Analysis
-
max time kernel
119s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
20-05-2022 23:00
Static task
static1
Behavioral task
behavioral1
Sample
Detalles del banco Pdf.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
Detalles del banco Pdf.exe
Resource
win10v2004-20220414-en
General
-
Target
Detalles del banco Pdf.exe
-
Size
548KB
-
MD5
d367775b90921b2d36296036bac6a255
-
SHA1
897618f155cfb5b5f580f3b08751ff9b4fb5c5e8
-
SHA256
74fb0be9b7d5f5e5a39ddf596dfb3357deb458b7b4340be8f0ce8c4ae819f3de
-
SHA512
74f0a82c5542308ad66065319a206144a73eb95c32ae22e8e807a9e326eb6e91add2c8455aded2607eb2f268cb4a0560698126b9c2bcbb71423f549da7016d2b
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
us2.smtp.mailhostbox.com - Port:
587 - Username:
[email protected] - Password:
lFAvm@p#@z92
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/1964-62-0x0000000000400000-0x0000000000452000-memory.dmp family_agenttesla behavioral1/memory/1964-61-0x0000000000400000-0x0000000000452000-memory.dmp family_agenttesla behavioral1/memory/1964-63-0x0000000000400000-0x0000000000452000-memory.dmp family_agenttesla behavioral1/memory/1964-64-0x000000000044C3DE-mapping.dmp family_agenttesla behavioral1/memory/1964-66-0x0000000000400000-0x0000000000452000-memory.dmp family_agenttesla behavioral1/memory/1964-68-0x0000000000400000-0x0000000000452000-memory.dmp family_agenttesla -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
Detalles del banco Pdf.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Detalles del banco Pdf.exe Key opened \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Detalles del banco Pdf.exe Key opened \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Detalles del banco Pdf.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
Detalles del banco Pdf.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\MJVkSQ = "C:\\Users\\Admin\\AppData\\Roaming\\MJVkSQ\\MJVkSQ.exe" Detalles del banco Pdf.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Detalles del banco Pdf.exedescription pid process target process PID 1096 set thread context of 1964 1096 Detalles del banco Pdf.exe Detalles del banco Pdf.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
Detalles del banco Pdf.exeDetalles del banco Pdf.exepid process 1096 Detalles del banco Pdf.exe 1096 Detalles del banco Pdf.exe 1096 Detalles del banco Pdf.exe 1964 Detalles del banco Pdf.exe 1964 Detalles del banco Pdf.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
Detalles del banco Pdf.exepid process 1964 Detalles del banco Pdf.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Detalles del banco Pdf.exeDetalles del banco Pdf.exedescription pid process Token: SeDebugPrivilege 1096 Detalles del banco Pdf.exe Token: SeDebugPrivilege 1964 Detalles del banco Pdf.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
Detalles del banco Pdf.exeDetalles del banco Pdf.exedescription pid process target process PID 1096 wrote to memory of 1984 1096 Detalles del banco Pdf.exe schtasks.exe PID 1096 wrote to memory of 1984 1096 Detalles del banco Pdf.exe schtasks.exe PID 1096 wrote to memory of 1984 1096 Detalles del banco Pdf.exe schtasks.exe PID 1096 wrote to memory of 1984 1096 Detalles del banco Pdf.exe schtasks.exe PID 1096 wrote to memory of 1952 1096 Detalles del banco Pdf.exe Detalles del banco Pdf.exe PID 1096 wrote to memory of 1952 1096 Detalles del banco Pdf.exe Detalles del banco Pdf.exe