Analysis
-
max time kernel
115s -
max time network
60s -
platform
windows7_x64 -
resource
win7 -
submitted
13-07-2020 06:43
Static task
static1
Behavioral task
behavioral1
Sample
RFQ PO-05612020_pdf.exe
Resource
win7
Behavioral task
behavioral2
Sample
RFQ PO-05612020_pdf.exe
Resource
win10
General
-
Target
RFQ PO-05612020_pdf.exe
-
Size
351KB
-
MD5
1b752bcc97d601f051ee22881b4ae85c
-
SHA1
6a94e417c140c64bb2d45955eba08efe72cc89e5
-
SHA256
ee2a89fa1ed80e14eb7fc1a74780d480c574307d0d40aac90c22e8ab7d8b9332
-
SHA512
657f470688c9b4ba1756be778991fd7dec0ca18f24e1ef04686101461269d4c1a43107ee80e3ea646137ff4e8d33ae06b617f36736f9ef3170ce43552fe45868
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.anding-tw.com - Port:
587 - Username:
[email protected] - Password:
7#Sjsj*ebT+2
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1820-4-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla behavioral1/memory/1820-5-0x00000000004471DE-mapping.dmp family_agenttesla behavioral1/memory/1820-6-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla behavioral1/memory/1820-7-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
RFQ PO-05612020_pdf.exedescription pid process target process PID 1492 set thread context of 1820 1492 RFQ PO-05612020_pdf.exe RFQ PO-05612020_pdf.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
RFQ PO-05612020_pdf.exeRFQ PO-05612020_pdf.exepid process 1492 RFQ PO-05612020_pdf.exe 1492 RFQ PO-05612020_pdf.exe 1492 RFQ PO-05612020_pdf.exe 1820 RFQ PO-05612020_pdf.exe 1820 RFQ PO-05612020_pdf.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
RFQ PO-05612020_pdf.exeRFQ PO-05612020_pdf.exedescription pid process Token: SeDebugPrivilege 1492 RFQ PO-05612020_pdf.exe Token: SeDebugPrivilege 1820 RFQ PO-05612020_pdf.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
RFQ PO-05612020_pdf.exepid process 1820 RFQ PO-05612020_pdf.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
RFQ PO-05612020_pdf.exedescription pid process target process PID 1492 wrote to memory of 1908 1492 RFQ PO-05612020_pdf.exe schtasks.exe PID 1492 wrote to memory of 1908 1492 RFQ PO-05612020_pdf.exe schtasks.exe PID 1492 wrote to memory of 1908 1492 RFQ PO-05612020_pdf.exe schtasks.exe PID 1492 wrote to memory of 1908 1492 RFQ PO-05612020_pdf.exe schtasks.exe PID 1492 wrote to memory of 1916 1492 RFQ PO-05612020_pdf.exe RFQ PO-05612020_pdf.exe PID 1492 wrote to memory of 1916 1492 RFQ PO-05612020_pdf.exe RFQ PO-05612020_pdf.exe PID 1492 wrote to memory of 1916 1492 RFQ PO-05612020_pdf.exe RFQ PO-05612020_pdf.exe PID 1492 wrote to memory of 1916 1492 RFQ PO-05612020_pdf.exe RFQ PO-05612020_pdf.exe PID 1492 wrote to memory of 1820 1492 RFQ PO-05612020_pdf.exe RFQ PO-05612020_pdf.exe PID 1492 wrote to memory of 1820 1492 RFQ PO-05612020_pdf.exe RFQ PO-05612020_pdf.exe PID 1492 wrote to memory of 1820 1492 RFQ PO-05612020_pdf.exe RFQ PO-05612020_pdf.exe PID 1492 wrote to memory of 1820 1492 RFQ PO-05612020_pdf.exe RFQ PO-05612020_pdf.exe PID 1492 wrote to memory of 1820 1492 RFQ PO-05612020_pdf.exe RFQ PO-05612020_pdf.exe PID 1492 wrote to memory of 1820 1492 RFQ PO-05612020_pdf.exe RFQ PO-05612020_pdf.exe PID 1492 wrote to memory of 1820 1492 RFQ PO-05612020_pdf.exe RFQ PO-05612020_pdf.exe PID 1492 wrote to memory of 1820 1492 RFQ PO-05612020_pdf.exe RFQ PO-05612020_pdf.exe PID 1492 wrote to memory of 1820 1492 RFQ PO-05612020_pdf.exe RFQ PO-05612020_pdf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\RFQ PO-05612020_pdf.exe"C:\Users\Admin\AppData\Local\Temp\RFQ PO-05612020_pdf.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eigcTrcoftsfms" /XML "C:\Users\Admin\AppData\Local\Temp\tmpFE4B.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\RFQ PO-05612020_pdf.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\RFQ PO-05612020_pdf.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpFE4B.tmpMD5
179f61a5ac6f22944b6ecfcd9b71070a
SHA10856783d07afafb8fe4ffcb6083bbfb51fa7a890
SHA256ec3e585877a31c01b5528507f1c1ec47f1db8c6ef38e50b71b228f1f51de17ee
SHA512cfd22e7b9bc94f58b73eeb6bc1b4ca89a1928b186056222193f43081ff51ff6d81e72c56f1070cb646b52dc0354f6f590f99b4a1e9c62e46d6a78cb4b5fb84b8
-
memory/1492-1-0x0000000000000000-0x0000000000000000-disk.dmp
-
memory/1820-4-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1820-5-0x00000000004471DE-mapping.dmp
-
memory/1820-6-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1820-7-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1908-2-0x0000000000000000-mapping.dmp