Analysis
-
max time kernel
124s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
20-05-2022 23:29
Static task
static1
Behavioral task
behavioral1
Sample
New Orders- POB001745 PDF.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
New Orders- POB001745 PDF.exe
Resource
win10v2004-20220414-en
General
-
Target
New Orders- POB001745 PDF.exe
-
Size
666KB
-
MD5
0760e7f9daa0e835cb4f83762ea6a396
-
SHA1
1c93f56127048c0a3bc476014e97cd30398cefe3
-
SHA256
e8019c082f5e72270bfba4138ea662483e6235ab5751332e3ad9120f9850b5bd
-
SHA512
0fc15c08a74bf1b742f166b57edda31a94b39d74a4a4cfae147ade453dc930d4ddc53d6f5520112fbb3939d3cd52cc7a1125337e0798eb44a9c5cd6ab15ddc67
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.daafco.com - Port:
587 - Username:
[email protected] - Password:
Rawan!@#
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/1176-64-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla behavioral1/memory/1176-65-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla behavioral1/memory/1176-66-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla behavioral1/memory/1176-67-0x000000000044708E-mapping.dmp family_agenttesla behavioral1/memory/1176-69-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla behavioral1/memory/1176-71-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla -
Drops file in Drivers directory 1 IoCs
Processes:
RegSvcs.exedescription ioc process File opened for modification C:\Windows\system32\drivers\etc\hosts RegSvcs.exe -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
RegSvcs.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe Key opened \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe Key opened \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
RegSvcs.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Run\oPLNOE = "C:\\Users\\Admin\\AppData\\Roaming\\oPLNOE\\oPLNOE.exe" RegSvcs.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
New Orders- POB001745 PDF.exedescription pid process target process PID 1540 set thread context of 1176 1540 New Orders- POB001745 PDF.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies registry key 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
New Orders- POB001745 PDF.exeRegSvcs.exepid process 1540 New Orders- POB001745 PDF.exe 1540 New Orders- POB001745 PDF.exe 1540 New Orders- POB001745 PDF.exe 1176 RegSvcs.exe 1176 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
New Orders- POB001745 PDF.exeRegSvcs.exedescription pid process Token: SeDebugPrivilege 1540 New Orders- POB001745 PDF.exe Token: SeDebugPrivilege 1176 RegSvcs.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
New Orders- POB001745 PDF.exeRegSvcs.exedescription pid process target process PID 1540 wrote to memory of 1060 1540 New Orders- POB001745 PDF.exe schtasks.exe PID 1540 wrote to memory of 1060 1540 New Orders- POB001745 PDF.exe schtasks.exe PID 1540 wrote to memory of 1060 1540 New Orders- POB001745 PDF.exe schtasks.exe PID 1540 wrote to memory of 1060 1540 New Orders- POB001745 PDF.exe schtasks.exe PID 1540 wrote to memory of 1176 1540 New Orders- POB001745 PDF.exe RegSvcs.exe PID 1540 wrote to memory of 1176 1540 New Orders- POB001745 PDF.exe RegSvcs.exe PID 1540 wrote to memory of 1176 1540 New Orders- POB001745 PDF.exe RegSvcs.exe PID 1540 wrote to memory of 1176 1540 New Orders- POB001745 PDF.exe RegSvcs.exe PID 1540 wrote to memory of 1176 1540 New Orders- POB001745 PDF.exe RegSvcs.exe PID 1540 wrote to memory of 1176 1540 New Orders- POB001745 PDF.exe RegSvcs.exe PID 1540 wrote to memory of 1176 1540 New Orders- POB001745 PDF.exe RegSvcs.exe PID 1540 wrote to memory of 1176 1540 New Orders- POB001745 PDF.exe RegSvcs.exe PID 1540 wrote to memory of 1176 1540 New Orders- POB001745 PDF.exe RegSvcs.exe PID 1540 wrote to memory of 1176 1540 New Orders- POB001745 PDF.exe RegSvcs.exe PID 1540 wrote to memory of 1176 1540 New Orders- POB001745 PDF.exe RegSvcs.exe PID 1540 wrote to memory of 1176 1540 New Orders- POB001745 PDF.exe RegSvcs.exe PID 1176 wrote to memory of 1936 1176 RegSvcs.exe REG.exe PID 1176 wrote to memory of 1936 1176 RegSvcs.exe REG.exe PID 1176 wrote to memory of 1936 1176 RegSvcs.exe REG.exe PID 1176 wrote to memory of 1936 1176 RegSvcs.exe REG.exe -
outlook_office_path 1 IoCs
Processes:
RegSvcs.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe -
outlook_win_path 1 IoCs
Processes:
RegSvcs.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\New Orders- POB001745 PDF.exe"C:\Users\Admin\AppData\Local\Temp\New Orders- POB001745 PDF.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\&startupname&" /XML "C:\Users\Admin\AppData\Local\Temp\tmpAB5D.tmp"2⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"2⤵
- Drops file in Drivers directory
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
-
C:\Windows\SysWOW64\REG.exeREG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System / v DisableTaskMgr / t REG_DWORD / d 1 / f3⤵
- Modifies registry key
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpAB5D.tmpFilesize
1KB
MD5d2aa72e1e0a9b7dcb81af5082540153a
SHA169f84c985fea812daa2fcfd1941a7d60facb4a7e
SHA256c7a368be198491672c06e17b5626878b39a06de3bb28c0f028cc3aff46e43d3d
SHA512541bbb3c838c14bfc2c91d1394a99a72f76ad8c3534da1215336ffdc3d63922d456af573ced60d5dff7f9e70fc1f7c8f3cd8ad997374356ecb784695ea312692
-
memory/1060-59-0x0000000000000000-mapping.dmp
-
memory/1176-67-0x000000000044708E-mapping.dmp
-
memory/1176-65-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1176-71-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1176-69-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1176-66-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1176-61-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1176-62-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1176-64-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1540-55-0x0000000074B51000-0x0000000074B53000-memory.dmpFilesize
8KB
-
memory/1540-57-0x0000000007050000-0x00000000070BE000-memory.dmpFilesize
440KB
-
memory/1540-54-0x0000000000A80000-0x0000000000B2C000-memory.dmpFilesize
688KB
-
memory/1540-56-0x00000000003A0000-0x00000000003A8000-memory.dmpFilesize
32KB
-
memory/1540-58-0x0000000000900000-0x0000000000956000-memory.dmpFilesize
344KB
-
memory/1936-73-0x0000000000000000-mapping.dmp