Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
19-06-2024 12:00
Static task
static1
Behavioral task
behavioral1
Sample
Payment advice.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
Payment advice.exe
Resource
win10v2004-20240508-en
General
-
Target
Payment advice.exe
-
Size
1.0MB
-
MD5
f1f023410d036b2cb9c5560771cdac95
-
SHA1
33983202139b55b2f268387ac6fbec0e2a63511c
-
SHA256
027fd05dc4bc7e4fd4127b9490198faf1ddfe250c8a5bb74de64df2d7d021cfb
-
SHA512
0ec9400829b872ea9e0744b770c5511fe8ea8c186a27fa7f9cd15b6a896ee0a9355a35fd5fdbe8438d737e36777b8fe99ff603dac6d7870d2522306de76f022c
-
SSDEEP
24576:8AHnh+eWsN3skA4RV1Hom2KXMmHamol2x1JjmHtTy5:bh+ZkldoPK8YamP1QE
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.albushrametalic.com - Port:
587 - Username:
[email protected] - Password:
GLBL1285# - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 api.ipify.org 5 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Payment advice.exedescription pid Process procid_target PID 3020 set thread context of 2984 3020 Payment advice.exe 28 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
RegSvcs.exepid Process 2984 RegSvcs.exe 2984 RegSvcs.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
Payment advice.exepid Process 3020 Payment advice.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RegSvcs.exedescription pid Process Token: SeDebugPrivilege 2984 RegSvcs.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Payment advice.exepid Process 3020 Payment advice.exe 3020 Payment advice.exe -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Payment advice.exepid Process 3020 Payment advice.exe 3020 Payment advice.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
Payment advice.exedescription pid Process procid_target PID 3020 wrote to memory of 2984 3020 Payment advice.exe 28 PID 3020 wrote to memory of 2984 3020 Payment advice.exe 28 PID 3020 wrote to memory of 2984 3020 Payment advice.exe 28 PID 3020 wrote to memory of 2984 3020 Payment advice.exe 28 PID 3020 wrote to memory of 2984 3020 Payment advice.exe 28 PID 3020 wrote to memory of 2984 3020 Payment advice.exe 28 PID 3020 wrote to memory of 2984 3020 Payment advice.exe 28 PID 3020 wrote to memory of 2984 3020 Payment advice.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\Payment advice.exe"C:\Users\Admin\AppData\Local\Temp\Payment advice.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\Payment advice.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2984
-