Analysis
-
max time kernel
130s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
04-10-2024 11:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
proforma invoice No 2003988 dated 10042024.exe
Resource
win7-20240903-en
windows7-x64
15 signatures
150 seconds
General
-
Target
proforma invoice No 2003988 dated 10042024.exe
-
Size
742KB
-
MD5
288e2818b37e52f9e697431692abb36e
-
SHA1
6868bc69d0d6d0b92e9c0c3078c09420c3dc651f
-
SHA256
0a74602363d411ea6ce0a632acadeb68025595990a3ee9add024ab36cca0bfcc
-
SHA512
e7d481cc5281223fc4636c190026f14fef5351e80bec2bd40bb053349cba497998b9700aa1b06736bc30a5a657fc2690ad94adec50b3f2f315287115805b9cee
-
SSDEEP
12288:Ahx6P6SzMLJ9Cg0ISgrUaoNsFo4uMY2Csm0jQ:gx/yMnCCSgAmo/WV
Malware Config
Extracted
Credentials
Protocol: ftp- Host:
ftp.concaribe.com - Port:
21 - Username:
[email protected] - Password:
ro}UWgz#!38E
Extracted
Family
agenttesla
Credentials
Protocol: ftp- Host:
ftp://ftp.concaribe.com - Port:
21 - Username:
[email protected] - Password:
ro}UWgz#!38E
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 15 api.ipify.org 16 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2032 set thread context of 2248 2032 proforma invoice No 2003988 dated 10042024.exe 89 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language proforma invoice No 2003988 dated 10042024.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language proforma invoice No 2003988 dated 10042024.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2248 proforma invoice No 2003988 dated 10042024.exe 2248 proforma invoice No 2003988 dated 10042024.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 5000 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 2248 proforma invoice No 2003988 dated 10042024.exe Token: SeDebugPrivilege 5000 taskmgr.exe Token: SeSystemProfilePrivilege 5000 taskmgr.exe Token: SeCreateGlobalPrivilege 5000 taskmgr.exe Token: 33 5000 taskmgr.exe Token: SeIncBasePriorityPrivilege 5000 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe 5000 taskmgr.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2032 wrote to memory of 2248 2032 proforma invoice No 2003988 dated 10042024.exe 89 PID 2032 wrote to memory of 2248 2032 proforma invoice No 2003988 dated 10042024.exe 89 PID 2032 wrote to memory of 2248 2032 proforma invoice No 2003988 dated 10042024.exe 89 PID 2032 wrote to memory of 2248 2032 proforma invoice No 2003988 dated 10042024.exe 89 PID 2032 wrote to memory of 2248 2032 proforma invoice No 2003988 dated 10042024.exe 89 PID 2032 wrote to memory of 2248 2032 proforma invoice No 2003988 dated 10042024.exe 89 PID 2032 wrote to memory of 2248 2032 proforma invoice No 2003988 dated 10042024.exe 89 PID 2032 wrote to memory of 2248 2032 proforma invoice No 2003988 dated 10042024.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice No 2003988 dated 10042024.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice No 2003988 dated 10042024.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\proforma invoice No 2003988 dated 10042024.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice No 2003988 dated 10042024.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2248
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4280,i,10065386245627775856,6567048529106473151,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:81⤵PID:1112
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5000
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1828
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
4Credentials In Files
3Credentials in Registry
1