Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
11-05-2021 11:10
Static task
static1
Behavioral task
behavioral1
Sample
PO#6275473 pdf.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
PO#6275473 pdf.exe
Resource
win10v20210410
General
-
Target
PO#6275473 pdf.exe
-
Size
880KB
-
MD5
02d84808b070f7232a96a2dfbdf77be9
-
SHA1
35f15873b331fbd261c3ff3a39388616d99a1782
-
SHA256
6f88a4bdf6ca9a0b63e8dca6b56c2431acaccb7b58a6ddf5166028756c172d5a
-
SHA512
761945b6c916f5914204208a9df32c08620e588c568015c594e3b9aca61851df78f56769c56609685855e760254edd9f1e15bf4f0b346cb472ff2e8319b5f771
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.esquiresweaters.com - Port:
587 - Username:
[email protected] - Password:
Esquire@#2078
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1888-65-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla behavioral1/memory/1888-66-0x000000000043752E-mapping.dmp family_agenttesla -
Suspicious use of SetThreadContext 1 IoCs
Processes:
PO#6275473 pdf.exedescription pid process target process PID 1948 set thread context of 1888 1948 PO#6275473 pdf.exe PO#6275473 pdf.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
PO#6275473 pdf.exePO#6275473 pdf.exepid process 1948 PO#6275473 pdf.exe 1888 PO#6275473 pdf.exe 1888 PO#6275473 pdf.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
PO#6275473 pdf.exePO#6275473 pdf.exedescription pid process Token: SeDebugPrivilege 1948 PO#6275473 pdf.exe Token: SeDebugPrivilege 1888 PO#6275473 pdf.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
PO#6275473 pdf.exePO#6275473 pdf.exedescription pid process target process PID 1948 wrote to memory of 996 1948 PO#6275473 pdf.exe schtasks.exe PID 1948 wrote to memory of 996 1948 PO#6275473 pdf.exe schtasks.exe PID 1948 wrote to memory of 996 1948 PO#6275473 pdf.exe schtasks.exe PID 1948 wrote to memory of 996 1948 PO#6275473 pdf.exe schtasks.exe PID 1948 wrote to memory of 1888 1948 PO#6275473 pdf.exe PO#6275473 pdf.exe PID 1948 wrote to memory of 1888 1948 PO#6275473 pdf.exe PO#6275473 pdf.exe PID 1948 wrote to memory of 1888 1948 PO#6275473 pdf.exe PO#6275473 pdf.exe PID 1948 wrote to memory of 1888 1948 PO#6275473 pdf.exe PO#6275473 pdf.exe PID 1948 wrote to memory of 1888 1948 PO#6275473 pdf.exe PO#6275473 pdf.exe PID 1948 wrote to memory of 1888 1948 PO#6275473 pdf.exe PO#6275473 pdf.exe PID 1948 wrote to memory of 1888 1948 PO#6275473 pdf.exe PO#6275473 pdf.exe PID 1948 wrote to memory of 1888 1948 PO#6275473 pdf.exe PO#6275473 pdf.exe PID 1948 wrote to memory of 1888 1948 PO#6275473 pdf.exe PO#6275473 pdf.exe PID 1888 wrote to memory of 1640 1888 PO#6275473 pdf.exe dw20.exe PID 1888 wrote to memory of 1640 1888 PO#6275473 pdf.exe dw20.exe PID 1888 wrote to memory of 1640 1888 PO#6275473 pdf.exe dw20.exe PID 1888 wrote to memory of 1640 1888 PO#6275473 pdf.exe dw20.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PO#6275473 pdf.exe"C:\Users\Admin\AppData\Local\Temp\PO#6275473 pdf.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VjWRclFPprX" /XML "C:\Users\Admin\AppData\Local\Temp\tmp25C9.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\PO#6275473 pdf.exe"C:\Users\Admin\AppData\Local\Temp\PO#6275473 pdf.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 5203⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp25C9.tmpMD5
fad273acf6173847a4c15c7cbcf99d2b
SHA143e722df41d1d8ed0ebd93aa4c54ef9fae0894a4
SHA25633f7245a9597cd27e9c8314bc17653e17de63f6aad2af973766084ca1aca446f
SHA51266ebc016fcd4652f2583c0b1347c5a604b6535dbd16eaff6cd24cd46b938fa3d27bd3cbff849ea5fdb649192af25aab7335b1c9099766f5f17a9a5271d36d712
-
memory/996-63-0x0000000000000000-mapping.dmp
-
memory/1640-69-0x0000000000000000-mapping.dmp
-
memory/1640-71-0x0000000001E70000-0x0000000001E71000-memory.dmpFilesize
4KB
-
memory/1888-65-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1888-66-0x000000000043752E-mapping.dmp
-
memory/1888-68-0x0000000002100000-0x0000000002101000-memory.dmpFilesize
4KB
-
memory/1948-60-0x0000000075511000-0x0000000075513000-memory.dmpFilesize
8KB
-
memory/1948-61-0x0000000000170000-0x0000000000171000-memory.dmpFilesize
4KB
-
memory/1948-62-0x0000000000171000-0x0000000000172000-memory.dmpFilesize
4KB