Analysis

  • max time kernel
    141s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/10/2024, 10:03

General

  • Target

    Proforma Invoice.scr.exe

  • Size

    13KB

  • MD5

    3efcf6123cc2697d54be8e8d17f70eb6

  • SHA1

    194d4304e6fbea7bcc5203d9f5dd7c0883277fb1

  • SHA256

    a05acadb64d5923e931a42aecca755b6a160b39f96ec1bff8611cd5116b4c926

  • SHA512

    73ac5727e012611904ca6be764a92db67cbea082cdaca37017e1b6db04fee6bae884aaf82dcf4eb36094012463dcfd0b5beecfc36048d87db01f17dafe7c32a9

  • SSDEEP

    192:Z6F7KvWISi8OXTjyr4mikpAfQZz/IJCKVxmy:ZZNSEDjyHikpAIZz/In

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot7245016847:AAHTGgEGytVrrQCnyNC6RGvqcnPdZoR0H5U/

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Agenttesla family
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Drops startup file 1 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3432
      • C:\Users\Admin\AppData\Local\Temp\Proforma Invoice.scr.exe
        "C:\Users\Admin\AppData\Local\Temp\Proforma Invoice.scr.exe"
        2⤵
        • Suspicious use of NtCreateUserProcessOtherParentProcess
        • Drops startup file
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1176
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:2308

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/1176-0-0x000000007470E000-0x000000007470F000-memory.dmp

