Analysis
-
max time kernel
23s -
max time network
114s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
27-07-2024 01:06
Static task
static1
Behavioral task
behavioral1
Sample
Receipt of payment 03744 PDF.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
Receipt of payment 03744 PDF.exe
Resource
win10v2004-20240709-en
General
-
Target
Receipt of payment 03744 PDF.exe
-
Size
1.2MB
-
MD5
7a751bcda4f85feadb5073f1b21eee43
-
SHA1
0f92303453d3ed5ee087e5b65099962182a842ee
-
SHA256
11249774e541685aa3eed7d7fc58cc8d10491180760637c7e6d2868d909078eb
-
SHA512
f87d3960b9b6eaf6fe9ef46ba06bfe050ff17f2a0f0188b14433199f3044d59192f1fbf8c1ce560733ed250389738a6290580f049371061183f6f2b50923a7c5
-
SSDEEP
24576:NqDEvCTbMWu7rQYlBQcBiT6rprG8aJw8+mgYx3eIZHM+eeew7:NTvC/MTQYxsWR7aJwbux3eIC+eHw
Malware Config
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 2 api.ipify.org 3 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Receipt of payment 03744 PDF.exedescription pid process target process PID 2240 set thread context of 2756 2240 Receipt of payment 03744 PDF.exe RegSvcs.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
RegSvcs.exeReceipt of payment 03744 PDF.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegSvcs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Receipt of payment 03744 PDF.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
RegSvcs.exepid process 2756 RegSvcs.exe 2756 RegSvcs.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
Receipt of payment 03744 PDF.exepid process 2240 Receipt of payment 03744 PDF.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RegSvcs.exedescription pid process Token: SeDebugPrivilege 2756 RegSvcs.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Receipt of payment 03744 PDF.exepid process 2240 Receipt of payment 03744 PDF.exe 2240 Receipt of payment 03744 PDF.exe -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Receipt of payment 03744 PDF.exepid process 2240 Receipt of payment 03744 PDF.exe 2240 Receipt of payment 03744 PDF.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
Receipt of payment 03744 PDF.exedescription pid process target process PID 2240 wrote to memory of 2756 2240 Receipt of payment 03744 PDF.exe RegSvcs.exe PID 2240 wrote to memory of 2756 2240 Receipt of payment 03744 PDF.exe RegSvcs.exe PID 2240 wrote to memory of 2756 2240 Receipt of payment 03744 PDF.exe RegSvcs.exe PID 2240 wrote to memory of 2756 2240 Receipt of payment 03744 PDF.exe RegSvcs.exe PID 2240 wrote to memory of 2756 2240 Receipt of payment 03744 PDF.exe RegSvcs.exe PID 2240 wrote to memory of 2756 2240 Receipt of payment 03744 PDF.exe RegSvcs.exe PID 2240 wrote to memory of 2756 2240 Receipt of payment 03744 PDF.exe RegSvcs.exe PID 2240 wrote to memory of 2756 2240 Receipt of payment 03744 PDF.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Receipt of payment 03744 PDF.exe"C:\Users\Admin\AppData\Local\Temp\Receipt of payment 03744 PDF.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\Receipt of payment 03744 PDF.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\GraffFilesize
261KB
MD5902cb31761e1b5a26d64bfdf96740062
SHA1139316297e0751c767819001d5b1d4284cd7d99d
SHA256236e970f281ee58b76d4e50e80f69b99dd09689181cf55000f44b97c47e77167
SHA51237e4e2afada17892cf26e866a7d8968391a8c50b6d6a714888bcd4e5d54e5fdb612322e90edc33973f19d2f7de9255fb0a9999dc951bdd04fc8d1c36e7cfda4f
-
memory/2240-12-0x00000000001E0000-0x00000000001E4000-memory.dmpFilesize
16KB
-
