Analysis
-
max time kernel
144s -
max time network
41s -
platform
windows7_x64 -
resource
win7v200430 -
submitted
24-06-2020 13:14
Static task
static1
Behavioral task
behavioral1
Sample
Bank details.pdf.xlx.bat.exe
Resource
win7v200430
Behavioral task
behavioral2
Sample
Bank details.pdf.xlx.bat.exe
Resource
win10
General
-
Target
Bank details.pdf.xlx.bat.exe
-
Size
458KB
-
MD5
cfe564351e6b4077a2408967ed77deec
-
SHA1
a2601f58f3659593da9c113b05a082d79b10cd73
-
SHA256
3fed11bcfa0ec80fa94626f65c9b397d2117782bc5efae636e3ee0462ca9e42d
-
SHA512
1ffcb47e15b9e373340820fcf2fb357bd61b8d7f407e2575a2944e65472264dbde235a83a403a988efb4e6b9cae4a01f2cac558790b12006bf71046db424b347
Malware Config
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
Bank details.pdf.xlx.bat.exepid process 1252 Bank details.pdf.xlx.bat.exe 1252 Bank details.pdf.xlx.bat.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Bank details.pdf.xlx.bat.exedescription pid process Token: SeDebugPrivilege 1252 Bank details.pdf.xlx.bat.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
Bank details.pdf.xlx.bat.exedescription pid process target process PID 1252 wrote to memory of 580 1252 Bank details.pdf.xlx.bat.exe netsh.exe PID 1252 wrote to memory of 580 1252 Bank details.pdf.xlx.bat.exe netsh.exe PID 1252 wrote to memory of 580 1252 Bank details.pdf.xlx.bat.exe netsh.exe PID 1252 wrote to memory of 580 1252 Bank details.pdf.xlx.bat.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Bank details.pdf.xlx.bat.exe"C:\Users\Admin\AppData\Local\Temp\Bank details.pdf.xlx.bat.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exe"netsh" wlan show profile2⤵