Analysis
-
max time kernel
146s -
max time network
148s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
11-05-2021 11:10
Static task
static1
Behavioral task
behavioral1
Sample
PO#6275473 pdf.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
PO#6275473 pdf.exe
Resource
win10v20210410
General
-
Target
PO#6275473 pdf.exe
-
Size
880KB
-
MD5
02d84808b070f7232a96a2dfbdf77be9
-
SHA1
35f15873b331fbd261c3ff3a39388616d99a1782
-
SHA256
6f88a4bdf6ca9a0b63e8dca6b56c2431acaccb7b58a6ddf5166028756c172d5a
-
SHA512
761945b6c916f5914204208a9df32c08620e588c568015c594e3b9aca61851df78f56769c56609685855e760254edd9f1e15bf4f0b346cb472ff2e8319b5f771
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.esquiresweaters.com - Port:
587 - Username:
imam@esquiresweaters.com - Password:
Esquire@#2078
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/2008-117-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla behavioral2/memory/2008-118-0x000000000043752E-mapping.dmp family_agenttesla behavioral2/memory/2008-120-0x0000000000BE0000-0x0000000000D2A000-memory.dmp family_agenttesla -
Suspicious use of SetThreadContext 1 IoCs
Processes:
PO#6275473 pdf.exedescription pid process target process PID 3876 set thread context of 2008 3876 PO#6275473 pdf.exe PO#6275473 pdf.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
PO#6275473 pdf.exePO#6275473 pdf.exepid process 3876 PO#6275473 pdf.exe 3876 PO#6275473 pdf.exe 3876 PO#6275473 pdf.exe 2008 PO#6275473 pdf.exe 2008 PO#6275473 pdf.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
PO#6275473 pdf.exePO#6275473 pdf.exedescription pid process Token: SeDebugPrivilege 3876 PO#6275473 pdf.exe Token: SeDebugPrivilege 2008 PO#6275473 pdf.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
PO#6275473 pdf.exedescription pid process target process PID 3876 wrote to memory of 4024 3876 PO#6275473 pdf.exe schtasks.exe PID 3876 wrote to memory of 4024 3876 PO#6275473 pdf.exe schtasks.exe PID 3876 wrote to memory of 4024 3876 PO#6275473 pdf.exe schtasks.exe PID 3876 wrote to memory of 4060 3876 PO#6275473 pdf.exe PO#6275473 pdf.exe PID 3876 wrote to memory of 4060 3876 PO#6275473 pdf.exe PO#6275473 pdf.exe PID 3876 wrote to memory of 4060 3876 PO#6275473 pdf.exe PO#6275473 pdf.exe PID 3876 wrote to memory of 2008 3876 PO#6275473 pdf.exe PO#6275473 pdf.exe PID 3876 wrote to memory of 2008 3876 PO#6275473 pdf.exe PO#6275473 pdf.exe PID 3876 wrote to memory of 2008 3876 PO#6275473 pdf.exe PO#6275473 pdf.exe PID 3876 wrote to memory of 2008 3876 PO#6275473 pdf.exe PO#6275473 pdf.exe PID 3876 wrote to memory of 2008 3876 PO#6275473 pdf.exe PO#6275473 pdf.exe PID 3876 wrote to memory of 2008 3876 PO#6275473 pdf.exe PO#6275473 pdf.exe PID 3876 wrote to memory of 2008 3876 PO#6275473 pdf.exe PO#6275473 pdf.exe PID 3876 wrote to memory of 2008 3876 PO#6275473 pdf.exe PO#6275473 pdf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PO#6275473 pdf.exe"C:\Users\Admin\AppData\Local\Temp\PO#6275473 pdf.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VjWRclFPprX" /XML "C:\Users\Admin\AppData\Local\Temp\tmpACCB.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\PO#6275473 pdf.exe"C:\Users\Admin\AppData\Local\Temp\PO#6275473 pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PO#6275473 pdf.exe"C:\Users\Admin\AppData\Local\Temp\PO#6275473 pdf.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpACCB.tmpMD5
7d45d034a34be2a3085bd7553155546d
SHA145eca0cde45b03fe216c1c6ad9f450b9799bc3dd
SHA256029345b104e3954f908215e00227bc86830b4a660202ea85096e927e431d7325
SHA512562db6456aa653cf6617be9832adfa5ca94cd0c4586e7434eafec2e35485d82b0fc7e06d3e43be9e677f449bdba4fd93872a0f25b47f1d51a6466f7a47080e66
-
memory/2008-117-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/2008-118-0x000000000043752E-mapping.dmp
-
memory/2008-119-0x0000000000BE0000-0x0000000000D2A000-memory.dmpFilesize
1.3MB
-
memory/2008-120-0x0000000000BE0000-0x0000000000D2A000-memory.dmpFilesize
1.3MB
-
memory/3876-114-0x00000000005F0000-0x00000000005F1000-memory.dmpFilesize
4KB
-
memory/4024-115-0x0000000000000000-mapping.dmp