Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
11-05-2021 12:24
Static task
static1
Behavioral task
behavioral1
Sample
Swift Copy.pdf.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
Swift Copy.pdf.exe
Resource
win10v20210408
General
-
Target
Swift Copy.pdf.exe
-
Size
889KB
-
MD5
dd2eb46743bf230998439673e3deba99
-
SHA1
4871d34e0db77e32f627e74b92e9a9fbdef7a21a
-
SHA256
ab417e35533138c082445ac1997401837c2be3af4527860f3b5c30dcabd325cb
-
SHA512
9ddf626833dc5551ad869214590c23b11e8ca16bc37959608c960f283bfef027b451a8f7fabff9d0678d24cabf2de12a509c8a75e524643cf29faf2a1d275b33
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.saudimedlabexpo.com - Port:
587 - Username:
info@saudimedlabexpo.com - Password:
]dTqP-]^T]Pt
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/1968-139-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla behavioral2/memory/1968-140-0x00000000004375BE-mapping.dmp family_agenttesla behavioral2/memory/1968-146-0x0000000005090000-0x000000000558E000-memory.dmp family_agenttesla -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
Swift Copy.pdf.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\pGKuRU = "C:\\Users\\Admin\\AppData\\Roaming\\pGKuRU\\pGKuRU.exe" Swift Copy.pdf.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Swift Copy.pdf.exedescription pid process target process PID 1456 set thread context of 1968 1456 Swift Copy.pdf.exe Swift Copy.pdf.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
Swift Copy.pdf.exepowershell.exepowershell.exeSwift Copy.pdf.exepowershell.exepid process 1456 Swift Copy.pdf.exe 1548 powershell.exe 2540 powershell.exe 1968 Swift Copy.pdf.exe 1968 Swift Copy.pdf.exe 2524 powershell.exe 2524 powershell.exe 1548 powershell.exe 2540 powershell.exe 2540 powershell.exe 2524 powershell.exe 1548 powershell.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
powershell.exepowershell.exeSwift Copy.pdf.exeSwift Copy.pdf.exepowershell.exedescription pid process Token: SeDebugPrivilege 2540 powershell.exe Token: SeDebugPrivilege 1548 powershell.exe Token: SeDebugPrivilege 1456 Swift Copy.pdf.exe Token: SeDebugPrivilege 1968 Swift Copy.pdf.exe Token: SeDebugPrivilege 2524 powershell.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
Swift Copy.pdf.exedescription pid process target process PID 1456 wrote to memory of 1548 1456 Swift Copy.pdf.exe powershell.exe PID 1456 wrote to memory of 1548 1456 Swift Copy.pdf.exe powershell.exe PID 1456 wrote to memory of 1548 1456 Swift Copy.pdf.exe powershell.exe PID 1456 wrote to memory of 2540 1456 Swift Copy.pdf.exe powershell.exe PID 1456 wrote to memory of 2540 1456 Swift Copy.pdf.exe powershell.exe PID 1456 wrote to memory of 2540 1456 Swift Copy.pdf.exe powershell.exe PID 1456 wrote to memory of 1872 1456 Swift Copy.pdf.exe schtasks.exe PID 1456 wrote to memory of 1872 1456 Swift Copy.pdf.exe schtasks.exe PID 1456 wrote to memory of 1872 1456 Swift Copy.pdf.exe schtasks.exe PID 1456 wrote to memory of 2524 1456 Swift Copy.pdf.exe powershell.exe PID 1456 wrote to memory of 2524 1456 Swift Copy.pdf.exe powershell.exe PID 1456 wrote to memory of 2524 1456 Swift Copy.pdf.exe powershell.exe PID 1456 wrote to memory of 1968 1456 Swift Copy.pdf.exe Swift Copy.pdf.exe PID 1456 wrote to memory of 1968 1456 Swift Copy.pdf.exe Swift Copy.pdf.exe PID 1456 wrote to memory of 1968 1456 Swift Copy.pdf.exe Swift Copy.pdf.exe PID 1456 wrote to memory of 1968 1456 Swift Copy.pdf.exe Swift Copy.pdf.exe PID 1456 wrote to memory of 1968 1456 Swift Copy.pdf.exe Swift Copy.pdf.exe PID 1456 wrote to memory of 1968 1456 Swift Copy.pdf.exe Swift Copy.pdf.exe PID 1456 wrote to memory of 1968 1456 Swift Copy.pdf.exe Swift Copy.pdf.exe PID 1456 wrote to memory of 1968 1456 Swift Copy.pdf.exe Swift Copy.pdf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Swift Copy.pdf.exe"C:\Users\Admin\AppData\Local\Temp\Swift Copy.pdf.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Swift Copy.pdf.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\DXGWcUXNvU.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\DXGWcUXNvU" /XML "C:\Users\Admin\AppData\Local\Temp\tmp510A.tmp"2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\DXGWcUXNvU.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Swift Copy.pdf.exe"C:\Users\Admin\AppData\Local\Temp\Swift Copy.pdf.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logMD5
