Analysis
-
max time kernel
109s -
max time network
146s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
11-05-2021 11:05
Static task
static1
Behavioral task
behavioral1
Sample
Transfer1096-20_736289_PDF.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
Transfer1096-20_736289_PDF.exe
Resource
win10v20210410
General
-
Target
Transfer1096-20_736289_PDF.exe
-
Size
973KB
-
MD5
cfb6d7cd819b64c8c3088e5c9004712e
-
SHA1
4f233fd6e38c06f035064665fe15e6374bee382d
-
SHA256
eb0801ae0c61475a74fbc4bbe7c89df02fd2e2473f80b31e562af202f4dc8378
-
SHA512
1209a084204d3eb15ca40174b7223befb29f349a235af61bde0452715fd7f4f1ddca31b1c8338e2bb87ef67f41ecfe92a3e811c240ed63c46d4f82ddf3cb9add
Malware Config
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1816-66-0x0000000004E80000-0x0000000004EFB000-memory.dmp family_agenttesla -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Transfer1096-20_736289_PDF.exedescription pid process target process PID 1816 set thread context of 796 1816 Transfer1096-20_736289_PDF.exe Transfer1096-20_736289_PDF.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Transfer1096-20_736289_PDF.exedescription pid process Token: SeDebugPrivilege 1816 Transfer1096-20_736289_PDF.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
Transfer1096-20_736289_PDF.exepid process 796 Transfer1096-20_736289_PDF.exe 796 Transfer1096-20_736289_PDF.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
Transfer1096-20_736289_PDF.exedescription pid process target process PID 1816 wrote to memory of 796 1816 Transfer1096-20_736289_PDF.exe Transfer1096-20_736289_PDF.exe PID 1816 wrote to memory of 796 1816 Transfer1096-20_736289_PDF.exe Transfer1096-20_736289_PDF.exe PID 1816 wrote to memory of 796 1816 Transfer1096-20_736289_PDF.exe Transfer1096-20_736289_PDF.exe PID 1816 wrote to memory of 796 1816 Transfer1096-20_736289_PDF.exe Transfer1096-20_736289_PDF.exe PID 1816 wrote to memory of 796 1816 Transfer1096-20_736289_PDF.exe Transfer1096-20_736289_PDF.exe PID 1816 wrote to memory of 796 1816 Transfer1096-20_736289_PDF.exe Transfer1096-20_736289_PDF.exe PID 1816 wrote to memory of 796 1816 Transfer1096-20_736289_PDF.exe Transfer1096-20_736289_PDF.exe PID 1816 wrote to memory of 796 1816 Transfer1096-20_736289_PDF.exe Transfer1096-20_736289_PDF.exe PID 1816 wrote to memory of 796 1816 Transfer1096-20_736289_PDF.exe Transfer1096-20_736289_PDF.exe PID 1816 wrote to memory of 796 1816 Transfer1096-20_736289_PDF.exe Transfer1096-20_736289_PDF.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Transfer1096-20_736289_PDF.exe"C:\Users\Admin\AppData\Local\Temp\Transfer1096-20_736289_PDF.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Transfer1096-20_736289_PDF.exe"C:\Users\Admin\AppData\Local\Temp\Transfer1096-20_736289_PDF.exe"2⤵
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/796-67-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/796-68-0x0000000000403670-mapping.dmp
-
memory/796-72-0x0000000074D91000-0x0000000074D93000-memory.dmpFilesize
8KB
-
memory/796-73-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1816-60-0x0000000000BF0000-0x0000000000BF1000-memory.dmpFilesize
4KB
-
memory/1816-62-0x00000000002C0000-0x00000000002C4000-memory.dmpFilesize
16KB
-
memory/1816-63-0x00000000045E0000-0x00000000045E1000-memory.dmpFilesize
4KB
-
memory/1816-64-0x00000000051F0000-0x00000000052CC000-memory.dmpFilesize
880KB
-
memory/1816-65-0x00000000077B0000-0x0000000007885000-memory.dmpFilesize
852KB
-
memory/1816-66-0x0000000004E80000-0x0000000004EFB000-memory.dmpFilesize
492KB