Analysis
-
max time kernel
150s -
max time network
161s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
20-05-2022 23:29
Static task
static1
Behavioral task
behavioral1
Sample
New Orders- POB001745 PDF.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
New Orders- POB001745 PDF.exe
Resource
win10v2004-20220414-en
General
-
Target
New Orders- POB001745 PDF.exe
-
Size
666KB
-
MD5
0760e7f9daa0e835cb4f83762ea6a396
-
SHA1
1c93f56127048c0a3bc476014e97cd30398cefe3
-
SHA256
e8019c082f5e72270bfba4138ea662483e6235ab5751332e3ad9120f9850b5bd
-
SHA512
0fc15c08a74bf1b742f166b57edda31a94b39d74a4a4cfae147ade453dc930d4ddc53d6f5520112fbb3939d3cd52cc7a1125337e0798eb44a9c5cd6ab15ddc67
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.daafco.com - Port:
587 - Username:
[email protected] - Password:
Rawan!@#
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4792-138-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla -
Drops file in Drivers directory 1 IoCs
Processes:
RegSvcs.exedescription ioc process File opened for modification C:\Windows\system32\drivers\etc\hosts RegSvcs.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
New Orders- POB001745 PDF.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation New Orders- POB001745 PDF.exe -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
RegSvcs.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe Key opened \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe Key opened \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
RegSvcs.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\oPLNOE = "C:\\Users\\Admin\\AppData\\Roaming\\oPLNOE\\oPLNOE.exe" RegSvcs.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
New Orders- POB001745 PDF.exedescription pid process target process PID 4504 set thread context of 4792 4504 New Orders- POB001745 PDF.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies registry key 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
New Orders- POB001745 PDF.exeRegSvcs.exepid process 4504 New Orders- POB001745 PDF.exe 4504 New Orders- POB001745 PDF.exe 4504 New Orders- POB001745 PDF.exe 4504 New Orders- POB001745 PDF.exe 4792 RegSvcs.exe 4792 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
New Orders- POB001745 PDF.exeRegSvcs.exedescription pid process Token: SeDebugPrivilege 4504 New Orders- POB001745 PDF.exe Token: SeDebugPrivilege 4792 RegSvcs.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
New Orders- POB001745 PDF.exeRegSvcs.exedescription pid process target process PID 4504 wrote to memory of 4280 4504 New Orders- POB001745 PDF.exe schtasks.exe PID 4504 wrote to memory of 4280 4504 New Orders- POB001745 PDF.exe schtasks.exe PID 4504 wrote to memory of 4280 4504 New Orders- POB001745 PDF.exe schtasks.exe PID 4504 wrote to memory of 4792 4504 New Orders- POB001745 PDF.exe RegSvcs.exe PID 4504 wrote to memory of 4792 4504 New Orders- POB001745 PDF.exe RegSvcs.exe PID 4504 wrote to memory of 4792 4504 New Orders- POB001745 PDF.exe RegSvcs.exe PID 4504 wrote to memory of 4792 4504 New Orders- POB001745 PDF.exe RegSvcs.exe PID 4504 wrote to memory of 4792 4504 New Orders- POB001745 PDF.exe RegSvcs.exe PID 4504 wrote to memory of 4792 4504 New Orders- POB001745 PDF.exe RegSvcs.exe PID 4504 wrote to memory of 4792 4504 New Orders- POB001745 PDF.exe RegSvcs.exe PID 4504 wrote to memory of 4792 4504 New Orders- POB001745 PDF.exe RegSvcs.exe PID 4792 wrote to memory of 4964 4792 RegSvcs.exe REG.exe PID 4792 wrote to memory of 4964 4792 RegSvcs.exe REG.exe PID 4792 wrote to memory of 4964 4792 RegSvcs.exe REG.exe -
outlook_office_path 1 IoCs
Processes:
RegSvcs.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe -
outlook_win_path 1 IoCs
Processes:
RegSvcs.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\New Orders- POB001745 PDF.exe"C:\Users\Admin\AppData\Local\Temp\New Orders- POB001745 PDF.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\&startupname&" /XML "C:\Users\Admin\AppData\Local\Temp\tmp142F.tmp"2⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"2⤵
- Drops file in Drivers directory
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
-
C:\Windows\SysWOW64\REG.exeREG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System / v DisableTaskMgr / t REG_DWORD / d 1 / f3⤵
- Modifies registry key
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp142F.tmpFilesize
1KB
MD5f0194d140d5655b77acfe5c633086ba1
SHA18cd43646855f664a0ebcff81adb01c0681a9363e
SHA25631fb428c38ed87cd3c15ca9020c0dd95120ff487e25a9886be7acf1c7c9c5e46
SHA512abf16211ad68556400043b1a50b9753bbcdb25e433a1c7bc982afcd3c9bfa48207f063f90130d1f5fe1eb8c335ef06159d9fe740cff7f9e0cb6bca6d8e422a14
-
memory/4280-135-0x0000000000000000-mapping.dmp
-
memory/4504-130-0x0000000000810000-0x00000000008BC000-memory.dmpFilesize
688KB
-
memory/4504-131-0x0000000007D00000-0x00000000082A4000-memory.dmpFilesize
5.6MB
-
memory/4504-132-0x0000000007750000-0x00000000077E2000-memory.dmpFilesize
584KB
-
memory/4504-133-0x00000000077F0000-0x00000000077FA000-memory.dmpFilesize
40KB
-
memory/4504-134-0x0000000007A20000-0x0000000007ABC000-memory.dmpFilesize
624KB
-
memory/4792-137-0x0000000000000000-mapping.dmp
-
memory/4792-138-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/4792-139-0x0000000005AA0000-0x0000000005B06000-memory.dmpFilesize
408KB
-
memory/4792-140-0x00000000066F0000-0x0000000006740000-memory.dmpFilesize
320KB
-
memory/4964-141-0x0000000000000000-mapping.dmp