PID 1096 wrote to memory of 1952 1096 Detalles del banco Pdf.exe Detalles del banco Pdf.exe PID 1096 wrote to memory of 1952 1096 Detalles del banco Pdf.exe Detalles del banco Pdf.exe PID 1096 wrote to memory of 1964 1096 Detalles del banco Pdf.exe Detalles del banco Pdf.exe PID 1096 wrote to memory of 1964 1096 Detalles del banco Pdf.exe Detalles del banco Pdf.exe PID 1096 wrote to memory of 1964 1096 Detalles del banco Pdf.exe Detalles del banco Pdf.exe PID 1096 wrote to memory of 1964 1096 Detalles del banco Pdf.exe Detalles del banco Pdf.exe PID 1096 wrote to memory of 1964 1096 Detalles del banco Pdf.exe Detalles del banco Pdf.exe PID 1096 wrote to memory of 1964 1096 Detalles del banco Pdf.exe Detalles del banco Pdf.exe PID 1096 wrote to memory of 1964 1096 Detalles del banco Pdf.exe Detalles del banco Pdf.exe PID 1096 wrote to memory of 1964 1096 Detalles del banco Pdf.exe Detalles del banco Pdf.exe PID 1096 wrote to memory of 1964 1096 Detalles del banco Pdf.exe Detalles del banco Pdf.exe PID 1964 wrote to memory of 1072 1964 Detalles del banco Pdf.exe netsh.exe PID 1964 wrote to memory of 1072 1964 Detalles del banco Pdf.exe netsh.exe PID 1964 wrote to memory of 1072 1964 Detalles del banco Pdf.exe netsh.exe PID 1964 wrote to memory of 1072 1964 Detalles del banco Pdf.exe netsh.exe -
outlook_office_path 1 IoCs
Processes:
Detalles del banco Pdf.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Detalles del banco Pdf.exe -
outlook_win_path 1 IoCs
Processes:
Detalles del banco Pdf.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Detalles del banco Pdf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Detalles del banco Pdf.exe"C:\Users\Admin\AppData\Local\Temp\Detalles del banco Pdf.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\unlOvmub" /XML "C:\Users\Admin\AppData\Local\Temp\tmp7EE.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\Detalles del banco Pdf.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Detalles del banco Pdf.exe"{path}"2⤵
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
-
C:\Windows\SysWOW64\netsh.exe"netsh" wlan show profile3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp7EE.tmpFilesize
1KB
MD596ad376037de1aac80625177a7ea6800
SHA10c64e3cabc6460dec6a20a0ca9629f9c4ebad298
SHA256de84856c02bef16b87dc41cf169fcbaa8f68aeb4580f75d03afaa538db8826a9
SHA51223f23b7bfc94dd62c3b6e476222271c5943fb4aa001caa203c077a5fa3a47ed7ddb35f5056f0ec7fd5a99d8fcb795f5f785ec8bd0294b04c16bab746eba54c42
-
memory/1072-71-0x0000000000000000-mapping.dmp
-
memory/1096-54-0x0000000075E51000-0x0000000075E53000-memory.dmpFilesize
8KB
-
memory/1096-55-0x0000000074590000-0x0000000074B3B000-memory.dmpFilesize
5.7MB
-
memory/1964-61-0x0000000000400000-0x0000000000452000-memory.dmpFilesize
328KB
-
memory/1964-62-0x0000000000400000-0x0000000000452000-memory.dmpFilesize
328KB
-
memory/1964-59-0x0000000000400000-0x0000000000452000-memory.dmpFilesize
328KB
-
memory/1964-58-0x0000000000400000-0x0000000000452000-memory.dmpFilesize
328KB
-
memory/1964-63-0x0000000000400000-0x0000000000452000-memory.dmpFilesize
328KB
-
memory/1964-64-0x000000000044C3DE-mapping.dmp
-
memory/1964-66-0x0000000000400000-0x0000000000452000-memory.dmpFilesize
328KB
-
memory/1964-68-0x0000000000400000-0x0000000000452000-memory.dmpFilesize
328KB
-
memory/1964-70-0x0000000074520000-0x0000000074ACB000-memory.dmpFilesize
5.7MB
-
memory/1984-56-0x0000000000000000-mapping.dmp