Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18-06-2024 13:38

General

  • Target

    INVOICE PAYMENT_Scan0016.scr.exe

  • Size

    546KB

  • MD5

    ca6a93a429257f7203112e5311ca5b01

  • SHA1

    6ab678c5318042c710d59b7e4b1623c20759f8b7

  • SHA256

    0ec17a88232be3356c93b0b0eae5acf6a53332fe13e6881d627bea4f2963e6d6

  • SHA512

    4d04c05cdcb96f1f465f355c12418de016b12ec2bffd74b086712b75e0777388ebc2183e16c545d73ac42e38a085a18209c37653bfd41b3fbededfcb42ed7dfd

  • SSDEEP

    3072:r6Fvnr8xWdvz6m6yQIIDOkbBybvN7jO++qTh3kSkPAxS5oRN:runr11zT2IIDR9ybvdqYgoR

Malware Config

Extracted

Family

agenttesla

Credentials

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\INVOICE PAYMENT_Scan0016.scr.exe
    "C:\Users\Admin\AppData\Local\Temp\INVOICE PAYMENT_Scan0016.scr.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1596
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:1540

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1540-4903-0x0000000074840000-0x0000000074FF0000-memory.dmp

    Filesize

    7.7MB

  • memory/1540-4904-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

  • memory/1540-4905-0x0000000074840000-0x0000000074FF0000-memory.dmp

    Filesize

    7.7MB

  • memory/1540-4906-0x0000000006280000-0x00000000062D0000-memory.dmp

    Filesize

    320KB

  • memory/1540-4907-0x0000000006500000-0x000000000650A000-memory.dmp

    Filesize

    40KB

  • memory/1540-4908-0x0000000074840000-0x0000000074FF0000-memory.dmp

    Filesize

    7.7MB

  • memory/1596-27-0x0000000007490000-0x00000000076BA000-memory.dmp

    Filesize

    2.2MB

  • memory/1596-21-0x0000000007490000-0x00000000076BA000-memory.dmp

    Filesize

    2.2MB

  • memory/1596-3-0x0000000007490000-0x00000000076C0000-memory.dmp

    Filesize

    2.2MB

  • memory/1596-4-0x0000000007C70000-0x0000000008214000-memory.dmp

    Filesize

    5.6MB

  • memory/1596-5-0x0000000007870000-0x0000000007902000-memory.dmp

    Filesize

    584KB

  • memory/1596-7-0x0000000007490000-0x00000000076BA000-memory.dmp

    Filesize

    2.2MB

  • memory/1596-6-0x0000000007490000-0x00000000076BA000-memory.dmp

    Filesize

    2.2MB

  • memory/1596-17-0x0000000007490000-0x00000000076BA000-memory.dmp

    Filesize

    2.2MB

  • memory/1596-47-0x0000000007490000-0x00000000076BA000-memory.dmp

    Filesize

    2.2MB

  • memory/1596-57-0x0000000007490000-0x00000000076BA000-memory.dmp

    Filesize

    2.2MB

  • memory/1596-51-0x0000000007490000-0x00000000076BA000-memory.dmp

    Filesize

    2.2MB

  • memory/1596-49-0x0000000007490000-0x00000000076BA000-memory.dmp

    Filesize

    2.2MB

  • memory/1596-45-0x0000000007490000-0x00000000076BA000-memory.dmp

    Filesize

    2.2MB

  • memory/1596-43-0x0000000007490000-0x00000000076BA000-memory.dmp

    Filesize

    2.2MB

  • memory/1596-41-0x0000000007490000-0x00000000076BA000-memory.dmp

    Filesize

    2.2MB

  • memory/1596-39-0x0000000007490000-0x00000000076BA000-memory.dmp

    Filesize

    2.2MB

  • memory/1596-37-0x0000000007490000-0x00000000076BA000-memory.dmp

    Filesize

    2.2MB

  • memory/1596-35-0x0000000007490000-0x00000000076BA000-memory.dmp

    Filesize

    2.2MB

  • memory/1596-31-0x0000000007490000-0x00000000076BA000-memory.dmp

    Filesize

    2.2MB

  • memory/1596-29-0x0000000007490000-0x00000000076BA000-memory.dmp

    Filesize

    2.2MB

  • memory/1596-1-0x0000000000650000-0x00000000006DE000-memory.dmp

    Filesize

    568KB

  • memory/1596-33-0x0000000007490000-0x00000000076BA000-memory.dmp

    Filesize

    2.2MB

  • memory/1596-25-0x0000000007490000-0x00000000076BA000-memory.dmp

    Filesize

    2.2MB

  • memory/1596-2-0x0000000074840000-0x0000000074FF0000-memory.dmp

    Filesize

    7.7MB

  • memory/1596-19-0x0000000007490000-0x00000000076BA000-memory.dmp

    Filesize

    2.2MB

  • memory/1596-15-0x0000000007490000-0x00000000076BA000-memory.dmp

    Filesize

    2.2MB

  • memory/1596-13-0x0000000007490000-0x00000000076BA000-memory.dmp

    Filesize

    2.2MB

  • memory/1596-11-0x0000000007490000-0x00000000076BA000-memory.dmp

    Filesize

    2.2MB

  • memory/1596-9-0x0000000007490000-0x00000000076BA000-memory.dmp

    Filesize

    2.2MB

  • memory/1596-23-0x0000000007490000-0x00000000076BA000-memory.dmp

    Filesize

    2.2MB

  • memory/1596-70-0x0000000007490000-0x00000000076BA000-memory.dmp

    Filesize

    2.2MB

  • memory/1596-67-0x0000000007490000-0x00000000076BA000-memory.dmp

    Filesize

    2.2MB

  • memory/1596-65-0x0000000007490000-0x00000000076BA000-memory.dmp

    Filesize

    2.2MB

  • memory/1596-63-0x0000000007490000-0x00000000076BA000-memory.dmp

    Filesize

    2.2MB

  • memory/1596-61-0x0000000007490000-0x00000000076BA000-memory.dmp

    Filesize

    2.2MB

  • memory/1596-59-0x0000000007490000-0x00000000076BA000-memory.dmp

    Filesize

    2.2MB

  • memory/1596-55-0x0000000007490000-0x00000000076BA000-memory.dmp

    Filesize

    2.2MB

  • memory/1596-53-0x0000000007490000-0x00000000076BA000-memory.dmp

    Filesize

    2.2MB

  • memory/1596-4892-0x0000000074840000-0x0000000074FF0000-memory.dmp

    Filesize

    7.7MB

  • memory/1596-4893-0x0000000005760000-0x0000000005766000-memory.dmp

    Filesize

    24KB

  • memory/1596-4894-0x0000000005800000-0x000000000586C000-memory.dmp

    Filesize

    432KB

  • memory/1596-4895-0x0000000005870000-0x00000000058BC000-memory.dmp

    Filesize

    304KB

  • memory/1596-0-0x000000007484E000-0x000000007484F000-memory.dmp

    Filesize

    4KB

  • memory/1596-4896-0x0000000005990000-0x00000000059F6000-memory.dmp

    Filesize

    408KB

  • memory/1596-4897-0x000000007484E000-0x000000007484F000-memory.dmp

    Filesize

    4KB

  • memory/1596-4898-0x0000000074840000-0x0000000074FF0000-memory.dmp

    Filesize

    7.7MB

  • memory/1596-4899-0x0000000000C10000-0x0000000000C64000-memory.dmp

    Filesize

    336KB

  • memory/1596-4902-0x0000000074840000-0x0000000074FF0000-memory.dmp

    Filesize

    7.7MB