memory/2756-13-0x0000000000400000-0x0000000000446000-memory.dmpFilesize
280KB
-
memory/2756-16-0x0000000000400000-0x0000000000446000-memory.dmpFilesize
280KB
-
memory/2756-15-0x0000000000400000-0x0000000000446000-memory.dmpFilesize
280KB
-
memory/2756-17-0x0000000073EFE000-0x0000000073EFF000-memory.dmpFilesize
4KB
-
memory/2756-18-0x0000000000370000-0x00000000003C4000-memory.dmpFilesize
336KB
-
memory/2756-19-0x0000000073EF0000-0x00000000745DE000-memory.dmpFilesize
6.9MB
-
memory/2756-20-0x0000000000560000-0x00000000005B2000-memory.dmpFilesize
328KB
-
memory/2756-21-0x0000000073EF0000-0x00000000745DE000-memory.dmpFilesize
6.9MB
-
memory/2756-22-0x0000000073EF0000-0x00000000745DE000-memory.dmpFilesize
6.9MB
-
memory/2756-65-0x0000000000560000-0x00000000005AC000-memory.dmpFilesize
304KB
-
memory/2756-68-0x0000000000560000-0x00000000005AC000-memory.dmpFilesize
304KB
-
memory/2756-82-0x0000000000560000-0x00000000005AC000-memory.dmpFilesize
304KB
-
memory/2756-78-0x0000000000560000-0x00000000005AC000-memory.dmpFilesize
304KB
-
memory/2756-76-0x0000000000560000-0x00000000005AC000-memory.dmpFilesize
304KB
-
memory/2756-74-0x0000000000560000-0x00000000005AC000-memory.dmpFilesize
304KB
-
memory/2756-70-0x0000000000560000-0x00000000005AC000-memory.dmpFilesize
304KB
-
memory/2756-66-0x0000000000560000-0x00000000005AC000-memory.dmpFilesize
304KB
-
memory/2756-62-0x0000000000560000-0x00000000005AC000-memory.dmpFilesize
304KB
-
memory/2756-60-0x0000000000560000-0x00000000005AC000-memory.dmpFilesize
304KB
-
memory/2756-58-0x0000000000560000-0x00000000005AC000-memory.dmpFilesize
304KB
-
memory/2756-54-0x0000000000560000-0x00000000005AC000-memory.dmpFilesize
304KB
-
memory/2756-52-0x0000000000560000-0x00000000005AC000-memory.dmpFilesize
304KB
-
memory/2756-50-0x0000000000560000-0x00000000005AC000-memory.dmpFilesize
304KB
-
memory/2756-48-0x0000000000560000-0x00000000005AC000-memory.dmpFilesize
304KB
-
memory/2756-44-0x0000000000560000-0x00000000005AC000-memory.dmpFilesize
304KB
-
memory/2756-42-0x0000000000560000-0x00000000005AC000-memory.dmpFilesize
304KB
-
memory/2756-40-0x0000000000560000-0x00000000005AC000-memory.dmpFilesize
304KB
-
memory/2756-36-0x0000000000560000-0x00000000005AC000-memory.dmpFilesize
304KB
-
memory/2756-34-0x0000000000560000-0x00000000005AC000-memory.dmpFilesize
304KB
-
memory/2756-32-0x0000000000560000-0x00000000005AC000-memory.dmpFilesize
304KB
-
memory/2756-30-0x0000000000560000-0x00000000005AC000-memory.dmpFilesize
304KB
-
memory/2756-26-0x0000000000560000-0x00000000005AC000-memory.dmpFilesize
304KB
-
memory/2756-24-0x0000000000560000-0x00000000005AC000-memory.dmpFilesize
304KB
-
memory/2756-81-0x0000000000560000-0x00000000005AC000-memory.dmpFilesize
304KB
-
memory/2756-72-0x0000000000560000-0x00000000005AC000-memory.dmpFilesize
304KB
-
memory/2756-57-0x0000000000560000-0x00000000005AC000-memory.dmpFilesize
304KB
-
memory/2756-46-0x0000000000560000-0x00000000005AC000-memory.dmpFilesize
304KB
-
memory/2756-39-0x0000000000560000-0x00000000005AC000-memory.dmpFilesize
304KB
-
memory/2756-29-0x0000000000560000-0x00000000005AC000-memory.dmpFilesize
304KB
-
memory/2756-23-0x0000000000560000-0x00000000005AC000-memory.dmpFilesize
304KB
-
memory/2756-1055-0x0000000073EF0000-0x00000000745DE000-memory.dmpFilesize
6.9MB
-
memory/2756-1056-0x0000000000400000-0x0000000000446000-memory.dmpFilesize
280KB
-
memory/2756-1057-0x0000000073EFE000-0x0000000073EFF000-memory.dmpFilesize
4KB
-
memory/2756-1058-0x0000000073EF0000-0x00000000745DE000-memory.dmpFilesize
6.9MB