Analysis
- max time kernel
106s - max time network
108s - platform
windows11-21h2_x64 - resource
win11-20250502-en - resource tags
- submitted
19/05/2025, 06:35
General
- Target Bank_Payment_Copy_TRF_RED#2504225.pdf.exe
- Size 1.1MB
- Sample250519-hcf5lstm13
- SHA256 6584f13ecd514b59ef380f0fa106ef5f6ef53e2bb39e0da02947e83de62f6444
Malware Config
Extracted
-
Protocol
ftp
-
Host
ftp.haliza.com.my
-
Port
21
-
Username
-
Password
JesusChrist007$
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Agenttesla family
- Drops startup file 1 IoCs
- Executes dropped EXE 3 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
- Suspicious use of SetThreadContext 1 IoCs
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: MapViewOfSection 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 16 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Bank_Payment_Copy_TRF_RED#2504225.pdf.exe"C:\Users\Admin\AppData\Local\Temp\Bank_Payment_Copy_TRF_RED#2504225.pdf.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\miaou\quinquennia.exe"C:\Users\Admin\AppData\Local\Temp\Bank_Payment_Copy_TRF_RED#2504225.pdf.exe"2⤵
- Drops startup file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\Bank_Payment_Copy_TRF_RED#2504225.pdf.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\miaou\quinquennia.exe"C:\Users\Admin\AppData\Local\miaou\quinquennia.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\miaou\quinquennia.exe"4⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2900 -s 7564⤵
- Program crash
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2900 -ip 29001⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\sgxIb\sgxIb.exe1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\sgxIb\sgxIb.exeC:\Users\Admin\AppData\Roaming\sgxIb\sgxIb.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
aut9E82.tmp
quinquennia.exe
sgxIb.exe
memory/1328-8-0x00000000016F0000-0x0000000001AF0000-memory.dmp
memory/1552-75-0x0000000005220000-0x000000000526F000-memory.dmp
memory/1552-97-0x0000000005220000-0x000000000526F000-memory.dmp
memory/1552-37-0x0000000000400000-0x0000000000447000-memory.dmp
memory/1552-38-0x0000000000400000-0x0000000000447000-memory.dmp
memory/1552-39-0x0000000005160000-0x00000000051B6000-memory.dmp
memory/1552-40-0x0000000005790000-0x0000000005D36000-memory.dmp
memory/1552-41-0x0000000005220000-0x0000000005274000-memory.dmp
memory/1552-49-0x0000000005220000-0x000000000526F000-memory.dmp
memory/1552-71-0x0000000005220000-0x000000000526F000-memory.dmp
memory/1552-67-0x0000000005220000-0x000000000526F000-memory.dmp
memory/1552-69-0x0000000005220000-0x000000000526F000-memory.dmp
memory/1552-95-0x0000000005220000-0x000000000526F000-memory.dmp
memory/1552-93-0x0000000005220000-0x000000000526F000-memory.dmp
memory/1552-91-0x0000000005220000-0x000000000526F000-memory.dmp
memory/1552-89-0x0000000005220000-0x000000000526F000-memory.dmp
memory/1552-87-0x0000000005220000-0x000000000526F000-memory.dmp
memory/1552-85-0x0000000005220000-0x000000000526F000-memory.dmp
memory/1552-83-0x0000000005220000-0x000000000526F000-memory.dmp
memory/1552-81-0x0000000005220000-0x000000000526F000-memory.dmp
memory/1552-79-0x0000000005220000-0x000000000526F000-memory.dmp
memory/1552-77-0x0000000005220000-0x000000000526F000-memory.dmp
memory/1552-35-0x0000000000400000-0x0000000000447000-memory.dmp
memory/1552-36-0x0000000000400000-0x0000000000447000-memory.dmp
memory/1552-73-0x0000000005220000-0x000000000526F000-memory.dmp
memory/1552-99-0x0000000005220000-0x000000000526F000-memory.dmp
memory/1552-65-0x0000000005220000-0x000000000526F000-memory.dmp
memory/1552-63-0x0000000005220000-0x000000000526F000-memory.dmp
memory/1552-61-0x0000000005220000-0x000000000526F000-memory.dmp
memory/1552-59-0x0000000005220000-0x000000000526F000-memory.dmp
memory/1552-57-0x0000000005220000-0x000000000526F000-memory.dmp
memory/1552-55-0x0000000005220000-0x000000000526F000-memory.dmp
memory/1552-53-0x0000000005220000-0x000000000526F000-memory.dmp
memory/1552-51-0x0000000005220000-0x000000000526F000-memory.dmp
memory/1552-101-0x0000000005220000-0x000000000526F000-memory.dmp
memory/1552-43-0x0000000005220000-0x000000000526F000-memory.dmp
memory/1552-42-0x0000000005220000-0x000000000526F000-memory.dmp
memory/1552-47-0x0000000005220000-0x000000000526F000-memory.dmp
memory/1552-45-0x0000000005220000-0x000000000526F000-memory.dmp
memory/1552-1140-0x00000000053E0000-0x0000000005446000-memory.dmp
memory/1552-1152-0x0000000006820000-0x000000000682A000-memory.dmp
memory/1552-1151-0x0000000006850000-0x00000000068E2000-memory.dmp
memory/1552-1150-0x0000000000400000-0x0000000000447000-memory.dmp
memory/1552-1149-0x0000000006700000-0x0000000006750000-memory.dmp
memory/2900-34-0x00000000033F0000-0x00000000034F0000-memory.dmp
memory/3752-1145-0x0000000000900000-0x000000000090E000-memory.dmp
memory/3752-1146-0x00000000051C0000-0x00000000051FC000-memory.dmp
memory/3752-1147-0x0000000002D20000-0x0000000002D41000-memory.dmp
memory/4236-22-0x0000000001880000-0x0000000001C80000-memory.dmp