            Filesize

            4KB

          • memory/1176-1-0x0000000000FA0000-0x0000000000FA8000-memory.dmp

            Filesize

            32KB

          • memory/1176-2-0x0000000074700000-0x0000000074EB0000-memory.dmp

            Filesize

            7.7MB

          • memory/1176-3-0x0000000006D10000-0x0000000006E0A000-memory.dmp

            Filesize

            1000KB

          • memory/1176-4-0x00000000073C0000-0x0000000007964000-memory.dmp

            Filesize

            5.6MB

          • memory/1176-5-0x0000000006EC0000-0x0000000006F52000-memory.dmp

            Filesize

            584KB

          • memory/1176-6-0x0000000006D10000-0x0000000006E03000-memory.dmp

            Filesize

            972KB

          • memory/1176-17-0x0000000006D10000-0x0000000006E03000-memory.dmp

            Filesize

            972KB

          • memory/1176-23-0x0000000006D10000-0x0000000006E03000-memory.dmp

            Filesize

            972KB

          • memory/1176-21-0x0000000006D10000-0x0000000006E03000-memory.dmp

            Filesize

            972KB

          • memory/1176-19-0x0000000006D10000-0x0000000006E03000-memory.dmp

            Filesize

            972KB

          • memory/1176-15-0x0000000006D10000-0x0000000006E03000-memory.dmp

            Filesize

            972KB

          • memory/1176-13-0x0000000006D10000-0x0000000006E03000-memory.dmp

            Filesize

            972KB

          • memory/1176-11-0x0000000006D10000-0x0000000006E03000-memory.dmp

            Filesize

            972KB

          • memory/1176-9-0x0000000006D10000-0x0000000006E03000-memory.dmp

            Filesize

            972KB

          • memory/1176-7-0x0000000006D10000-0x0000000006E03000-memory.dmp

            Filesize

            972KB

          • memory/1176-25-0x000000007470E000-0x000000007470F000-memory.dmp

            Filesize

            4KB

          • memory/1176-40-0x0000000006D10000-0x0000000006E03000-memory.dmp

            Filesize

            972KB

          • memory/1176-66-0x0000000006D10000-0x0000000006E03000-memory.dmp

            Filesize

            972KB

          • memory/1176-70-0x0000000006D10000-0x0000000006E03000-memory.dmp

            Filesize

            972KB

          • memory/1176-68-0x0000000006D10000-0x0000000006E03000-memory.dmp

            Filesize

            972KB

          • memory/1176-64-0x0000000006D10000-0x0000000006E03000-memory.dmp

            Filesize

            972KB

          • memory/1176-62-0x0000000006D10000-0x0000000006E03000-memory.dmp

            Filesize

            972KB

          • memory/1176-60-0x0000000006D10000-0x0000000006E03000-memory.dmp

            Filesize

            972KB

          • memory/1176-58-0x0000000006D10000-0x0000000006E03000-memory.dmp

            Filesize

            972KB

          • memory/1176-56-0x0000000006D10000-0x0000000006E03000-memory.dmp

            Filesize

            972KB

          • memory/1176-54-0x0000000006D10000-0x0000000006E03000-memory.dmp

            Filesize

            972KB

          • memory/1176-52-0x0000000006D10000-0x0000000006E03000-memory.dmp

            Filesize

            972KB

          • memory/1176-50-0x0000000006D10000-0x0000000006E03000-memory.dmp

            Filesize

            972KB

          • memory/1176-48-0x0000000006D10000-0x0000000006E03000-memory.dmp

            Filesize

            972KB

          • memory/1176-46-0x0000000006D10000-0x0000000006E03000-memory.dmp

            Filesize

            972KB

          • memory/1176-44-0x0000000006D10000-0x0000000006E03000-memory.dmp

            Filesize

            972KB

          • memory/1176-38-0x0000000006D10000-0x0000000006E03000-memory.dmp

            Filesize

            972KB

          • memory/1176-36-0x0000000006D10000-0x0000000006E03000-memory.dmp

            Filesize

            972KB

          • memory/1176-34-0x0000000006D10000-0x0000000006E03000-memory.dmp

            Filesize

            972KB

          • memory/1176-32-0x0000000006D10000-0x0000000006E03000-memory.dmp

            Filesize

            972KB

          • memory/1176-30-0x0000000006D10000-0x0000000006E03000-memory.dmp

            Filesize

            972KB

          • memory/1176-28-0x0000000006D10000-0x0000000006E03000-memory.dmp

            Filesize

            972KB

          • memory/1176-26-0x0000000006D10000-0x0000000006E03000-memory.dmp

            Filesize

            972KB

          • memory/1176-42-0x0000000006D10000-0x0000000006E03000-memory.dmp

            Filesize

            972KB

          • memory/1176-258-0x0000000074700000-0x0000000074EB0000-memory.dmp

            Filesize

            7.7MB

          • memory/1176-1082-0x0000000074700000-0x0000000074EB0000-memory.dmp

            Filesize

            7.7MB

          • memory/1176-1083-0x0000000007030000-0x000000000709C000-memory.dmp

            Filesize

            432KB

          • memory/1176-1084-0x0000000006F60000-0x0000000006FAC000-memory.dmp

            Filesize

            304KB

          • memory/1176-1088-0x0000000074700000-0x0000000074EB0000-memory.dmp

            Filesize

            7.7MB

          • memory/1176-1089-0x0000000074700000-0x0000000074EB0000-memory.dmp

            Filesize

            7.7MB

          • memory/1176-1090-0x0000000074700000-0x0000000074EB0000-memory.dmp

            Filesize

            7.7MB

          • memory/1176-1091-0x0000000074700000-0x0000000074EB0000-memory.dmp

            Filesize

            7.7MB

          • memory/1176-1092-0x0000000074700000-0x0000000074EB0000-memory.dmp

            Filesize

            7.7MB

          • memory/1176-1093-0x0000000006240000-0x0000000006294000-memory.dmp

            Filesize

            336KB

          • memory/1176-1097-0x0000000074700000-0x0000000074EB0000-memory.dmp

            Filesize

            7.7MB

          • memory/2308-1098-0x0000000074700000-0x0000000074EB0000-memory.dmp

            Filesize

            7.7MB

          • memory/2308-1099-0x0000000000400000-0x0000000000444000-memory.dmp

            Filesize

            272KB

          • memory/2308-1100-0x00000000052C0000-0x0000000005326000-memory.dmp

            Filesize

            408KB

          • memory/2308-1101-0x0000000074700000-0x0000000074EB0000-memory.dmp

            Filesize

            7.7MB

          • memory/2308-1102-0x00000000066D0000-0x0000000006720000-memory.dmp

            Filesize

            320KB

          • memory/2308-1103-0x00000000067C0000-0x000000000685C000-memory.dmp

            Filesize

            624KB

          • memory/2308-1104-0x0000000006890000-0x000000000689A000-memory.dmp

            Filesize

            40KB

          • memory/2308-1105-0x0000000074700000-0x0000000074EB0000-memory.dmp

            Filesize

            7.7MB