Analysis
-
max time kernel
84s -
max time network
119s -
platform
windows10_x64 -
resource
win10 -
submitted
30-06-2020 12:26
Static task
static1
Behavioral task
behavioral1
Sample
Purchase Order.PDF.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Purchase Order.PDF.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
-
Target
Purchase Order.PDF.exe
-
Size
416KB
-
MD5
64d28b8dbfcee3ecfe724b7b0eb930a0
-
SHA1
6d522d6372b7ed6bad0535f809345b5f207d1db1
-
SHA256
9bf34a347324254e98e309990bcc487c6bb53f4cb3a44b401290d1cea114b1cc
-
SHA512
d484dade1af20b36bbd7b7dbb94b41454c79ffc8bcbf76e3bf6ff4c100926ce2fbd37935f4a1265a0ba85bd61ba8bfcbe7fa61a06ac86e0a41fd65b9505c5b14
Score
10/10
Malware Config
Extracted
Family
agenttesla
Credentials
Protocol: smtp- Host:
smtp.bapipl.com - Port:
587 - Username:
skc@bapipl.com - Password:
Bharat123
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/3888-0-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla behavioral2/memory/3888-1-0x000000000044778E-mapping.dmp family_agenttesla -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Purchase Order.PDF.exedescription pid process target process PID 3828 set thread context of 3888 3828 Purchase Order.PDF.exe RegSvcs.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
RegSvcs.exepid process 3888 RegSvcs.exe 3888 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RegSvcs.exedescription pid process Token: SeDebugPrivilege 3888 RegSvcs.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
Purchase Order.PDF.exedescription pid process target process PID 3828 wrote to memory of 3888 3828 Purchase Order.PDF.exe RegSvcs.exe PID 3828 wrote to memory of 3888 3828 Purchase Order.PDF.exe RegSvcs.exe PID 3828 wrote to memory of 3888 3828 Purchase Order.PDF.exe RegSvcs.exe PID 3828 wrote to memory of 3888 3828 Purchase Order.PDF.exe RegSvcs.exe PID 3828 wrote to memory of 3888 3828 Purchase Order.PDF.exe RegSvcs.exe PID 3828 wrote to memory of 3888 3828 Purchase Order.PDF.exe RegSvcs.exe PID 3828 wrote to memory of 3888 3828 Purchase Order.PDF.exe RegSvcs.exe PID 3828 wrote to memory of 3888 3828 Purchase Order.PDF.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Purchase Order.PDF.exe"C:\Users\Admin\AppData\Local\Temp\Purchase Order.PDF.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken