Analysis
-
max time kernel
47s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 00:23
Static task
static1
Behavioral task
behavioral1
Sample
New Orders- POB0.pdf.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
New Orders- POB0.pdf.exe
Resource
win10v2004-20220414-en
General
-
Target
New Orders- POB0.pdf.exe
-
Size
783KB
-
MD5
0f22eacae1316be03f6829946306b593
-
SHA1
3a3d3297ae8b1e96bc0fda3502a58d69447a2577
-
SHA256
b6cbbb6a53fb168a24f6a2f4bbf296547e5ece0314e2b9c21d6662af66a3ac4a
-
SHA512
3b74d936eb6faeab8ea2b37aee1bf90ee54e76a0e37f8ba08d2580908cb648d19da89720a51e5475298abfdab969a474f6145157e5b2662767f7a05795ab6e36
Malware Config
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1008-64-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
New Orders- POB0.pdf.exepid process 1968 New Orders- POB0.pdf.exe 1968 New Orders- POB0.pdf.exe 1968 New Orders- POB0.pdf.exe 1968 New Orders- POB0.pdf.exe 1968 New Orders- POB0.pdf.exe 1968 New Orders- POB0.pdf.exe 1968 New Orders- POB0.pdf.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
New Orders- POB0.pdf.exedescription pid process Token: SeDebugPrivilege 1968 New Orders- POB0.pdf.exe -
Suspicious use of WriteProcessMemory 45 IoCs
Processes:
New Orders- POB0.pdf.exedescription pid process target process PID 1968 wrote to memory of 640 1968 New Orders- POB0.pdf.exe schtasks.exe PID 1968 wrote to memory of 640 1968 New Orders- POB0.pdf.exe schtasks.exe PID 1968 wrote to memory of 640 1968 New Orders- POB0.pdf.exe schtasks.exe PID 1968 wrote to memory of 640 1968 New Orders- POB0.pdf.exe schtasks.exe PID 1968 wrote to memory of 1008 1968 New Orders- POB0.pdf.exe RegSvcs.exe PID 1968 wrote to memory of 1008 1968 New Orders- POB0.pdf.exe RegSvcs.exe PID 1968 wrote to memory of 1008 1968 New Orders- POB0.pdf.exe RegSvcs.exe PID 1968 wrote to memory of 1008 1968 New Orders- POB0.pdf.exe RegSvcs.exe PID 1968 wrote to memory of 1008 1968 New Orders- POB0.pdf.exe RegSvcs.exe PID 1968 wrote to memory of 1008 1968 New Orders- POB0.pdf.exe RegSvcs.exe PID 1968 wrote to memory of 1008 1968 New Orders- POB0.pdf.exe RegSvcs.exe PID 1968 wrote to memory of 1008 1968 New Orders- POB0.pdf.exe RegSvcs.exe PID 1968 wrote to memory of 1008 1968 New Orders- POB0.pdf.exe RegSvcs.exe PID 1968 wrote to memory of 1008 1968 New Orders- POB0.pdf.exe RegSvcs.exe PID 1968 wrote to memory of 888 1968 New Orders- POB0.pdf.exe RegSvcs.exe PID 1968 wrote to memory of 888 1968 New Orders- POB0.pdf.exe RegSvcs.exe PID 1968 wrote to memory of 888 1968 New Orders- POB0.pdf.exe RegSvcs.exe PID 1968 wrote to memory of 888 1968 New Orders- POB0.pdf.exe RegSvcs.exe PID 1968 wrote to memory of 888 1968 New Orders- POB0.pdf.exe RegSvcs.exe PID 1968 wrote to memory of 888 1968 New Orders- POB0.pdf.exe RegSvcs.exe PID 1968 wrote to memory of 888 1968 New Orders- POB0.pdf.exe RegSvcs.exe PID 1968 wrote to memory of 880 1968 New Orders- POB0.pdf.exe RegSvcs.exe PID 1968 wrote to