Analysis
-
max time kernel
140s -
max time network
135s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
21-05-2022 02:26
Static task
static1
Behavioral task
behavioral1
Sample
PEDIDO#4965832-pdf.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
PEDIDO#4965832-pdf.exe
Resource
win10v2004-20220414-en
General
-
Target
PEDIDO#4965832-pdf.exe
-
Size
766KB
-
MD5
cd53bb5a8efb8397089db59307b51406
-
SHA1
b6749766413cdd7a7c6b58bb1d596a6d4478e1a4
-
SHA256
d44272fe83f10383b50e8268ffe5f7f70e1c2b355363ccde038172f6a9eb5479
-
SHA512
5931d2c2966e2ca76ac307d4742acc2847da04bceaf02475e2d9bf0b3e081aeed4bb5caf2396a417bc3194cf6cda4c3d6b38538e75cb5a32a934e6ab62004f41
Malware Config
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/3160-136-0x0000000000400000-0x000000000045A000-memory.dmp family_agenttesla -
Executes dropped EXE 1 IoCs
Processes:
RegAsm.exepid process 3160 RegAsm.exe -
Loads dropped DLL 1 IoCs
Processes:
PEDIDO#4965832-pdf.exepid process 3996 PEDIDO#4965832-pdf.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
RegAsm.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegAsm.exe Key opened \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegAsm.exe Key opened \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegAsm.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
PEDIDO#4965832-pdf.exedescription pid process target process PID 3996 set thread context of 3160 3996 PEDIDO#4965832-pdf.exe RegAsm.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 400 3160 WerFault.exe RegAsm.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
PEDIDO#4965832-pdf.exeRegAsm.exepid process 3996 PEDIDO#4965832-pdf.exe 3996 PEDIDO#4965832-pdf.exe 3996 PEDIDO#4965832-pdf.exe 3160 RegAsm.exe 3160 RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
PEDIDO#4965832-pdf.exeRegAsm.exedescription pid process Token: SeDebugPrivilege 3996 PEDIDO#4965832-pdf.exe Token: SeDebugPrivilege 3160 RegAsm.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
PEDIDO#4965832-pdf.exedescription pid process target process PID 3996 wrote to memory of 3160 3996 PEDIDO#4965832-pdf.exe RegAsm.exe PID 3996 wrote to memory of 3160 3996 PEDIDO#4965832-pdf.exe RegAsm.exe PID 3996 wrote to memory of 3160 3996 PEDIDO#4965832-pdf.exe RegAsm.exe PID 3996 wrote to memory of 3160 3996 PEDIDO#4965832-pdf.exe RegAsm.exe PID 3996 wrote to memory of 3160 3996 PEDIDO#4965832-pdf.exe RegAsm.exe PID 3996 wrote to memory of 3160 3996 PEDIDO#4965832-pdf.exe RegAsm.exe PID 3996 wrote to memory of 3160 3996 PEDIDO#4965832-pdf.exe RegAsm.exe PID 3996 wrote to memory of 3160 3996 PEDIDO#4965832-pdf.exe RegAsm.exe -
outlook_office_path 1 IoCs
Processes:
RegAsm.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegAsm.exe -
outlook_win_path 1 IoCs
Processes:
RegAsm.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegAsm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PEDIDO#4965832-pdf.exe"C:\Users\Admin\AppData\Local\Temp\PEDIDO#4965832-pdf.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RegAsm.exe"C:\Users\Admin\AppData\Local\Temp\RegAsm.exe"2⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3160 -s 16563⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3160 -ip 31601⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\305ca9ce-05a7-4081-bcf5-b3110c43e68e\l.dllFilesize
94KB
MD514ff402962ad21b78ae0b4c43cd1f194
SHA1f8a510eb26666e875a5bdd1cadad40602763ad72
SHA256fb9646cb956945bdc503e69645f6b5316d3826b780d3c36738d6b944e884d15b
SHA512daa7a08bf3709119a944bce28f6ebdd24e54a22b18cd9f86a87873e958df121a3881dcdd5e162f6b4e543238c7aef20f657c9830df01d4c79290f7c9a4fcc54b
-
C:\Users\Admin\AppData\Local\Temp\RegAsm.exeFilesize
63KB
MD50d5df43af2916f47d00c1573797c1a13
SHA1230ab5559e806574d26b4c20847c368ed55483b0
SHA256c066aee7aa3aa83f763ebc5541daa266ed6c648fbffcde0d836a13b221bb2adc
SHA512f96cf9e1890746b12daf839a6d0f16f062b72c1b8a40439f96583f242980f10f867720232a6fa0f7d4d7ac0a7a6143981a5a130d6417ea98b181447134c7cfe2
-
C:\Users\Admin\AppData\Local\Temp\RegAsm.exeFilesize
63KB
MD50d5df43af2916f47d00c1573797c1a13
SHA1230ab5559e806574d26b4c20847c368ed55483b0
SHA256c066aee7aa3aa83f763ebc5541daa266ed6c648fbffcde0d836a13b221bb2adc
SHA512f96cf9e1890746b12daf839a6d0f16f062b72c1b8a40439f96583f242980f10f867720232a6fa0f7d4d7ac0a7a6143981a5a130d6417ea98b181447134c7cfe2
-
memory/3160-135-0x0000000000000000-mapping.dmp
-
memory/3160-136-0x0000000000400000-0x000000000045A000-memory.dmpFilesize
360KB
-
memory/3160-139-0x00000000055D0000-0x000000000566C000-memory.dmpFilesize
624KB
-
memory/3160-140-0x0000000005AE0000-0x0000000005B46000-memory.dmpFilesize
408KB
-
memory/3160-141-0x0000000006730000-0x0000000006780000-memory.dmpFilesize
320KB
-
memory/3996-130-0x0000000000070000-0x0000000000136000-memory.dmpFilesize
792KB
-
memory/3996-132-0x0000000073D90000-0x0000000073E19000-memory.dmpFilesize
548KB
-
memory/3996-133-0x0000000005B10000-0x00000000060B4000-memory.dmpFilesize
5.6MB
-
memory/3996-134-0x0000000005640000-0x00000000056D2000-memory.dmpFilesize
584KB