Analysis
-
max time kernel
118s -
max time network
53s -
platform
windows7_x64 -
resource
win7 -
submitted
13-07-2020 11:27
Static task
static1
Behavioral task
behavioral1
Sample
Order10049274pdf.exe
Resource
win7
Behavioral task
behavioral2
Sample
Order10049274pdf.exe
Resource
win10
General
-
Target
Order10049274pdf.exe
-
Size
328KB
-
MD5
c71732b7a6d89bac55bf2f525c6a3a2f
-
SHA1
8d5b4f6a236b84075f987a01e470350837c35d1c
-
SHA256
85d34a30b3163b6db32ec267c22e5fd5cbfab30533aa4a829f9d79ca55e779d2
-
SHA512
eb89ebbc51bcceac01edfe399916385abfa7db20bfcd23f6bad0b915a1e3822df3f70b97661b6f92bd1b6eb7f4d4112422ad71a5026c14e2eba80a81a94e6686
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
webmail.saritatravels.com - Port:
587 - Username:
[email protected] - Password:
sameerb%$321
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1792-3-0x0000000000446EFE-mapping.dmp family_agenttesla behavioral1/memory/1792-2-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla behavioral1/memory/1792-4-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla behavioral1/memory/1792-5-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
Order10049274pdf.exedescription pid process target process PID 1156 set thread context of 1792 1156 Order10049274pdf.exe Order10049274pdf.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
Order10049274pdf.exepid process 1792 Order10049274pdf.exe 1792 Order10049274pdf.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Order10049274pdf.exedescription pid process Token: SeDebugPrivilege 1792 Order10049274pdf.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Order10049274pdf.exepid process 1792 Order10049274pdf.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
Order10049274pdf.exedescription pid process target process PID 1156 wrote to memory of 1720 1156 Order10049274pdf.exe schtasks.exe PID 1156 wrote to memory of 1720 1156 Order10049274pdf.exe schtasks.exe PID 1156 wrote to memory of 1720 1156 Order10049274pdf.exe schtasks.exe PID 1156 wrote to memory of 1720 1156 Order10049274pdf.exe schtasks.exe PID 1156 wrote to memory of 1792 1156 Order10049274pdf.exe Order10049274pdf.exe PID 1156 wrote to memory of 1792 1156 Order10049274pdf.exe Order10049274pdf.exe PID 1156 wrote to memory of 1792 1156 Order10049274pdf.exe Order10049274pdf.exe PID 1156 wrote to memory of 1792 1156 Order10049274pdf.exe Order10049274pdf.exe PID 1156 wrote to memory of 1792 1156 Order10049274pdf.exe Order10049274pdf.exe PID 1156 wrote to memory of 1792 1156 Order10049274pdf.exe Order10049274pdf.exe PID 1156 wrote to memory of 1792 1156 Order10049274pdf.exe Order10049274pdf.exe PID 1156 wrote to memory of 1792 1156 Order10049274pdf.exe Order10049274pdf.exe PID 1156 wrote to memory of 1792 1156 Order10049274pdf.exe Order10049274pdf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Order10049274pdf.exe"C:\Users\Admin\AppData\Local\Temp\Order10049274pdf.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1156 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\LIVtvxl" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4411.tmp"2⤵
- Creates scheduled task(s)
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\Order10049274pdf.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1792
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp4411.tmpMD5
c10a68bb9de6fce5635d1c871ded0e70
SHA1e99070a26594d9b6f2f702fa69b57f3df45e6745
SHA256c03616633d90de98549cdcdeb92286025deb226e5d1124358791f7b62e64af0c
SHA51299701dbb0c8b99b605d6bc87ee46e4eaad6054d5dbf7ca2c22c5571584145efd16e1be9560047b05cb47b58711c2af94815eb1c61074413cccae1869fa3594ff
-
memory/1720-0-0x0000000000000000-mapping.dmp
-
memory/1792-3-0x0000000000446EFE-mapping.dmp
-
memory/1792-2-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1792-4-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1792-5-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB