Analysis
-
max time kernel
151s -
max time network
103s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
20-05-2022 23:46
Static task
static1
Behavioral task
behavioral1
Sample
Tax_Notification_6900449581.pdf.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
Tax_Notification_6900449581.pdf.exe
Resource
win10v2004-20220414-en
General
-
Target
Tax_Notification_6900449581.pdf.exe
-
Size
4.2MB
-
MD5
3e825c82323f71df05b323b0760e2697
-
SHA1
f9635ae2cbc1f389fd507159158a81e42dbee13e
-
SHA256
efe9be78a8da440c576162c8bd5498972ec6134b4276c05acb6a3b060a4013bb
-
SHA512
9e4f364b16f6353eff8841e60fbfa1e01cef93443c2e7a159cb34b2d0070fe59b225b5fa4ff30dd6bbc94547533dc58f62679d2a6920900fcebd26e30ac42470
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.privateemail.com - Port:
587 - Username:
[email protected] - Password:
chizzy25@
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/3908-140-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla -
Executes dropped EXE 2 IoCs
Processes:
trtsytyerwcgjt.exeAddInProcess32.exepid process 1472 trtsytyerwcgjt.exe 3908 AddInProcess32.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Tax_Notification_6900449581.pdf.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation Tax_Notification_6900449581.pdf.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\deersfsghrtuf = "C:\\Windows\\system32\\pcalua.exe -a C:\\Users\\Admin\\AppData\\Roaming\\trtsytyerwcgjt.exe" reg.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
trtsytyerwcgjt.exedescription pid process target process PID 1472 set thread context of 3908 1472 trtsytyerwcgjt.exe AddInProcess32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 27 IoCs
Processes:
Tax_Notification_6900449581.pdf.exetrtsytyerwcgjt.exeAddInProcess32.exepid process 1464 Tax_Notification_6900449581.pdf.exe 1464 Tax_Notification_6900449581.pdf.exe 1464 Tax_Notification_6900449581.pdf.exe 1464 Tax_Notification_6900449581.pdf.exe 1464 Tax_Notification_6900449581.pdf.exe 1464 Tax_Notification_6900449581.pdf.exe 1464 Tax_Notification_6900449581.pdf.exe 1464 Tax_Notification_6900449581.pdf.exe 1464 Tax_Notification_6900449581.pdf.exe 1464 Tax_Notification_6900449581.pdf.exe 1464 Tax_Notification_6900449581.pdf.exe 1464 Tax_Notification_6900449581.pdf.exe 1464 Tax_Notification_6900449581.pdf.exe 1464 Tax_Notification_6900449581.pdf.exe 1464 Tax_Notification_6900449581.pdf.exe 1464 Tax_Notification_6900449581.pdf.exe 1464 Tax_Notification_6900449581.pdf.exe 1464 Tax_Notification_6900449581.pdf.exe 1464 Tax_Notification_6900449581.pdf.exe 1464 Tax_Notification_6900449581.pdf.exe 1464 Tax_Notification_6900449581.pdf.exe 1464 Tax_Notification_6900449581.pdf.exe 1472 trtsytyerwcgjt.exe 1472 trtsytyerwcgjt.exe 1472 trtsytyerwcgjt.exe 3908 AddInProcess32.exe 3908 AddInProcess32.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
Tax_Notification_6900449581.pdf.exetrtsytyerwcgjt.exeAddInProcess32.exedescription pid process Token: SeDebugPrivilege 1464 Tax_Notification_6900449581.pdf.exe Token: SeDebugPrivilege 1472 trtsytyerwcgjt.exe Token: SeDebugPrivilege 3908 AddInProcess32.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
