Analysis
-
max time kernel
77s -
max time network
63s -
platform
windows7_x64 -
resource
win7 -
submitted
07-07-2020 13:24
Static task
static1
Behavioral task
behavioral1
Sample
documents.pdf.exe
Resource
win7
Behavioral task
behavioral2
Sample
documents.pdf.exe
Resource
win10
General
-
Target
documents.pdf.exe
-
Size
475KB
-
MD5
a99bef1b35e748c7f914b6020e45a26a
-
SHA1
127ea995117e17b0253b0e193b04ad7310a4ac54
-
SHA256
86199dfe35e6b54df16a4ffae4e58d3acd8bab4e821e5f286ed799df406f0e75
-
SHA512
81af90ed8f5ea87c2d8b476b0fe29388913c5d0ef7ddc927610677b00514514b3fe2c788b712d8bf8c9593c97cc02563e08b828a22bdd1e44c44e0caac9dd56a
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
documents.pdf.exedescription pid process target process PID 1108 wrote to memory of 1488 1108 documents.pdf.exe documents.pdf.exe PID 1108 wrote to memory of 1488 1108 documents.pdf.exe documents.pdf.exe PID 1108 wrote to memory of 1488 1108 documents.pdf.exe documents.pdf.exe PID 1108 wrote to memory of 1488 1108 documents.pdf.exe documents.pdf.exe PID 1108 wrote to memory of 1488 1108 documents.pdf.exe documents.pdf.exe PID 1108 wrote to memory of 1488 1108 documents.pdf.exe documents.pdf.exe PID 1108 wrote to memory of 1488 1108 documents.pdf.exe documents.pdf.exe PID 1108 wrote to memory of 1488 1108 documents.pdf.exe documents.pdf.exe PID 1108 wrote to memory of 1488 1108 documents.pdf.exe documents.pdf.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
documents.pdf.exepid process 1488 documents.pdf.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
documents.pdf.exedescription pid process target process PID 1108 set thread context of 1488 1108 documents.pdf.exe documents.pdf.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
documents.pdf.exedescription pid process Token: SeDebugPrivilege 1488 documents.pdf.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
documents.pdf.exepid process 1488 documents.pdf.exe 1488 documents.pdf.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
Processes
-
C:\Users\Admin\AppData\Local\Temp\documents.pdf.exe"C:\Users\Admin\AppData\Local\Temp\documents.pdf.exe"1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\documents.pdf.exe"{path}"2⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1488-0-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1488-1-0x000000000044701E-mapping.dmp
-
memory/1488-2-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1488-3-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB