Analysis
-
max time kernel
107s -
max time network
149s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
20-10-2021 05:49
Static task
static1
Behavioral task
behavioral1
Sample
Scan docs. pdf...................exe
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
Scan docs. pdf...................exe
Resource
win10-en-20211014
General
-
Target
Scan docs. pdf...................exe
-
Size
395KB
-
MD5
1be69ae48470bc61f9d9a3dadac1332b
-
SHA1
70fd3849d42ea40e4df52a4f388abfd099d8d892
-
SHA256
43503c2141f4ee3c30d73dc4cec26f079074c25cd4487ce9de32b9f36c73a871
-
SHA512
5d9bb581ec611702edf57317877cc15d60a9b096309b7a10b8bc1ff8c057d0dc7519b63b00e24253062ec6d16047c8220485f886a653dea97933dda47cd38c2e
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.nicedoc.biz - Port:
587 - Username:
[email protected] - Password:
simple2626
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/2680-127-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla behavioral2/memory/2680-128-0x00000000004375EE-mapping.dmp family_agenttesla behavioral2/memory/2680-134-0x0000000005850000-0x0000000005D4E000-memory.dmp family_agenttesla -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Scan docs. pdf...................exedescription pid process target process PID 2500 set thread context of 2680 2500 Scan docs. pdf...................exe Scan docs. pdf...................exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 9 IoCs
Processes:
Scan docs. pdf...................exeScan docs. pdf...................exepid process 2500 Scan docs. pdf...................exe 2500 Scan docs. pdf...................exe 2500 Scan docs. pdf...................exe 2500 Scan docs. pdf...................exe 2500 Scan docs. pdf...................exe 2500 Scan docs. pdf...................exe 2500 Scan docs. pdf...................exe 2680 Scan docs. pdf...................exe 2680 Scan docs. pdf...................exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Scan docs. pdf...................exeScan docs. pdf...................exedescription pid process Token: SeDebugPrivilege 2500 Scan docs. pdf...................exe Token: SeDebugPrivilege 2680 Scan docs. pdf...................exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
Scan docs. pdf...................exepid process 2500 Scan docs. pdf...................exe 2500 Scan docs. pdf...................exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
Scan docs. pdf...................exedescription pid process target process PID 2500 wrote to memory of 1428 2500 Scan docs. pdf...................exe schtasks.exe PID 2500 wrote to memory of 1428 2500 Scan docs. pdf...................exe schtasks.exe PID 2500 wrote to memory of 1428 2500 Scan docs. pdf...................exe schtasks.exe PID 2500 wrote to memory of 2680 2500 Scan docs. pdf...................exe Scan docs. pdf...................exe PID 2500 wrote to memory of 2680 2500 Scan docs. pdf...................exe Scan docs. pdf...................exe PID 2500 wrote to memory of 2680 2500 Scan docs. pdf...................exe Scan docs. pdf...................exe PID 2500 wrote to memory of 2680 2500 Scan docs. pdf...................exe Scan docs. pdf...................exe PID 2500 wrote to memory of 2680 2500 Scan docs. pdf...................exe Scan docs. pdf...................exe PID 2500 wrote to memory of 2680 2500 Scan docs. pdf...................exe Scan docs. pdf...................exe PID 2500 wrote to memory of 2680 2500 Scan docs. pdf...................exe Scan docs. pdf...................exe PID 2500 wrote to memory of 2680 2500 Scan docs. pdf...................exe Scan docs. pdf...................exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Scan docs. pdf...................exe"C:\Users\Admin\AppData\Local\Temp\Scan docs. pdf...................exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\OmIpirzuSc" /XML "C:\Users\Admin\AppData\Local\Temp\tmp91F.tmp"2⤵
- Creates scheduled task(s)
PID:1428 -
C:\Users\Admin\AppData\Local\Temp\Scan docs. pdf...................exe"C:\Users\Admin\AppData\Local\Temp\Scan docs. pdf...................exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2680
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Scan docs. pdf...................exe.logMD5
0c2899d7c6746f42d5bbe088c777f94c
SHA1622f66c5f7a3c91b28a9f43ce7c6cabadbf514f1
SHA2565b0b99740cadaeff7b9891136644b396941547e20cc7eea646560d0dad5a5458
SHA512ab7a3409ed4b6ca00358330a3aa4ef6de7d81eb21a5e24bb629ef6a7c7c4e2a70ca3accfbc989ed6e495fdb8eb6203a26d6f2a37b2a5809af4276af375b49078
-
memory/1428-126-0x0000000000000000-mapping.dmp
-
memory/2500-124-0x0000000009750000-0x0000000009751000-memory.dmpFilesize
4KB
-
memory/2500-125-0x00000000097F0000-0x0000000009848000-memory.dmpFilesize
352KB
-
memory/2500-120-0x0000000005390000-0x0000000005391000-memory.dmpFilesize
4KB
-
memory/2500-121-0x00000000053B1000-0x00000000053B2000-memory.dmpFilesize
4KB
-
memory/2500-122-0x00000000053B2000-0x00000000053B3000-memory.dmpFilesize
4KB
-
memory/2500-123-0x0000000009690000-0x0000000009698000-memory.dmpFilesize
32KB
-
memory/2500-115-0x0000000000AE0000-0x0000000000AE1000-memory.dmpFilesize
4KB
-
memory/2500-119-0x00000000053B0000-0x00000000053B1000-memory.dmpFilesize
4KB
-
memory/2500-118-0x00000000053F0000-0x00000000053F1000-memory.dmpFilesize
4KB
-
memory/2500-117-0x00000000058F0000-0x00000000058F1000-memory.dmpFilesize
4KB
-
memory/2680-128-0x00000000004375EE-mapping.dmp
-
memory/2680-127-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/2680-134-0x0000000005850000-0x0000000005D4E000-memory.dmpFilesize
5.0MB
-
memory/2680-135-0x0000000005980000-0x0000000005981000-memory.dmpFilesize
4KB
-
memory/2680-136-0x0000000006250000-0x0000000006251000-memory.dmpFilesize
4KB