-80-0x00000000050C0000-0x000000000510D000-memory.dmp
memory/5100-77-0x00000000050C0000-0x000000000510D000-memory.dmp
memory/5100-75-0x00000000050C0000-0x000000000510D000-memory.dmp
memory/5100-73-0x00000000050C0000-0x000000000510D000-memory.dmp
memory/5100-64-0x0000000073CA0000-0x0000000074450000-memory.dmp
memory/5100-60-0x00000000050C0000-0x000000000510D000-memory.dmp
memory/5100-58-0x00000000050C0000-0x000000000510D000-memory.dmp
memory/5100-56-0x00000000050C0000-0x000000000510D000-memory.dmp
memory/5100-52-0x00000000050C0000-0x000000000510D000-memory.dmp
memory/5100-1059-0x0000000073CA0000-0x0000000074450000-memory.dmp
memory/5100-1058-0x0000000005280000-0x00000000052E6000-memory.dmp
memory/5100-50-0x00000000050C0000-0x000000000510D000-memory.dmp
memory/5100-48-0x00000000050C0000-0x000000000510D000-memory.dmp
memory/5100-46-0x00000000050C0000-0x000000000510D000-memory.dmp
memory/5100-44-0x00000000050C0000-0x000000000510D000-memory.dmp
memory/5100-40-0x00000000050C0000-0x000000000510D000-memory.dmp
memory/5100-38-0x00000000050C0000-0x000000000510D000-memory.dmp
memory/5100-36-0x00000000050C0000-0x000000000510D000-memory.dmp
memory/5100-34-0x00000000050C0000-0x000000000510D000-memory.dmp
memory/5100-32-0x00000000050C0000-0x000000000510D000-memory.dmp
memory/5100-31-0x00000000050C0000-0x000000000510D000-memory.dmp
memory/5100-24-0x00000000050C0000-0x000000000510D000-memory.dmp
memory/5100-23-0x00000000050C0000-0x000000000510D000-memory.dmp
memory/5100-71-0x00000000050C0000-0x000000000510D000-memory.dmp
memory/5100-69-0x00000000050C0000-0x000000000510D000-memory.dmp
memory/5100-67-0x00000000050C0000-0x000000000510D000-memory.dmp
memory/5100-65-0x00000000050C0000-0x000000000510D000-memory.dmp
memory/5100-62-0x00000000050C0000-0x000000000510D000-memory.dmp
memory/5100-54-0x00000000050C0000-0x000000000510D000-memory.dmp
memory/5100-43-0x00000000050C0000-0x000000000510D000-memory.dmp
memory/5100-28-0x00000000050C0000-0x000000000510D000-memory.dmp
memory/5100-1062-0x00000000062C0000-0x0000000006352000-memory.dmp
memory/5100-1063-0x0000000006230000-0x000000000623A000-memory.dmp
memory/5100-1061-0x00000000061D0000-0x0000000006220000-memory.dmp
memory/5100-1064-0x0000000000400000-0x0000000000446000-memory.dmp
memory/5100-1066-0x0000000073CA0000-0x0000000074450000-memory.dmp
memory/5100-1065-0x0000000073CAE000-0x0000000073CAF000-memory.dmp