Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
21-05-2022 00:14
Static task
static1
Behavioral task
behavioral1
Sample
REMITTANCE ADVICE IF01112000212823419.pdf..exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
REMITTANCE ADVICE IF01112000212823419.pdf..exe
Resource
win10v2004-20220414-en
General
-
Target
REMITTANCE ADVICE IF01112000212823419.pdf..exe
-
Size
790KB
-
MD5
8e2843ecd350a81987669f750bbfe5ff
-
SHA1
8a2b87b5b5301ff5846de2afcd44ac968c7799e6
-
SHA256
86e731609c61fdf28983435240b0e28b9548ec53863c2db87036f0f79313c33b
-
SHA512
0d33b1ea56dec2c29e8875904f75d0dcae25bf26bce9d9e34b528f38b4a7fa458d7dde0fca5d4031c739e12a8ea6293be5d2d19d5e529c93e8460fe06a5617ea
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.stankovic.hr - Port:
587 - Username:
[email protected] - Password:
mp58zg
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/3564-137-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla -
Drops file in Drivers directory 1 IoCs
Processes:
RegSvcs.exedescription ioc process File opened for modification C:\Windows\system32\drivers\etc\hosts RegSvcs.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
REMITTANCE ADVICE IF01112000212823419.pdf..exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation REMITTANCE ADVICE IF01112000212823419.pdf..exe -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
RegSvcs.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe Key opened \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe Key opened \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
RegSvcs.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\oPLNOE = "C:\\Users\\Admin\\AppData\\Roaming\\oPLNOE\\oPLNOE.exe" RegSvcs.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
REMITTANCE ADVICE IF01112000212823419.pdf..exedescription pid process target process PID 2912 set thread context of 3564 2912 REMITTANCE ADVICE IF01112000212823419.pdf..exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
REMITTANCE ADVICE IF01112000212823419.pdf..exeRegSvcs.exepid process 2912 REMITTANCE ADVICE IF01112000212823419.pdf..exe 2912 REMITTANCE ADVICE IF01112000212823419.pdf..exe 2912 REMITTANCE ADVICE IF01112000212823419.pdf..exe 2912 REMITTANCE ADVICE IF01112000212823419.pdf..exe 2912 REMITTANCE ADVICE IF01112000212823419.pdf..exe 2912 REMITTANCE ADVICE IF01112000212823419.pdf..exe 3564 RegSvcs.exe 3564 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
REMITTANCE ADVICE IF01112000212823419.pdf..exeRegSvcs.exedescription pid process Token: SeDebugPrivilege 2912 REMITTANCE ADVICE IF01112000212823419.pdf..exe Token: SeDebugPrivilege 3564 RegSvcs.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
REMITTANCE ADVICE IF01112000212823419.pdf..exedescription pid process target process PID 2912 wrote to memory of 4424 2912 REMITTANCE ADVICE IF01112000212823419.pdf..exe schtasks.exe PID 2912 wrote to memory of 4424 2912 REMITTANCE ADVICE IF01112000212823419.pdf..exe schtasks.exe PID 2912 wrote to memory of 4424 2912 REMITTANCE ADVICE IF01112000212823419.pdf..exe schtasks.exe PID 2912 wrote to memory of 4080 2912 REMITTANCE ADVICE IF01112000212823419.pdf..exe RegSvcs.exe PID 2912 wrote to memory of 4080 2912 REMITTANCE ADVICE IF01112000212823419.pdf..exe RegSvcs.exe PID 2912 wrote to memory of 4080 2912 REMITTANCE ADVICE IF01112000212823419.pdf..exe RegSvcs.exe PID 2912 wrote to memory of 3564 2912 REMITTANCE ADVICE IF01112000212823419.pdf..exe RegSvcs.exe PID 2912 wrote to memory of 3564 2912 REMITTANCE ADVICE IF01112000212823419.pdf..exe RegSvcs.exe PID 2912 wrote to memory of 3564 2912 REMITTANCE ADVICE IF01112000212823419.pdf..exe RegSvcs.exe PID 2912 wrote to memory of 3564 2912 REMITTANCE ADVICE IF01112000212823419.pdf..exe RegSvcs.exe PID 2912 wrote to memory of 3564 2912 REMITTANCE ADVICE IF01112000212823419.pdf..exe RegSvcs.exe PID 2912 wrote to memory of 3564 2912 REMITTANCE ADVICE IF01112000212823419.pdf..exe RegSvcs.exe PID 2912 wrote to memory of 3564 2912 REMITTANCE ADVICE IF01112000212823419.pdf..exe RegSvcs.exe PID 2912 wrote to memory of 3564 2912 REMITTANCE ADVICE IF01112000212823419.pdf..exe RegSvcs.exe -
outlook_office_path 1 IoCs
Processes:
RegSvcs.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe -
outlook_win_path 1 IoCs
Processes:
RegSvcs.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\REMITTANCE ADVICE IF01112000212823419.pdf..exe"C:\Users\Admin\AppData\Local\Temp\REMITTANCE ADVICE IF01112000212823419.pdf..exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\&startupname&" /XML "C:\Users\Admin\AppData\Local\Temp\tmpDFA2.tmp"2⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"2⤵
- Drops file in Drivers directory
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpDFA2.tmpFilesize
1KB
MD5072541fbcc0f05e7e00afb8876087822
SHA10a1a6ad25a4a546520fe21bed23b4dd56f5ea7f5
SHA2568a98b2e2084e096028123a79228bc1b11f12179aecfbe53759b3e0805f973116
SHA51207074f512ee920a787af3d49d982795121051cc5cd1ce01d115aab63cd800fd58f2f57e73dafb96151e57ada9d2e407e370abc9c56d8ab604d118dad93c1412d
-
memory/2912-130-0x00000000001C0000-0x000000000028C000-memory.dmpFilesize
816KB
-
memory/2912-131-0x0000000004BD0000-0x0000000004C6C000-memory.dmpFilesize
624KB
-
memory/2912-132-0x0000000004DE0000-0x0000000004E72000-memory.dmpFilesize
584KB
-
memory/3564-136-0x0000000000000000-mapping.dmp
-
memory/3564-137-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/3564-138-0x0000000005B30000-0x00000000060D4000-memory.dmpFilesize
5.6MB
-
memory/3564-139-0x0000000005AC0000-0x0000000005B26000-memory.dmpFilesize
408KB
-
memory/3564-140-0x0000000006820000-0x0000000006870000-memory.dmpFilesize
320KB
-
memory/4080-135-0x0000000000000000-mapping.dmp
-
memory/4424-133-0x0000000000000000-mapping.dmp