Analysis
-
max time kernel
140s -
max time network
143s -
platform
windows10_x64 -
resource
win10 -
submitted
08-07-2020 06:58
Static task
static1
Behavioral task
behavioral1
Sample
Quote JQ2341024749.pdf.exe
Resource
win7
General
-
Target
Quote JQ2341024749.pdf.exe
-
Size
708KB
-
MD5
26a528a86cad4a65522eba4db40f5014
-
SHA1
37c01731625dd9f5000cd33b449e8c6ebcba470b
-
SHA256
de77f2b2fe58ab75b2a6876cc9883d59330766559847223284d764b74d88df12
-
SHA512
644f192b771c9435698cb60a803eb08281cf7ff82db82f2a2bc5defd58f81cc9ef06446a37795babdb3d07aeb83ced36081bb2624c37c756f03b3cc490487a7a
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
us2.smtp.mailhostbox.com - Port:
587 - Username:
[email protected] - Password:
sOeKk#E6
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/3280-3-0x0000000000400000-0x00000000004A4000-memory.dmp family_agenttesla behavioral2/memory/3280-4-0x0000000000980000-0x00000000009CC000-memory.dmp family_agenttesla -
Processes:
resource yara_rule behavioral2/memory/3280-0-0x0000000000400000-0x00000000004A4000-memory.dmp upx behavioral2/memory/3280-2-0x0000000000400000-0x00000000004A4000-memory.dmp upx behavioral2/memory/3280-3-0x0000000000400000-0x00000000004A4000-memory.dmp upx -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
Quote JQ2341024749.pdf.exedescription pid process target process PID 3820 set thread context of 3280 3820 Quote JQ2341024749.pdf.exe Quote JQ2341024749.pdf.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
Quote JQ2341024749.pdf.exeQuote JQ2341024749.pdf.exepid process 3820 Quote JQ2341024749.pdf.exe 3820 Quote JQ2341024749.pdf.exe 3280 Quote JQ2341024749.pdf.exe 3280 Quote JQ2341024749.pdf.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
Quote JQ2341024749.pdf.exepid process 3820 Quote JQ2341024749.pdf.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Quote JQ2341024749.pdf.exedescription pid process Token: SeDebugPrivilege 3280 Quote JQ2341024749.pdf.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
Quote JQ2341024749.pdf.exedescription pid process target process PID 3820 wrote to memory of 3280 3820 Quote JQ2341024749.pdf.exe Quote JQ2341024749.pdf.exe PID 3820 wrote to memory of 3280 3820 Quote JQ2341024749.pdf.exe Quote JQ2341024749.pdf.exe PID 3820 wrote to memory of 3280 3820 Quote JQ2341024749.pdf.exe Quote JQ2341024749.pdf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Quote JQ2341024749.pdf.exe"C:\Users\Admin\AppData\Local\Temp\Quote JQ2341024749.pdf.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Quote JQ2341024749.pdf.exe"C:\Users\Admin\AppData\Local\Temp\Quote JQ2341024749.pdf.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3280-0-0x0000000000400000-0x00000000004A4000-memory.dmpFilesize
656KB
-
memory/3280-1-0x00000000004A23A0-mapping.dmp
-
memory/3280-2-0x0000000000400000-0x00000000004A4000-memory.dmpFilesize
656KB
-
memory/3280-3-0x0000000000400000-0x00000000004A4000-memory.dmpFilesize
656KB
-
memory/3280-4-0x0000000000980000-0x00000000009CC000-memory.dmpFilesize
304KB
-
memory/3280-5-0x00000000009D2000-0x00000000009D3000-memory.dmpFilesize
4KB