Analysis
-
max time kernel
149s -
max time network
40s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
20-05-2022 23:46
Static task
static1
Behavioral task
behavioral1
Sample
Tax_Notification_6900449581.pdf.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
Tax_Notification_6900449581.pdf.exe
Resource
win10v2004-20220414-en
General
-
Target
Tax_Notification_6900449581.pdf.exe
-
Size
4.2MB
-
MD5
3e825c82323f71df05b323b0760e2697
-
SHA1
f9635ae2cbc1f389fd507159158a81e42dbee13e
-
SHA256
efe9be78a8da440c576162c8bd5498972ec6134b4276c05acb6a3b060a4013bb
-
SHA512
9e4f364b16f6353eff8841e60fbfa1e01cef93443c2e7a159cb34b2d0070fe59b225b5fa4ff30dd6bbc94547533dc58f62679d2a6920900fcebd26e30ac42470
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.privateemail.com - Port:
587 - Username:
[email protected] - Password:
chizzy25@
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 7 IoCs
Processes:
resource yara_rule behavioral1/memory/1660-70-0x0000000000080000-0x00000000000CC000-memory.dmp family_agenttesla behavioral1/memory/1660-71-0x0000000000080000-0x00000000000CC000-memory.dmp family_agenttesla behavioral1/memory/1660-73-0x0000000000446A2E-mapping.dmp family_agenttesla behavioral1/memory/1660-75-0x0000000000080000-0x00000000000CC000-memory.dmp family_agenttesla behavioral1/memory/1660-76-0x0000000000080000-0x00000000000CC000-memory.dmp family_agenttesla behavioral1/memory/1660-80-0x0000000000080000-0x00000000000CC000-memory.dmp family_agenttesla behavioral1/memory/1660-83-0x0000000000080000-0x00000000000CC000-memory.dmp family_agenttesla -
Executes dropped EXE 2 IoCs
Processes:
trtsytyerwcgjt.exeAddInProcess32.exepid process 1856 trtsytyerwcgjt.exe 1660 AddInProcess32.exe -
Loads dropped DLL 2 IoCs
Processes:
Tax_Notification_6900449581.pdf.exetrtsytyerwcgjt.exepid process 1788 Tax_Notification_6900449581.pdf.exe 1856 trtsytyerwcgjt.exe -
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
Processes:
resource yara_rule behavioral1/memory/1788-56-0x0000000000290000-0x000000000029A000-memory.dmp agile_net -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows\CurrentVersion\Run\deersfsghrtuf = "C:\\Windows\\system32\\pcalua.exe -a C:\\Users\\Admin\\AppData\\Roaming\\trtsytyerwcgjt.exe" reg.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
trtsytyerwcgjt.exedescription pid process target process PID 1856 set thread context of 1660 1856 trtsytyerwcgjt.exe AddInProcess32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
Tax_Notification_6900449581.pdf.exetrtsytyerwcgjt.exeAddInProcess32.exepid process 1788 Tax_Notification_6900449581.pdf.exe 1788 Tax_Notification_6900449581.pdf.exe 1856 trtsytyerwcgjt.exe 1856 trtsytyerwcgjt.exe 1856 trtsytyerwcgjt.exe 1660 AddInProcess32.exe 1660 AddInProcess32.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
Tax_Notification_6900449581.pdf.exetrtsytyerwcgjt.exeAddInProcess32.exedescription pid process Token: SeDebugPrivilege 1788 Tax_Notification_6900449581.pdf.exe Token: SeDebugPrivilege 1856 trtsytyerwcgjt.exe Token: SeDebugPrivilege 1660 AddInProcess32.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
Tax_Notification_6900449581.pdf.execmd.exetrtsytyerwcgjt.exedescription pid process target process PID 1788 wrote to memory of 1628 1788 Tax_Notification_6900449581.pdf.exe cmd.exe PID 1788 wrote to memory of 1628 1788 Tax_Notification_6900449581.pdf.exe cmd.exe PID 1788 wrote to memory of 1628 1788 Tax_Notification_6900449581.pdf.exe cmd.exe PID 1788 wrote to memory of 1628 1788 Tax_Notification_6900449581.pdf.exe cmd.exe PID 1628 wrote to memory of 1960 1628 cmd.exe reg.exe PID 1628 wrote to memory of 1960 1628 cmd.exe reg.exe PID 1628 wrote to memory of 1960 1628 cmd.exe reg.exe PID 1628 wrote to memory of 1960 1628 cmd.exe reg.exe PID 1788 wrote to memory of 1856 1788 Tax_Notification_6900449581.pdf.exe trtsytyerwcgjt.exe PID 1788 wrote to memory of 1856 1788 Tax_Notification_6900449581.pdf.exe trtsytyerwcgjt.exe PID 1788 wrote to memory of 1856 1788 Tax_Notification_6900449581.pdf.exe trtsytyerwcgjt.exe PID 1788 wrote to memory of 1856 1788 Tax_Notification_6900449581.pdf.exe trtsytyerwcgjt.exe PID 1856 wrote to memory of 1660 1856 trtsytyerwcgjt.exe AddInProcess32.exe PID 1856 wrote to memory of 1660 1856 trtsytyerwcgjt.exe AddInProcess32.exe PID 1856 wrote to memory of 1660 1856 trtsytyerwcgjt.exe AddInProcess32.exe PID 1856 wrote to memory of 1660 1856 trtsytyerwcgjt.exe AddInProcess32.exe PID 1856 wrote to memory of 1660 1856 trtsytyerwcgjt.exe AddInProcess32.exe PID 1856 wrote to memory of 1660 1856 trtsytyerwcgjt.exe AddInProcess32.exe PID 1856 wrote to memory of 1660 1856 trtsytyerwcgjt.exe AddInProcess32.exe PID 1856 wrote to memory of 1660 1856 trtsytyerwcgjt.exe AddInProcess32.exe PID 1856 wrote to memory of 1660 1856 trtsytyerwcgjt.exe AddInProcess32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Tax_Notification_6900449581.pdf.exe"C:\Users\Admin\AppData\Local\Temp\Tax_Notification_6900449581.pdf.