Analysis
-
max time kernel
81s -
max time network
111s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
12-09-2024 16:02
Behavioral task
behavioral1
Sample
signed contract and order confirmation.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
signed contract and order confirmation.exe
Resource
win10v2004-20240802-en
General
-
Target
signed contract and order confirmation.exe
-
Size
583KB
-
MD5
d6f99a0cc11e32ea897bc97a319748ab
-
SHA1
006a848fd606c3799ef9ec23ff47fbb81900bc74
-
SHA256
fd9725ecc7ed625c2174660e7f51f647fff9474f4c21c8ed84e0608bbcc5a409
-
SHA512
dc1af6b89f41a83d9eb84304fb1e9dff8e62de312f6c1245f1d0850bebd0596ab99e3548df6b36d9db7bb953882c745ee8a94cc4a9258b447fc5dec0ffa9b621
-
SSDEEP
12288:TXe9PPlowWX0t6mOQwg1Qd15CcYk0We1FY/Hd2sQIsXSBBCWENB:6hloDX0XOf4Kd2EsCjCW+B
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.mahesh-ent.com - Port:
587 - Username:
[email protected] - Password:
M@hesh3981 - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
resource yara_rule behavioral1/memory/2232-0-0x00000000001B0000-0x0000000000304000-memory.dmp upx behavioral1/memory/2232-14-0x00000000001B0000-0x0000000000304000-memory.dmp upx -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 api.ipify.org 5 api.ipify.org -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/2232-14-0x00000000001B0000-0x0000000000304000-memory.dmp autoit_exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2232 set thread context of 2732 2232 signed contract and order confirmation.exe 30 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language signed contract and order confirmation.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegSvcs.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2732 RegSvcs.exe 2732 RegSvcs.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2232 signed contract and order confirmation.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2732 RegSvcs.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2232 signed contract and order confirmation.exe 2232 signed contract and order confirmation.exe -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 2232 signed contract and order confirmation.exe 2232 signed contract and order confirmation.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2732 RegSvcs.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2232 wrote to memory of 2732 2232 signed contract and order confirmation.exe 30 PID 2232 wrote to memory of 2732 2232 signed contract and order confirmation.exe 30 PID 2232 wrote to memory of 2732 2232 signed contract and order confirmation.exe 30 PID 2232 wrote to memory of 2732 2232 signed contract and order confirmation.exe 30 PID 2232 wrote to memory of 2732 2232 signed contract and order confirmation.exe 30 PID 2232 wrote to memory of 2732 2232 signed contract and order confirmation.exe 30 PID 2232 wrote to memory of 2732 2232 signed contract and order confirmation.exe 30 PID 2232 wrote to memory of 2732 2232 signed contract and order confirmation.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\signed contract and order confirmation.exe"C:\Users\Admin\AppData\Local\Temp\signed contract and order confirmation.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\signed contract and order confirmation.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2732
-