Analysis
-
max time kernel
124s -
max time network
140s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
19-10-2021 09:52
Static task
static1
Behavioral task
behavioral1
Sample
Proforma Invoice PDF.exe
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
Proforma Invoice PDF.exe
Resource
win10-en-20210920
General
-
Target
Proforma Invoice PDF.exe
-
Size
82KB
-
MD5
e77c819969d8520d9bbd027dd1bfaa04
-
SHA1
27d6482b5777767e98838d5dd2e9d431e2f3ae97
-
SHA256
6fa5cdc1c01f21f752a968277cb495f3bf83b9171456b83483be4d5d4cea543d
-
SHA512
de26847a6cc7244ecf566ab2e3126ab27f14b86a8404f30871fc0606fcac8e2dec21c2552c777e7faa945136343e0999c5017e015d72ab79990c5373d40f5748
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
kerekesfoto.com - Port:
587 - Username:
[email protected] - Password:
admin@abc123
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/1888-121-0x000000000043760E-mapping.dmp family_agenttesla behavioral2/memory/1888-120-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla -
Downloads MZ/PE file
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
aspnet_compiler.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 aspnet_compiler.exe Key opened \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 aspnet_compiler.exe Key opened \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 aspnet_compiler.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Proforma Invoice PDF.exedescription pid process target process PID 1684 set thread context of 1888 1684 Proforma Invoice PDF.exe aspnet_compiler.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
aspnet_compiler.exepid process 1888 aspnet_compiler.exe 1888 aspnet_compiler.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Proforma Invoice PDF.exeaspnet_compiler.exedescription pid process Token: SeDebugPrivilege 1684 Proforma Invoice PDF.exe Token: SeDebugPrivilege 1888 aspnet_compiler.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
aspnet_compiler.exepid process 1888 aspnet_compiler.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
Proforma Invoice PDF.exedescription pid process target process PID 1684 wrote to memory of 1888 1684 Proforma Invoice PDF.exe aspnet_compiler.exe PID 1684 wrote to memory of 1888 1684 Proforma Invoice PDF.exe aspnet_compiler.exe PID 1684 wrote to memory of 1888 1684 Proforma Invoice PDF.exe aspnet_compiler.exe PID 1684 wrote to memory of 1888 1684 Proforma Invoice PDF.exe aspnet_compiler.exe PID 1684 wrote to memory of 1888 1684 Proforma Invoice PDF.exe aspnet_compiler.exe PID 1684 wrote to memory of 1888 1684 Proforma Invoice PDF.exe aspnet_compiler.exe PID 1684 wrote to memory of 1888 1684 Proforma Invoice PDF.exe aspnet_compiler.exe PID 1684 wrote to memory of 1888 1684 Proforma Invoice PDF.exe aspnet_compiler.exe -
outlook_office_path 1 IoCs
Processes:
aspnet_compiler.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 aspnet_compiler.exe -
outlook_win_path 1 IoCs
Processes:
aspnet_compiler.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 aspnet_compiler.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Proforma Invoice PDF.exe"C:\Users\Admin\AppData\Local\Temp\Proforma Invoice PDF.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1684-115-0x0000000000900000-0x0000000000901000-memory.dmpFilesize
4KB
-
memory/1684-117-0x0000000002AD0000-0x0000000002AD2000-memory.dmpFilesize
8KB
-
memory/1684-118-0x0000000001000000-0x0000000001002000-memory.dmpFilesize
8KB
-
memory/1684-119-0x0000000001200000-0x0000000001208000-memory.dmpFilesize
32KB
-
memory/1888-121-0x000000000043760E-mapping.dmp
-
memory/1888-120-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1888-124-0x0000000005530000-0x0000000005531000-memory.dmpFilesize
4KB
-
memory/1888-125-0x00000000050D0000-0x00000000050D1000-memory.dmpFilesize
4KB
-
memory/1888-126-0x0000000004F90000-0x0000000004F91000-memory.dmpFilesize
4KB
-
memory/1888-127-0x0000000005070000-0x0000000005071000-memory.dmpFilesize
4KB
-
memory/1888-128-0x0000000005C20000-0x0000000005C21000-memory.dmpFilesize
4KB
-
memory/1888-129-0x00000000060F0000-0x00000000060F1000-memory.dmpFilesize
4KB
-
memory/1888-130-0x00000000054C0000-0x00000000054C1000-memory.dmpFilesize
4KB