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v deersfsghrtuf /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Roaming\trtsytyerwcgjt.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v deersfsghrtuf /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Roaming\trtsytyerwcgjt.exe"3⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\trtsytyerwcgjt.exe"C:\Users\Admin\AppData\Roaming\trtsytyerwcgjt.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exeFilesize
41KB
MD56a673bfc3b67ae9782cb31af2f234c68
SHA17544e89566d91e84e3cd437b9a073e5f6b56566e
SHA256978a4093058aa2ebf05dc353897d90d950324389879b57741b64160825b5ec0e
SHA51272c302372ce87ceda2a3c70a6005d3f9c112f1641bc7fe6824c718971233e66c07e2996d2785fa358566c38714c25ea812c05c7cfd2f588284849d495fd24f39
-
C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exeFilesize
41KB
MD56a673bfc3b67ae9782cb31af2f234c68
SHA17544e89566d91e84e3cd437b9a073e5f6b56566e
SHA256978a4093058aa2ebf05dc353897d90d950324389879b57741b64160825b5ec0e
SHA51272c302372ce87ceda2a3c70a6005d3f9c112f1641bc7fe6824c718971233e66c07e2996d2785fa358566c38714c25ea812c05c7cfd2f588284849d495fd24f39
-
C:\Users\Admin\AppData\Roaming\trtsytyerwcgjt.exeFilesize
4.2MB
MD53e825c82323f71df05b323b0760e2697
SHA1f9635ae2cbc1f389fd507159158a81e42dbee13e
SHA256efe9be78a8da440c576162c8bd5498972ec6134b4276c05acb6a3b060a4013bb
SHA5129e4f364b16f6353eff8841e60fbfa1e01cef93443c2e7a159cb34b2d0070fe59b225b5fa4ff30dd6bbc94547533dc58f62679d2a6920900fcebd26e30ac42470
-
C:\Users\Admin\AppData\Roaming\trtsytyerwcgjt.exeFilesize
4.2MB
MD53e825c82323f71df05b323b0760e2697
SHA1f9635ae2cbc1f389fd507159158a81e42dbee13e
SHA256efe9be78a8da440c576162c8bd5498972ec6134b4276c05acb6a3b060a4013bb
SHA5129e4f364b16f6353eff8841e60fbfa1e01cef93443c2e7a159cb34b2d0070fe59b225b5fa4ff30dd6bbc94547533dc58f62679d2a6920900fcebd26e30ac42470
-
\Users\Admin\AppData\Local\Temp\AddInProcess32.exeFilesize
41KB
MD56a673bfc3b67ae9782cb31af2f234c68
SHA17544e89566d91e84e3cd437b9a073e5f6b56566e
SHA256978a4093058aa2ebf05dc353897d90d950324389879b57741b64160825b5ec0e
SHA51272c302372ce87ceda2a3c70a6005d3f9c112f1641bc7fe6824c718971233e66c07e2996d2785fa358566c38714c25ea812c05c7cfd2f588284849d495fd24f39
-
\Users\Admin\AppData\Roaming\trtsytyerwcgjt.exeFilesize
4.2MB
MD53e825c82323f71df05b323b0760e2697
SHA1f9635ae2cbc1f389fd507159158a81e42dbee13e
SHA256efe9be78a8da440c576162c8bd5498972ec6134b4276c05acb6a3b060a4013bb
SHA5129e4f364b16f6353eff8841e60fbfa1e01cef93443c2e7a159cb34b2d0070fe59b225b5fa4ff30dd6bbc94547533dc58f62679d2a6920900fcebd26e30ac42470
-
memory/1628-57-0x0000000000000000-mapping.dmp
-
memory/1660-73-0x0000000000446A2E-mapping.dmp
-
memory/1660-76-0x0000000000080000-0x00000000000CC000-memory.dmpFilesize
304KB
-
memory/1660-84-0x0000000075DB1000-0x0000000075DB3000-memory.dmpFilesize
8KB
-
memory/1660-83-0x0000000000080000-0x00000000000CC000-memory.dmpFilesize
304KB
-
memory/1660-80-0x0000000000080000-0x00000000000CC000-memory.dmpFilesize
304KB
-
memory/1660-75-0x0000000000080000-0x00000000000CC000-memory.dmpFilesize
304KB
-
memory/1660-67-0x0000000000080000-0x00000000000CC000-memory.dmpFilesize
304KB
-
memory/1660-68-0x0000000000080000-0x00000000000CC000-memory.dmpFilesize
304KB
-
memory/1660-70-0x0000000000080000-0x00000000000CC000-memory.dmpFilesize
304KB
-
memory/1660-71-0x0000000000080000-0x00000000000CC000-memory.dmpFilesize
304KB
-
memory/1788-55-0x0000000000210000-0x000000000022E000-memory.dmpFilesize
120KB
-
memory/1788-54-0x0000000000C40000-0x000000000106E000-memory.dmpFilesize
4.2MB
-
memory/1788-56-0x0000000000290000-0x000000000029A000-memory.dmpFilesize
40KB
-
memory/1856-60-0x0000000000000000-mapping.dmp
-
memory/1856-64-0x00000000005A0000-0x00000000005AA000-memory.dmpFilesize
40KB
-
memory/1856-63-0x0000000000B60000-0x0000000000F8E000-memory.dmpFilesize
4.2MB
-
memory/1960-58-0x0000000000000000-mapping.dmp