1c19c16e21c97ed42d5beabc93391fc5
SHA18ad83f8e0b3acf8dfbbf87931e41f0d664c4df68
SHA2561bcd97396c83babfe6c5068ba590d7a3f8b70e72955a9d1e4070648e404cbf05
SHA5127d18776d8f649b3d29c182ff03efc6cea8b527542ee55304980f24577aae8b64e37044407776e220984346c3998ace5f8853afa58c8b38407482a728e9495e0c
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveMD5
479707254a5b32c3e17e756b3d1373ca
SHA18d1d540058c936745c04c2fc1df03875e19336cd
SHA256323956ccfa9438663d00caddbeda5fcf8ca7e2803db01f51dfec607ff9b1f11b
SHA51200853fff7b16363b74f39af46a319fb88f071087568dc45d18e1e83fe9fd21341d8914dd24bda6ac54e23f1326ac4d131516c916437687c6ac4cd4ea5fac28cc
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveMD5
479707254a5b32c3e17e756b3d1373ca
SHA18d1d540058c936745c04c2fc1df03875e19336cd
SHA256323956ccfa9438663d00caddbeda5fcf8ca7e2803db01f51dfec607ff9b1f11b
SHA51200853fff7b16363b74f39af46a319fb88f071087568dc45d18e1e83fe9fd21341d8914dd24bda6ac54e23f1326ac4d131516c916437687c6ac4cd4ea5fac28cc
-
C:\Users\Admin\AppData\Local\Temp\tmp510A.tmpMD5
9cdcc06e4e8aae4d7f8c61e1d7a6c37c
SHA110698f119f8d20fb9cace4da1e697a746c9d74c0
SHA256f1e0248eac465e8a2f91b5d5136b15985816a4fed58d6e1463889170da126607
SHA5127df84e8a1fc52f373915b705b4c2713d31b361118efbbf1457c29700a47ee560dd1b09e218d51dcd9c27f6f738c3287f5564e16adb1e0e0831df548bfa17b953
-
memory/1456-121-0x0000000005B60000-0x0000000005B61000-memory.dmpFilesize
4KB
-
memory/1456-120-0x0000000005890000-0x0000000005891000-memory.dmpFilesize
4KB
-
memory/1456-119-0x00000000059A0000-0x0000000005E9E000-memory.dmpFilesize
5.0MB
-
memory/1456-122-0x0000000005B10000-0x0000000005B14000-memory.dmpFilesize
16KB
-
memory/1456-123-0x00000000067A0000-0x0000000006868000-memory.dmpFilesize
800KB
-
memory/1456-124-0x0000000008D30000-0x0000000008DC0000-memory.dmpFilesize
576KB
-
memory/1456-118-0x00000000059A0000-0x00000000059A1000-memory.dmpFilesize
4KB
-
memory/1456-117-0x0000000005EA0000-0x0000000005EA1000-memory.dmpFilesize
4KB
-
memory/1456-116-0x0000000005900000-0x0000000005901000-memory.dmpFilesize
4KB
-
memory/1456-114-0x0000000000FA0000-0x0000000000FA1000-memory.dmpFilesize
4KB
-
memory/1548-144-0x00000000045E2000-0x00000000045E3000-memory.dmpFilesize
4KB
-
memory/1548-192-0x000000007EE60000-0x000000007EE61000-memory.dmpFilesize
4KB
-
memory/1548-125-0x0000000000000000-mapping.dmp
-
memory/1548-128-0x00000000045E0000-0x00000000045E1000-memory.dmpFilesize
4KB
-
memory/1548-129-0x0000000004540000-0x0000000004541000-memory.dmpFilesize
4KB
-
memory/1548-197-0x00000000045E3000-0x00000000045E4000-memory.dmpFilesize
4KB
-
memory/1548-130-0x00000000071A0000-0x00000000071A1000-memory.dmpFilesize
4KB
-
memory/1548-173-0x0000000008040000-0x0000000008041000-memory.dmpFilesize
4KB
-
memory/1548-167-0x0000000007130000-0x0000000007131000-memory.dmpFilesize
4KB
-
memory/1548-164-0x0000000007940000-0x0000000007941000-memory.dmpFilesize
4KB
-
memory/1548-161-0x00000000078D0000-0x00000000078D1000-memory.dmpFilesize
4KB
-
memory/1548-158-0x0000000007050000-0x0000000007051000-memory.dmpFilesize
4KB
-
memory/1548-155-0x0000000006FB0000-0x0000000006FB1000-memory.dmpFilesize
4KB
-
memory/1872-132-0x0000000000000000-mapping.dmp
-
memory/1968-146-0x0000000005090000-0x000000000558E000-memory.dmpFilesize
5.0MB
-
memory/1968-139-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1968-140-0x00000000004375BE-mapping.dmp
-
memory/2524-195-0x00000000069F3000-0x00000000069F4000-memory.dmpFilesize
4KB
-
memory/2524-193-0x000000007EAF0000-0x000000007EAF1000-memory.dmpFilesize
4KB
-
memory/2524-154-0x00000000069F2000-0x00000000069F3000-memory.dmpFilesize
4KB
-
memory/2524-150-0x00000000069F0000-0x00000000069F1000-memory.dmpFilesize
4KB
-
memory/2524-138-0x0000000000000000-mapping.dmp
-
memory/2540-170-0x0000000008270000-0x0000000008271000-memory.dmpFilesize
4KB
-
memory/2540-148-0x0000000004A80000-0x0000000004A81000-memory.dmpFilesize
4KB
-
memory/2540-194-0x000000007EB20000-0x000000007EB21000-memory.dmpFilesize
4KB
-
memory/2540-196-0x0000000004A83000-0x0000000004A84000-memory.dmpFilesize
4KB
-
memory/2540-152-0x0000000004A82000-0x0000000004A83000-memory.dmpFilesize
4KB
-
memory/2540-131-0x0000000000000000-mapping.dmp