Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
147s -
platform
windows10_x64 -
resource
win10v200430 -
submitted
09/07/2020, 05:31
Static task
static1
Behavioral task
behavioral1
Sample
Urgent PO.pdf.exe
Resource
win7
General
-
Target
Urgent PO.pdf.exe
-
Size
920KB
-
MD5
c6e88afdd984ebbb05d56fe6c491cd2d
-
SHA1
f89284ef042e2fc9d46f15ceb5f4340d3b1168a6
-
SHA256
edd3a9064d9828a06d55be4ea729afe1847c1ea5190287469ee8ed2088c018b0
-
SHA512
e65eb2204563e5adc959f5e33d68f56c3a6a59108c1d7f9ddecb7efbaadcaf14c7ff8f039ebc72c890651554b8c16670ce319a18ab4eaed8c22f83053eccb2f3
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.yandex.ru - Port:
587 - Username:
[email protected] - Password:
kingmoney12345
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 2 IoCs
resource yara_rule behavioral2/memory/420-3-0x0000000000400000-0x00000000004A4000-memory.dmp family_agenttesla behavioral2/memory/420-4-0x00000000021B0000-0x00000000021FC000-memory.dmp family_agenttesla -
resource yara_rule behavioral2/memory/420-0-0x0000000000400000-0x00000000004A4000-memory.dmp upx behavioral2/memory/420-2-0x0000000000400000-0x00000000004A4000-memory.dmp upx behavioral2/memory/420-3-0x0000000000400000-0x00000000004A4000-memory.dmp upx -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3692 set thread context of 420 3692 Urgent PO.pdf.exe 66 -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3692 Urgent PO.pdf.exe 3692 Urgent PO.pdf.exe 420 Urgent PO.pdf.exe 420 Urgent PO.pdf.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 3692 Urgent PO.pdf.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 420 Urgent PO.pdf.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3692 wrote to memory of 420 3692 Urgent PO.pdf.exe 66 PID 3692 wrote to memory of 420 3692 Urgent PO.pdf.exe 66 PID 3692 wrote to memory of 420 3692 Urgent PO.pdf.exe 66
Processes
-
C:\Users\Admin\AppData\Local\Temp\Urgent PO.pdf.exe"C:\Users\Admin\AppData\Local\Temp\Urgent PO.pdf.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3692 -
C:\Users\Admin\AppData\Local\Temp\Urgent PO.pdf.exe"C:\Users\Admin\AppData\Local\Temp\Urgent PO.pdf.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:420
-