Tax_Notification_6900449581.pdf.execmd.exetrtsytyerwcgjt.exedescription pid process target process PID 1464 wrote to memory of 708 1464 Tax_Notification_6900449581.pdf.exe cmd.exe PID 1464 wrote to memory of 708 1464 Tax_Notification_6900449581.pdf.exe cmd.exe PID 1464 wrote to memory of 708 1464 Tax_Notification_6900449581.pdf.exe cmd.exe PID 708 wrote to memory of 2216 708 cmd.exe reg.exe PID 708 wrote to memory of 2216 708 cmd.exe reg.exe PID 708 wrote to memory of 2216 708 cmd.exe reg.exe PID 1464 wrote to memory of 1472 1464 Tax_Notification_6900449581.pdf.exe trtsytyerwcgjt.exe PID 1464 wrote to memory of 1472 1464 Tax_Notification_6900449581.pdf.exe trtsytyerwcgjt.exe PID 1464 wrote to memory of 1472 1464 Tax_Notification_6900449581.pdf.exe trtsytyerwcgjt.exe PID 1472 wrote to memory of 3908 1472 trtsytyerwcgjt.exe AddInProcess32.exe PID 1472 wrote to memory of 3908 1472 trtsytyerwcgjt.exe AddInProcess32.exe PID 1472 wrote to memory of 3908 1472 trtsytyerwcgjt.exe AddInProcess32.exe PID 1472 wrote to memory of 3908 1472 trtsytyerwcgjt.exe AddInProcess32.exe PID 1472 wrote to memory of 3908 1472 trtsytyerwcgjt.exe AddInProcess32.exe PID 1472 wrote to memory of 3908 1472 trtsytyerwcgjt.exe AddInProcess32.exe PID 1472 wrote to memory of 3908 1472 trtsytyerwcgjt.exe AddInProcess32.exe PID 1472 wrote to memory of 3908 1472 trtsytyerwcgjt.exe AddInProcess32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Tax_Notification_6900449581.pdf.exe"C:\Users\Admin\AppData\Local\Temp\Tax_Notification_6900449581.pdf.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v deersfsghrtuf /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Roaming\trtsytyerwcgjt.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v deersfsghrtuf /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Roaming\trtsytyerwcgjt.exe"3⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\trtsytyerwcgjt.exe"C:\Users\Admin\AppData\Roaming\trtsytyerwcgjt.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exeFilesize
42KB
MD59827ff3cdf4b83f9c86354606736ca9c
SHA1e73d73f42bb2a310f03eb1bcbb22be2b8eb7c723
SHA256c1cf3dc8fa1c7fc00f88e07ad539979b3706ca8d69223cffd1d58bc8f521f63a
SHA5128261828d55f3b5134c0aeb98311c04e20c5395d4347251746f3be0fb854f36cc7e118713cd00c9867537e6e47d5e71f2b2384fc00c67f0ae1b285b8310321579
-
C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exeFilesize
42KB
MD59827ff3cdf4b83f9c86354606736ca9c
SHA1e73d73f42bb2a310f03eb1bcbb22be2b8eb7c723
SHA256c1cf3dc8fa1c7fc00f88e07ad539979b3706ca8d69223cffd1d58bc8f521f63a
SHA5128261828d55f3b5134c0aeb98311c04e20c5395d4347251746f3be0fb854f36cc7e118713cd00c9867537e6e47d5e71f2b2384fc00c67f0ae1b285b8310321579
-
C:\Users\Admin\AppData\Roaming\trtsytyerwcgjt.exeFilesize
4.2MB
MD53e825c82323f71df05b323b0760e2697
SHA1f9635ae2cbc1f389fd507159158a81e42dbee13e
SHA256efe9be78a8da440c576162c8bd5498972ec6134b4276c05acb6a3b060a4013bb
SHA5129e4f364b16f6353eff8841e60fbfa1e01cef93443c2e7a159cb34b2d0070fe59b225b5fa4ff30dd6bbc94547533dc58f62679d2a6920900fcebd26e30ac42470
-
C:\Users\Admin\AppData\Roaming\trtsytyerwcgjt.exeFilesize
4.2MB
MD53e825c82323f71df05b323b0760e2697
SHA1f9635ae2cbc1f389fd507159158a81e42dbee13e
SHA256efe9be78a8da440c576162c8bd5498972ec6134b4276c05acb6a3b060a4013bb
SHA5129e4f364b16f6353eff8841e60fbfa1e01cef93443c2e7a159cb34b2d0070fe59b225b5fa4ff30dd6bbc94547533dc58f62679d2a6920900fcebd26e30ac42470
-
memory/708-134-0x0000000000000000-mapping.dmp
-
memory/1464-131-0x0000000005ED0000-0x0000000006474000-memory.dmpFilesize
5.6MB
-
memory/1464-132-0x0000000005A20000-0x0000000005AB2000-memory.dmpFilesize
584KB
-
memory/1464-133-0x0000000005E40000-0x0000000005E84000-memory.dmpFilesize
272KB
-
memory/1464-130-0x0000000000470000-0x000000000089E000-memory.dmpFilesize
4.2MB
-
memory/1472-136-0x0000000000000000-mapping.dmp
-
memory/2216-135-0x0000000000000000-mapping.dmp
-
memory/3908-140-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/3908-139-0x0000000000000000-mapping.dmp
-
memory/3908-143-0x0000000005390000-0x000000000542C000-memory.dmpFilesize
624KB
-
memory/3908-144-0x0000000006020000-0x0000000006086000-memory.dmpFilesize
408KB