Analysis

  • max time kernel
    135s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    24-09-2024 12:57

General

  • Target

    Proforma Invoice.exe

  • Size

    708KB

  • MD5

    ce283c28a7441d2197b14faad7eccb38

  • SHA1

    805e2221564dda4603cb6975c1ac51cd50afa030

  • SHA256

    ba9c641828f465a988c43c858463602faadc4bc688b5b58d9a80bd25fd45a4d6

  • SHA512

    8d4659f08858799b2fc51d15887b562597c8cbc489bd5e44bf0dad1ff8ffbcfaa537b6a41b5150cca3e0792c5836574ac251ebe76741c60c7ba2858d08b79d5e

  • SSDEEP

    12288:AEGPYMScPFtEGTaxF+gIAtF5O0JwFK1ftPLAJu9douc7N:zGPdnXaKpsT2A257N

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    smtp.yandex.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    PUBLIC12345.@!!@

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • AgentTesla payload 5 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Start PowerShell.

  • Suspicious use of SetThreadContext 1 IoCs
  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs

    Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 35 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Proforma Invoice.exe
    "C:\Users\Admin\AppData\Local\Temp\Proforma Invoice.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2528
    • C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /c REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v SkypeSetup /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Skvpe.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2460
      • C:\Windows\SysWOW64\reg.exe
        REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v SkypeSetup /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Skvpe.exe"
        3⤵
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        PID:744
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Process C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Skvpe.exe
      2⤵
      • Loads dropped DLL
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2728
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Skvpe.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Skvpe.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2972
        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Skvpe.exe
          "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Skvpe.exe"
          4⤵
          • Executes dropped EXE
          • Accesses Microsoft Outlook profiles
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          • outlook_office_path
          • outlook_win_path
          PID:1028
          • C:\Windows\SysWOW64\netsh.exe
            "netsh" wlan show profile
            5⤵
            • Event Triggered Execution: Netsh Helper DLL
            • System Location Discovery: System Language Discovery
            • System Network Configuration Discovery: Wi-Fi Discovery
            PID:2108

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Skvpe.exe

    Filesize

    708KB

    MD5

    ce283c28a7441d2197b14faad7eccb38

    SHA1

    805e2221564dda4603cb6975c1ac51cd50afa030

    SHA256

    ba9c641828f465a988c43c858463602faadc4bc688b5b58d9a80bd25fd45a4d6

    SHA512

    8d4659f08858799b2fc51d15887b562597c8cbc489bd5e44bf0dad1ff8ffbcfaa537b6a41b5150cca3e0792c5836574ac251ebe76741c60c7ba2858d08b79d5e

  • memory/1028-15-0x0000000000400000-0x0000000000450000-memory.dmp

    Filesize

    320KB

  • memory/1028-27-0x0000000000400000-0x0000000000450000-memory.dmp

    Filesize

    320KB

  • memory/1028-26-0x0000000000400000-0x0000000000450000-memory.dmp

    Filesize

    320KB

  • memory/1028-24-0x0000000000400000-0x0000000000450000-memory.dmp

    Filesize

    320KB

  • memory/1028-23-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/1028-21-0x0000000000400000-0x0000000000450000-memory.dmp

    Filesize

    320KB

  • memory/1028-20-0x0000000000400000-0x0000000000450000-memory.dmp

    Filesize

    320KB

  • memory/1028-17-0x0000000000400000-0x0000000000450000-memory.dmp

    Filesize

    320KB

  • memory/2528-4-0x0000000074E5E000-0x0000000074E5F000-memory.dmp

    Filesize

    4KB

  • memory/2528-7-0x0000000074E50000-0x000000007553E000-memory.dmp

    Filesize

    6.9MB

  • memory/2528-5-0x0000000074E50000-0x000000007553E000-memory.dmp

    Filesize

    6.9MB

  • memory/2528-0-0x0000000074E5E000-0x0000000074E5F000-memory.dmp

    Filesize

    4KB

  • memory/2528-3-0x0000000074E50000-0x000000007553E000-memory.dmp

    Filesize

    6.9MB

  • memory/2528-2-0x00000000003A0000-0x00000000003C2000-memory.dmp

    Filesize

    136KB

  • memory/2528-1-0x0000000000240000-0x00000000002F6000-memory.dmp

    Filesize

    728KB

  • memory/2972-13-0x00000000010A0000-0x0000000001156000-memory.dmp

    Filesize

    728KB