Analysis
-
max time kernel
117s -
max time network
122s -
platform
windows7_x64 -
resource
win7 -
submitted
09-07-2020 12:13
Static task
static1
Behavioral task
behavioral1
Sample
PDF.New order.exe
Resource
win7
Behavioral task
behavioral2
Sample
PDF.New order.exe
Resource
win10
General
-
Target
PDF.New order.exe
-
Size
571KB
-
MD5
b4a67408bac84f6f0280dd23ca072ed0
-
SHA1
488ef4e8228dcec6621589751fafef6b2a7945e1
-
SHA256
9886dbd251a349a2675e4b0bd53a0b24bed7858541d955f0c7449c6a5e15e4ee
-
SHA512
c8239327dd70bb96fd6d5b15609468c8d254d684163e22eb1bb0f9eb2f68e9abe91578b30ea330f23b2bf552ac768f80d8a525fa960910d25260a24a95dce8ba
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.orientalkuwait.com - Port:
587 - Username:
[email protected] - Password:
Operatingmanager1&
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1512-4-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla behavioral1/memory/1512-5-0x0000000000446EDE-mapping.dmp family_agenttesla behavioral1/memory/1512-6-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla behavioral1/memory/1512-7-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
PDF.New order.exedescription pid process target process PID 1552 set thread context of 1512 1552 PDF.New order.exe PDF.New order.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
PDF.New order.exePDF.New order.exepid process 1552 PDF.New order.exe 1552 PDF.New order.exe 1512 PDF.New order.exe 1512 PDF.New order.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
PDF.New order.exePDF.New order.exedescription pid process Token: SeDebugPrivilege 1552 PDF.New order.exe Token: SeDebugPrivilege 1512 PDF.New order.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
PDF.New order.exedescription pid process target process PID 1552 wrote to memory of 324 1552 PDF.New order.exe schtasks.exe PID 1552 wrote to memory of 324 1552 PDF.New order.exe schtasks.exe PID 1552 wrote to memory of 324 1552 PDF.New order.exe schtasks.exe PID 1552 wrote to memory of 324 1552 PDF.New order.exe schtasks.exe PID 1552 wrote to memory of 1516 1552 PDF.New order.exe PDF.New order.exe PID 1552 wrote to memory of 1516 1552 PDF.New order.exe PDF.New order.exe PID 1552 wrote to memory of 1516 1552 PDF.New order.exe PDF.New order.exe PID 1552 wrote to memory of 1516 1552 PDF.New order.exe PDF.New order.exe PID 1552 wrote to memory of 1512 1552 PDF.New order.exe PDF.New order.exe PID 1552 wrote to memory of 1512 1552 PDF.New order.exe PDF.New order.exe PID 1552 wrote to memory of 1512 1552 PDF.New order.exe PDF.New order.exe PID 1552 wrote to memory of 1512 1552 PDF.New order.exe PDF.New order.exe PID 1552 wrote to memory of 1512 1552 PDF.New order.exe PDF.New order.exe PID 1552 wrote to memory of 1512 1552 PDF.New order.exe PDF.New order.exe PID 1552 wrote to memory of 1512 1552 PDF.New order.exe PDF.New order.exe PID 1552 wrote to memory of 1512 1552 PDF.New order.exe PDF.New order.exe PID 1552 wrote to memory of 1512 1552 PDF.New order.exe PDF.New order.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PDF.New order.exe"C:\Users\Admin\AppData\Local\Temp\PDF.New order.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1552 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\dDNWtHLI" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8EC7.tmp"2⤵
- Creates scheduled task(s)
PID:324 -
C:\Users\Admin\AppData\Local\Temp\PDF.New order.exe"{path}"2⤵PID:1516
-
C:\Users\Admin\AppData\Local\Temp\PDF.New order.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1512
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
ef70f8c60b6d2217efc7d087e2730fec
SHA1050d3010b236ca398618f8c3accedd7af87b8a88
SHA2563526b88896c32f72cc9b17de3f87d87f96a0bf24c50d73ae2965469ab9b0820c
SHA5120b0083197d1b2309a648a4c472a4605846c53e8d456f2d58d03d978dbda38800f46113ce6e81567af2018b188b50c117013cf92fec536ce61965eb0ea568b99c