Analysis
-
max time kernel
137s -
max time network
16s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
11-05-2021 11:05
Static task
static1
Behavioral task
behavioral1
Sample
PO#011.PDF.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
PO#011.PDF.exe
Resource
win10v20210408
General
-
Target
PO#011.PDF.exe
-
Size
901KB
-
MD5
98957c57335fcefd5dce687b2eb7c248
-
SHA1
8f3893d501e48d7c582f1de1f321f8ac24338262
-
SHA256
b3d0bf9251e4c9e7643d80a95dc7ed46e06f062610c3f3cbcebb8ba8343ecede
-
SHA512
61ab71fae09b8f7fa28f9c7cdc055f28f91bd72367fa39c752ca95d1e5168e51ed64dcbe1bd72b6c0dd570ddb7b5ca8b954331ce3b61e705b7151db0660e9f89
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.flourmillsindia.com - Port:
587 - Username:
sales@flourmillsindia.com - Password:
Swastik@1
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/868-68-0x000000000043751E-mapping.dmp family_agenttesla behavioral1/memory/868-67-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla behavioral1/memory/868-69-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
PO#011.PDF.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\RXhUFA = "C:\\Users\\Admin\\AppData\\Roaming\\RXhUFA\\RXhUFA.exe" PO#011.PDF.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
PO#011.PDF.exedescription pid process target process PID 1788 set thread context of 868 1788 PO#011.PDF.exe PO#011.PDF.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
PO#011.PDF.exepid process 868 PO#011.PDF.exe 868 PO#011.PDF.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
PO#011.PDF.exedescription pid process Token: SeDebugPrivilege 868 PO#011.PDF.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
PO#011.PDF.exedescription pid process target process PID 1788 wrote to memory of 1044 1788 PO#011.PDF.exe schtasks.exe PID 1788 wrote to memory of 1044 1788 PO#011.PDF.exe schtasks.exe PID 1788 wrote to memory of 1044 1788 PO#011.PDF.exe schtasks.exe PID 1788 wrote to memory of 1044 1788 PO#011.PDF.exe schtasks.exe PID 1788 wrote to memory of 868 1788 PO#011.PDF.exe PO#011.PDF.exe PID 1788 wrote to memory of 868 1788 PO#011.PDF.exe PO#011.PDF.exe PID 1788 wrote to memory of 868 1788 PO#011.PDF.exe PO#011.PDF.exe PID 1788 wrote to memory of 868 1788 PO#011.PDF.exe PO#011.PDF.exe PID 1788 wrote to memory of 868 1788 PO#011.PDF.exe PO#011.PDF.exe PID 1788 wrote to memory of 868 1788 PO#011.PDF.exe PO#011.PDF.exe PID 1788 wrote to memory of 868 1788 PO#011.PDF.exe PO#011.PDF.exe PID 1788 wrote to memory of 868 1788 PO#011.PDF.exe PO#011.PDF.exe PID 1788 wrote to memory of 868 1788 PO#011.PDF.exe PO#011.PDF.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PO#011.PDF.exe"C:\Users\Admin\AppData\Local\Temp\PO#011.PDF.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\QWibalCwxQG" /XML "C:\Users\Admin\AppData\Local\Temp\tmp50AF.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\PO#011.PDF.exe"C:\Users\Admin\AppData\Local\Temp\PO#011.PDF.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp50AF.tmpMD5
7c1f9bfb117e1ef05b7c4950599182a0
SHA1a14e9028bc2b96e965fc9f01e9f01fc96e695266
SHA256f6a340af01304a45c0069e182f4c3dca7d01bb16bf9da14c3a7b43e5377447a0
SHA512fa4f3bac0e4ecdb43a230e64a00cd1b6d623b802c4768aad517d12ad870182526063bd990298f56ca48a06c59f2047bf140e8190e70e4a74ae053253c9864e55
-
memory/868-68-0x000000000043751E-mapping.dmp
-
memory/868-67-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/868-69-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/868-71-0x0000000004B30000-0x0000000004B31000-memory.dmpFilesize
4KB
-
memory/1044-65-0x0000000000000000-mapping.dmp
-
memory/1788-59-0x0000000000170000-0x0000000000171000-memory.dmpFilesize
4KB
-
memory/1788-61-0x0000000004CB0000-0x0000000004CB1000-memory.dmpFilesize
4KB
-
memory/1788-62-0x0000000000600000-0x0000000000604000-memory.dmpFilesize
16KB
-
memory/1788-63-0x0000000005120000-0x00000000051E9000-memory.dmpFilesize
804KB
-
memory/1788-64-0x00000000051F0000-0x0000000005283000-memory.dmpFilesize
588KB