Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
18-06-2024 13:10
Static task
static1
Behavioral task
behavioral1
Sample
freight invoice.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
freight invoice.exe
Resource
win10v2004-20240508-en
General
-
Target
freight invoice.exe
-
Size
1007KB
-
MD5
ad2b14ed6077cddcb6fe7caa1b4fc6bb
-
SHA1
e1df5697ba2b1d38f23c242c85873f4b9ae98c57
-
SHA256
44f99d24049bdd928b66782697112d31e45c2de51a515fdd6298e5a57f4eab35
-
SHA512
f8b66bc86dbff4f1765f76a65d1c4b1572fcdd5c2dcaa1a7f2e084378e4e34a0100580134c8a039d9c53c52f7e0a3af95ea4849678e86269a002fd7d41fa7a6a
-
SSDEEP
12288:/TFIsPAaY5QH3xbiSlaMkzE10MKzOzvMJ+EMMuDEzcmFEmm7I3sL4ZNKmobj:JIKsSBbLaMtUzOCPJzNm7IcL4bKHj
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.naveentour.com - Port:
587 - Username:
[email protected] - Password:
nav!T6u2@001 - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Processes:
powershell.exepowershell.exepid process 1752 powershell.exe 4472 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
freight invoice.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation freight invoice.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
RegSvcs.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\boqXv = "C:\\Users\\Admin\\AppData\\Roaming\\boqXv\\boqXv.exe" RegSvcs.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
freight invoice.exedescription pid process target process PID 352 set thread context of 4312 352 freight invoice.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 11 IoCs
Processes:
freight invoice.exepowershell.exepowershell.exeRegSvcs.exepid process 352 freight invoice.exe 352 freight invoice.exe 4472 powershell.exe 1752 powershell.exe 352 freight invoice.exe 352 freight invoice.exe 352 freight invoice.exe 4472 powershell.exe 4312 RegSvcs.exe 4312 RegSvcs.exe 1752 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
freight invoice.exepowershell.exepowershell.exeRegSvcs.exedescription pid process Token: SeDebugPrivilege 352 freight invoice.exe Token: SeDebugPrivilege 4472 powershell.exe Token: SeDebugPrivilege 1752 powershell.exe Token: SeDebugPrivilege 4312 RegSvcs.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
freight invoice.exedescription pid process target process PID 352 wrote to memory of 4472 352 freight invoice.exe powershell.exe PID 352 wrote to memory of 4472 352 freight invoice.exe powershell.exe PID 352 wrote to memory of 4472 352 freight invoice.exe powershell.exe PID 352 wrote to memory of 1752 352 freight invoice.exe powershell.exe PID 352 wrote to memory of 1752 352 freight invoice.exe powershell.exe PID 352 wrote to memory of 1752 352 freight invoice.exe powershell.exe PID 352 wrote to memory of 2264 352 freight invoice.exe schtasks.exe PID 352 wrote to memory of 2264 352 freight invoice.exe schtasks.exe PID 352 wrote to memory of 2264 352 freight invoice.exe schtasks.exe PID 352 wrote to memory of 2756 352 freight invoice.exe RegSvcs.exe PID 352 wrote to memory of 2756 352 freight invoice.exe RegSvcs.exe PID 352 wrote to memory of 2756 352 freight invoice.exe RegSvcs.exe PID 352 wrote to memory of 4312 352 freight invoice.exe RegSvcs.exe PID 352 wrote to memory of 4312 352 freight invoice.exe RegSvcs.exe PID 352 wrote to memory of 4312 352 freight invoice.exe RegSvcs.exe PID 352 wrote to memory of 4312 352 freight invoice.exe RegSvcs.exe PID 352 wrote to memory of 4312 352 freight invoice.exe RegSvcs.exe PID 352 wrote to memory of 4312 352 freight invoice.exe RegSvcs.exe PID 352 wrote to memory of 4312 352 freight invoice.exe RegSvcs.exe PID 352 wrote to memory of 4312 352 freight invoice.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\freight invoice.exe"C:\Users\Admin\AppData\Local\Temp\freight invoice.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:352 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\freight invoice.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4472
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ASUenBCZUZgfeR.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1752
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ASUenBCZUZgfeR" /XML "C:\Users\Admin\AppData\Local\Temp\tmp82FB.tmp"2⤵
- Scheduled Task/Job: Scheduled Task
PID:2264
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵PID:2756
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4312
-
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD53d086a433708053f9bf9523e1d87a4e8
SHA1b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA2566f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
SHA512931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd
-
Filesize
18KB
MD568b43c287dbb9170b338f3039e6700a1
SHA19c68905038377ee0c018d449febb5cf1cc21349b
SHA2569adf3a509a244a37776a9af6512aac90e66147efc6bf0d740deb1c997722b5df
SHA51200dd30e689145175b4879e412443c3b434ba3655e089504f6986ab6939229c937ef0b934d537cb3dd3b460e5391b21ef5aa0d37bf990bd6cfbe320fc2c4ffb13
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
1KB
MD5e3417f96149e28676455fa9094341acb
SHA1d1822a43e50715457215b29ec6438ba07825e002
SHA256bebca4b4792674b6628abea57c0640c7f61d5c1e23ab84259da08e816682d386
SHA5129f86109453b5d28ff44faa01dd097b0c016b072b99469887c5cdec72859e48586e41c506c21f5a9bcff195c0c35f0343dd5bd0a21d094b15809e81e5d93e8788