Analysis
-
max time kernel
131s -
max time network
122s -
platform
windows10_x64 -
resource
win10 -
submitted
13-07-2020 11:27
Static task
static1
Behavioral task
behavioral1
Sample
Order10049274pdf.exe
Resource
win7
Behavioral task
behavioral2
Sample
Order10049274pdf.exe
Resource
win10
General
-
Target
Order10049274pdf.exe
-
Size
328KB
-
MD5
c71732b7a6d89bac55bf2f525c6a3a2f
-
SHA1
8d5b4f6a236b84075f987a01e470350837c35d1c
-
SHA256
85d34a30b3163b6db32ec267c22e5fd5cbfab30533aa4a829f9d79ca55e779d2
-
SHA512
eb89ebbc51bcceac01edfe399916385abfa7db20bfcd23f6bad0b915a1e3822df3f70b97661b6f92bd1b6eb7f4d4112422ad71a5026c14e2eba80a81a94e6686
Malware Config
Extracted
Protocol: smtp- Host:
webmail.saritatravels.com - Port:
587 - Username:
[email protected] - Password:
sameerb%$321
Extracted
agenttesla
Protocol: smtp- Host:
webmail.saritatravels.com - Port:
587 - Username:
[email protected] - Password:
sameerb%$321
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/1548-2-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla behavioral2/memory/1548-3-0x0000000000446EFE-mapping.dmp family_agenttesla -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
Order10049274pdf.exedescription pid process target process PID 364 set thread context of 1548 364 Order10049274pdf.exe Order10049274pdf.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
Order10049274pdf.exeOrder10049274pdf.exepid process 364 Order10049274pdf.exe 1548 Order10049274pdf.exe 1548 Order10049274pdf.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Order10049274pdf.exeOrder10049274pdf.exedescription pid process Token: SeDebugPrivilege 364 Order10049274pdf.exe Token: SeDebugPrivilege 1548 Order10049274pdf.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Order10049274pdf.exepid process 1548 Order10049274pdf.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
Order10049274pdf.exedescription pid process target process PID 364 wrote to memory of 1232 364 Order10049274pdf.exe schtasks.exe PID 364 wrote to memory of 1232 364 Order10049274pdf.exe schtasks.exe PID 364 wrote to memory of 1232 364 Order10049274pdf.exe schtasks.exe PID 364 wrote to memory of 1548 364 Order10049274pdf.exe Order10049274pdf.exe PID 364 wrote to memory of 1548 364 Order10049274pdf.exe Order10049274pdf.exe PID 364 wrote to memory of 1548 364 Order10049274pdf.exe Order10049274pdf.exe PID 364 wrote to memory of 1548 364 Order10049274pdf.exe Order10049274pdf.exe PID 364 wrote to memory of 1548 364 Order10049274pdf.exe Order10049274pdf.exe PID 364 wrote to memory of 1548 364 Order10049274pdf.exe Order10049274pdf.exe PID 364 wrote to memory of 1548 364 Order10049274pdf.exe Order10049274pdf.exe PID 364 wrote to memory of 1548 364 Order10049274pdf.exe Order10049274pdf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Order10049274pdf.exe"C:\Users\Admin\AppData\Local\Temp\Order10049274pdf.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:364 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\LIVtvxl" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2D01.tmp"2⤵
- Creates scheduled task(s)
PID:1232 -
C:\Users\Admin\AppData\Local\Temp\Order10049274pdf.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1548
-
C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exeC:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe1⤵PID:1008
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\Order10049274pdf.exe.logMD5
c33b4293a0023b388d1a816aba4901f1
SHA1a793fe7d4694457873aa26a454a5d4b0207d7d54
SHA2565b4a63ea1ce7cc18eb1be775ffb52b342bb678f265c88d4518d8e1fe44a55234
SHA512d04308b55218a71bd09562de76a8030e6327fb0143695e01cb25fb5ad6a9b3715425e4782dc5d27b0aaaf0d71048f0886099df6ce87e29e796abe3727fd1ba53
-
C:\Users\Admin\AppData\Local\Temp\tmp2D01.tmpMD5
a55700887954ace9704a3e5aaec7d853
SHA1812f06670e0b8b2d77ecffa188cd1ce3300736df
SHA256aba7f2e41c77422a5d30c9f2d73573d64fef82fb4e0c0a634aa4db24136dc296
SHA5129c4ca4ee6c2bcbd9a6c968d214efda2c9c8c27dd2c278fc4168f4ef2e06efb28d71f09eb74d1b4d5bd92ac7c17f5a2fa0c50c4425878c40f4abf0cca293f4d2d
-
memory/1232-0-0x0000000000000000-mapping.dmp
-
memory/1548-2-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1548-3-0x0000000000446EFE-mapping.dmp