Analysis
-
max time kernel
84s -
max time network
75s -
platform
windows7_x64 -
resource
win7 -
submitted
30-06-2020 12:26
Static task
static1
Behavioral task
behavioral1
Sample
Purchase Order.PDF.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Purchase Order.PDF.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
-
Target
Purchase Order.PDF.exe
-
Size
416KB
-
MD5
64d28b8dbfcee3ecfe724b7b0eb930a0
-
SHA1
6d522d6372b7ed6bad0535f809345b5f207d1db1
-
SHA256
9bf34a347324254e98e309990bcc487c6bb53f4cb3a44b401290d1cea114b1cc
-
SHA512
d484dade1af20b36bbd7b7dbb94b41454c79ffc8bcbf76e3bf6ff4c100926ce2fbd37935f4a1265a0ba85bd61ba8bfcbe7fa61a06ac86e0a41fd65b9505c5b14
Score
10/10
Malware Config
Extracted
Family
agenttesla
Credentials
Protocol: smtp- Host:
smtp.bapipl.com - Port:
587 - Username:
skc@bapipl.com - Password:
Bharat123
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/316-0-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla behavioral1/memory/316-1-0x000000000044778E-mapping.dmp family_agenttesla behavioral1/memory/316-2-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla behavioral1/memory/316-3-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Purchase Order.PDF.exedescription pid process target process PID 1104 set thread context of 316 1104 Purchase Order.PDF.exe RegSvcs.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
Purchase Order.PDF.exeRegSvcs.exepid process 1104 Purchase Order.PDF.exe 316 RegSvcs.exe 316 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Purchase Order.PDF.exeRegSvcs.exedescription pid process Token: SeDebugPrivilege 1104 Purchase Order.PDF.exe Token: SeDebugPrivilege 316 RegSvcs.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
Purchase Order.PDF.exedescription pid process target process PID 1104 wrote to memory of 316 1104 Purchase Order.PDF.exe RegSvcs.exe PID 1104 wrote to memory of 316 1104 Purchase Order.PDF.exe RegSvcs.exe PID 1104 wrote to memory of 316 1104 Purchase Order.PDF.exe RegSvcs.exe PID 1104 wrote to memory of 316 1104 Purchase Order.PDF.exe RegSvcs.exe PID 1104 wrote to memory of 316 1104 Purchase Order.PDF.exe RegSvcs.exe PID 1104 wrote to memory of 316 1104 Purchase Order.PDF.exe RegSvcs.exe PID 1104 wrote to memory of 316 1104 Purchase Order.PDF.exe RegSvcs.exe PID 1104 wrote to memory of 316 1104 Purchase Order.PDF.exe RegSvcs.exe PID 1104 wrote to memory of 316 1104 Purchase Order.PDF.exe RegSvcs.exe PID 1104 wrote to memory of 316 1104 Purchase Order.PDF.exe RegSvcs.exe PID 1104 wrote to memory of 316 1104 Purchase Order.PDF.exe RegSvcs.exe PID 1104 wrote to memory of 316 1104 Purchase Order.PDF.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Purchase Order.PDF.exe"C:\Users\Admin\AppData\Local\Temp\Purchase Order.PDF.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/316-0-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/316-1-0x000000000044778E-mapping.dmp
-
memory/316-2-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/316-3-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB