Analysis
-
max time kernel
41s -
max time network
51s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
19-06-2024 12:13
Static task
static1
Behavioral task
behavioral1
Sample
PO and Proforma invoice.exe
Resource
win7-20240419-en
General
-
Target
PO and Proforma invoice.exe
-
Size
814KB
-
MD5
b289f51e58a368997298cc205b10d8be
-
SHA1
4e3256b8699de2d2a67aa122337bfaa7407a737b
-
SHA256
18f7507efdb35483a8642553f66647b9c1cc54d67614782622b7a64261042924
-
SHA512
54ceecb268ef81664b7ae4af7e399a72643a9415877c3b3ac9c14b8a363d72d07d1dff51e20dc60e6e4529c57b1e545434c93385d0d46ba74a3acf884df1b4f3
-
SSDEEP
12288:nlIc81H9rI6rgKmQgVsavXLJkM5ghECVFnMfkNbaz3e0igw0D9OwhEDin:nlUlRMK8JdX5aECdNba60igw0k0n
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.mahesh-ent.com - Port:
587 - Username:
[email protected] - Password:
M@hesh3981 - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
PO and Proforma invoice.exedescription ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation PO and Proforma invoice.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 6 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
PO and Proforma invoice.exedescription pid Process procid_target PID 3244 set thread context of 3300 3244 PO and Proforma invoice.exe 90 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 9 IoCs
Processes:
PO and Proforma invoice.exepowershell.exeMSBuild.exepid Process 3244 PO and Proforma invoice.exe 3244 PO and Proforma invoice.exe 2004 powershell.exe 3244 PO and Proforma invoice.exe 3244 PO and Proforma invoice.exe 3244 PO and Proforma invoice.exe 3300 MSBuild.exe 3300 MSBuild.exe 2004 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
PO and Proforma invoice.exepowershell.exeMSBuild.exedescription pid Process Token: SeDebugPrivilege 3244 PO and Proforma invoice.exe Token: SeDebugPrivilege 2004 powershell.exe Token: SeDebugPrivilege 3300 MSBuild.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
MSBuild.exepid Process 3300 MSBuild.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
PO and Proforma invoice.exedescription pid Process procid_target PID 3244 wrote to memory of 2004 3244 PO and Proforma invoice.exe 85 PID 3244 wrote to memory of 2004 3244 PO and Proforma invoice.exe 85 PID 3244 wrote to memory of 2004 3244 PO and Proforma invoice.exe 85 PID 3244 wrote to memory of 1784 3244 PO and Proforma invoice.exe 87 PID 3244 wrote to memory of 1784 3244 PO and Proforma invoice.exe 87 PID 3244 wrote to memory of 1784 3244 PO and Proforma invoice.exe 87 PID 3244 wrote to memory of 2292 3244 PO and Proforma invoice.exe 89 PID 3244 wrote to memory of 2292 3244 PO and Proforma invoice.exe 89 PID 3244 wrote to memory of 2292 3244 PO and Proforma invoice.exe 89 PID 3244 wrote to memory of 3300 3244 PO and Proforma invoice.exe 90 PID 3244 wrote to memory of 3300 3244 PO and Proforma invoice.exe 90 PID 3244 wrote to memory of 3300 3244 PO and Proforma invoice.exe 90 PID 3244 wrote to memory of 3300 3244 PO and Proforma invoice.exe 90 PID 3244 wrote to memory of 3300 3244 PO and Proforma invoice.exe 90 PID 3244 wrote to memory of 3300 3244 PO and Proforma invoice.exe 90 PID 3244 wrote to memory of 3300 3244 PO and Proforma invoice.exe 90 PID 3244 wrote to memory of 3300 3244 PO and Proforma invoice.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\PO and Proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\PO and Proforma invoice.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3244 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\hebYuJoo.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2004
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\hebYuJoo" /XML "C:\Users\Admin\AppData\Local\Temp\tmp78F9.tmp"2⤵
- Scheduled Task/Job: Scheduled Task
PID:1784
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵PID:2292
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3300
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
1KB
MD5fe1d95ac2524a5e89c13414282b4ca50
SHA1869ce307898127280a0968c7330a8e2ec7c7b82f
SHA2561d4a46c23df2447ec6b8bddcb92cb4f61538396add9aab1c60334b98bdaf37fc
SHA5129e20cc23bdfdfad6547ee939c6d728c1362199b672b4a7151d4ec51fee7dc1971b5cf9d8cf018fa0edb49f31e255fea1eb196401a1646ea83245147e9d489c5d