Analysis
-
max time kernel
46s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 11:14
Static task
static1
Behavioral task
behavioral1
Sample
REMITTANCE ADVICE IF011200022823419.pdf - Copy (2).exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
REMITTANCE ADVICE IF011200022823419.pdf - Copy (2).exe
Resource
win10v2004-20220414-en
General
-
Target
REMITTANCE ADVICE IF011200022823419.pdf - Copy (2).exe
-
Size
609KB
-
MD5
c12557a3d973d45b602fbc8784fd8b75
-
SHA1
321569bcfe34e7c751f1efef818d7b2d1337790a
-
SHA256
50bca33857f38988e44abdd9542f348a2f5c4f499822a7eb37b58273b0fecb75
-
SHA512
6cae6fc81ad2f3e4b25e8d793378a2956207f95064c0f00ab86d5c8a2fcfc1214e1eaf28317e10f8cf3c08ebd6eac35f87a6de7254416d8095ab162ca5ec033e
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.stankovic.hr - Port:
587 - Username:
[email protected] - Password:
mp58zg
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/1208-59-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla behavioral1/memory/1208-60-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla behavioral1/memory/1208-61-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla behavioral1/memory/1208-62-0x000000000044741E-mapping.dmp family_agenttesla behavioral1/memory/1208-64-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla behavioral1/memory/1208-66-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla -
Suspicious use of SetThreadContext 1 IoCs
Processes:
REMITTANCE ADVICE IF011200022823419.pdf - Copy (2).exedescription pid process target process PID 380 set thread context of 1208 380 REMITTANCE ADVICE IF011200022823419.pdf - Copy (2).exe RegSvcs.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
REMITTANCE ADVICE IF011200022823419.pdf - Copy (2).exepid process 380 REMITTANCE ADVICE IF011200022823419.pdf - Copy (2).exe 380 REMITTANCE ADVICE IF011200022823419.pdf - Copy (2).exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
REMITTANCE ADVICE IF011200022823419.pdf - Copy (2).exedescription pid process Token: SeDebugPrivilege 380 REMITTANCE ADVICE IF011200022823419.pdf - Copy (2).exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
REMITTANCE ADVICE IF011200022823419.pdf - Copy (2).exeRegSvcs.exedescription pid process target process PID 380 wrote to memory of 1208 380 REMITTANCE ADVICE IF011200022823419.pdf - Copy (2).exe RegSvcs.exe PID 380 wrote to memory of 1208 380 REMITTANCE ADVICE IF011200022823419.pdf - Copy (2).exe RegSvcs.exe PID 380 wrote to memory of 1208 380 REMITTANCE ADVICE IF011200022823419.pdf - Copy (2).exe RegSvcs.exe PID 380 wrote to memory of 1208 380 REMITTANCE ADVICE IF011200022823419.pdf - Copy (2).exe RegSvcs.exe PID 380 wrote to memory of 1208 380 REMITTANCE ADVICE IF011200022823419.pdf - Copy (2).exe RegSvcs.exe PID 380 wrote to memory of 1208 380 REMITTANCE ADVICE IF011200022823419.pdf - Copy (2).exe RegSvcs.exe PID 380 wrote to memory of 1208 380 REMITTANCE ADVICE IF011200022823419.pdf - Copy (2).exe RegSvcs.exe PID 380 wrote to memory of 1208 380 REMITTANCE ADVICE IF011200022823419.pdf - Copy (2).exe RegSvcs.exe PID 380 wrote to memory of 1208 380 REMITTANCE ADVICE IF011200022823419.pdf - Copy (2).exe RegSvcs.exe PID 380 wrote to memory of 1208 380 REMITTANCE ADVICE IF011200022823419.pdf - Copy (2).exe RegSvcs.exe PID 380 wrote to memory of 1208 380 REMITTANCE ADVICE IF011200022823419.pdf - Copy (2).exe RegSvcs.exe PID 380 wrote to memory of 1208 380 REMITTANCE ADVICE IF011200022823419.pdf - Copy (2).exe RegSvcs.exe PID 1208 wrote to memory of 1096 1208 RegSvcs.exe dw20.exe PID 1208 wrote to memory of 1096 1208 RegSvcs.exe dw20.exe PID 1208 wrote to memory of 1096 1208 RegSvcs.exe dw20.exe PID 1208 wrote to memory of 1096 1208 RegSvcs.exe dw20.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\REMITTANCE ADVICE IF011200022823419.pdf - Copy (2).exe"C:\Users\Admin\AppData\Local\Temp\REMITTANCE ADVICE IF011200022823419.pdf - Copy (2).exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"{path}"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 3883⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/380-54-0x00000000765F1000-0x00000000765F3000-memory.dmpFilesize
8KB
-
memory/380-55-0x0000000074FE0000-0x000000007558B000-memory.dmpFilesize
5.7MB
-
memory/1096-68-0x0000000000000000-mapping.dmp
-
memory/1208-56-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1208-57-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1208-59-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1208-60-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1208-61-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1208-62-0x000000000044741E-mapping.dmp
-
memory/1208-64-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1208-66-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1208-70-0x0000000074FE0000-0x000000007558B000-memory.dmpFilesize
5.7MB