memory of 880 1968 New Orders- POB0.pdf.exe RegSvcs.exe PID 1968 wrote to memory of 880 1968 New Orders- POB0.pdf.exe RegSvcs.exe PID 1968 wrote to memory of 880 1968 New Orders- POB0.pdf.exe RegSvcs.exe PID 1968 wrote to memory of 880 1968 New Orders- POB0.pdf.exe RegSvcs.exe PID 1968 wrote to memory of 880 1968 New Orders- POB0.pdf.exe RegSvcs.exe PID 1968 wrote to memory of 880 1968 New Orders- POB0.pdf.exe RegSvcs.exe PID 1968 wrote to memory of 1824 1968 New Orders- POB0.pdf.exe RegSvcs.exe PID 1968 wrote to memory of 1824 1968 New Orders- POB0.pdf.exe RegSvcs.exe PID 1968 wrote to memory of 1824 1968 New Orders- POB0.pdf.exe RegSvcs.exe PID 1968 wrote to memory of 1824 1968 New Orders- POB0.pdf.exe RegSvcs.exe PID 1968 wrote to memory of 1824 1968 New Orders- POB0.pdf.exe RegSvcs.exe PID 1968 wrote to memory of 1824 1968 New Orders- POB0.pdf.exe RegSvcs.exe PID 1968 wrote to memory of 1824 1968 New Orders- POB0.pdf.exe RegSvcs.exe PID 1968 wrote to memory of 1980 1968 New Orders- POB0.pdf.exe RegSvcs.exe PID 1968 wrote to memory of 1980 1968 New Orders- POB0.pdf.exe RegSvcs.exe PID 1968 wrote to memory of 1980 1968 New Orders- POB0.pdf.exe RegSvcs.exe PID 1968 wrote to memory of 1980 1968 New Orders- POB0.pdf.exe RegSvcs.exe PID 1968 wrote to memory of 1980 1968 New Orders- POB0.pdf.exe RegSvcs.exe PID 1968 wrote to memory of 1980 1968 New Orders- POB0.pdf.exe RegSvcs.exe PID 1968 wrote to memory of 1980 1968 New Orders- POB0.pdf.exe RegSvcs.exe PID 1968 wrote to memory of 1980 1968 New Orders- POB0.pdf.exe RegSvcs.exe PID 1968 wrote to memory of 1980 1968 New Orders- POB0.pdf.exe RegSvcs.exe PID 1968 wrote to memory of 1980 1968 New Orders- POB0.pdf.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\New Orders- POB0.pdf.exe"C:\Users\Admin\AppData\Local\Temp\New Orders- POB0.pdf.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\&startupname&" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA3CF.tmp"2⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpA3CF.tmpFilesize
1KB
MD5dc436ff5b60ef8168376c73a193ed25c
SHA10943c8a1a0851b7b79d31fadb488cce2e0444638
SHA256949ee6cece73e1304479fc963d79d2fd8e6410f451c1ce0ae6fd6e1b40b70705
SHA5121f66711762ef86444a1e4edd5e3105b2ca5e83ec72bc6c2e04c7b5a9de1f50df3a6a85c75fc54003e4ebb0c9d8061455a6ef2e544726536592fb32dbf99736bd
-
memory/640-59-0x0000000000000000-mapping.dmp
-
memory/1008-61-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1008-62-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1008-64-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1968-54-0x0000000001200000-0x00000000012CA000-memory.dmpFilesize
808KB
-
memory/1968-55-0x0000000075EF1000-0x0000000075EF3000-memory.dmpFilesize
8KB
-
memory/1968-56-0x0000000000380000-0x0000000000388000-memory.dmpFilesize
32KB
-
memory/1968-57-0x0000000005210000-0x000000000527E000-memory.dmpFilesize
440KB
-
memory/1968-58-0x00000000005A0000-0x00000000005F6000-memory.dmpFilesize
344KB