General
Target

SSCN_12462020pdf.exe

Filesize

444KB

Completed

21-05-2022 19:00

Task

behavioral2

Score
10/10
MD5

33d17dffd1221cd066f45811323b44b1

SHA1

4412bb573391d3466ba49d0d0451d0bb73b245c8

SHA256

ba2937327a241e543cddc12d8c1648db557d5408cc4fe8d06a5261d2d96896ca

SHA256

b7f6c51325171a8d3d6b89c07ebf6715f74ba4fa19bd62f781719c540494a18c0c659301957b34c6bce4ea5f7cf837fe6f299d7a56d8f97e2cc54bd62b3ae8dd

Malware Config

Extracted

Credentials

Protocol: smtp

Host: secure231.servconfig.com

Port: 587

Username: info@eltaef.com

Password: eltaefSH6548883

Extracted

Family

agenttesla

Credentials

Protocol: smtp

Host: secure231.servconfig.com

Port: 587

Username: info@eltaef.com

Password: eltaefSH6548883

Signatures 15

Filter: none

Collection
Credential Access
Discovery
Persistence
  • AgentTesla

    Description

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • AgentTesla Payload

    Reported IOCs

    resourceyara_rule
    behavioral2/memory/4972-135-0x0000000000400000-0x0000000000452000-memory.dmpfamily_agenttesla
  • Checks computer location settings
    SSCN_12462020pdf.exe

    Description

    Looks up country code configured in the registry, likely geofence.

    TTPs

    Query RegistrySystem Information Discovery

    Reported IOCs

    descriptioniocprocess
    Key value queried\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\NationSSCN_12462020pdf.exe
  • Reads data files stored by FTP clients

    Description

    Tries to access configuration files associated with programs like FileZilla.

    TTPs

    Data from Local SystemCredentials in Files
  • Reads user/profile data of local email clients

    Description

    Email clients store some user data on disk where infostealers will often target it.

    TTPs

    Data from Local SystemCredentials in Files
  • Reads user/profile data of web browsers

    Description

    Infostealers often target stored browser data, which can include saved credentials etc.

    TTPs

    Data from Local SystemCredentials in Files
  • Accesses Microsoft Outlook profiles
    SSCN_12462020pdf.exe

    Tags

    TTPs

    Email Collection

    Reported IOCs

    descriptioniocprocess
    Key opened\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676SSCN_12462020pdf.exe
    Key opened\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676SSCN_12462020pdf.exe
    Key opened\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676SSCN_12462020pdf.exe
  • Suspicious use of SetThreadContext
    SSCN_12462020pdf.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 3004 set thread context of 49723004SSCN_12462020pdf.exeSSCN_12462020pdf.exe
  • Enumerates physical storage devices

    Description

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

    TTPs

    System Information Discovery
  • Creates scheduled task(s)
    schtasks.exe

    Description

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    TTPs

    Scheduled Task

    Reported IOCs

    pidprocess
    704schtasks.exe
  • Suspicious behavior: EnumeratesProcesses
    SSCN_12462020pdf.exeSSCN_12462020pdf.exe

    Reported IOCs

    pidprocess
    3004SSCN_12462020pdf.exe
    3004SSCN_12462020pdf.exe
    3004SSCN_12462020pdf.exe
    3004SSCN_12462020pdf.exe
    3004SSCN_12462020pdf.exe
    3004SSCN_12462020pdf.exe
    4972SSCN_12462020pdf.exe
    4972SSCN_12462020pdf.exe
  • Suspicious use of AdjustPrivilegeToken
    SSCN_12462020pdf.exeSSCN_12462020pdf.exe

    Reported IOCs

    descriptionpidprocess
    Token: SeDebugPrivilege3004SSCN_12462020pdf.exe
    Token: SeDebugPrivilege4972SSCN_12462020pdf.exe
  • Suspicious use of WriteProcessMemory
    SSCN_12462020pdf.exeSSCN_12462020pdf.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 3004 wrote to memory of 7043004SSCN_12462020pdf.exeschtasks.exe
    PID 3004 wrote to memory of 7043004SSCN_12462020pdf.exeschtasks.exe
    PID 3004 wrote to memory of 7043004SSCN_12462020pdf.exeschtasks.exe
    PID 3004 wrote to memory of 36083004SSCN_12462020pdf.exeSSCN_12462020pdf.exe
    PID 3004 wrote to memory of 36083004SSCN_12462020pdf.exeSSCN_12462020pdf.exe
    PID 3004 wrote to memory of 36083004SSCN_12462020pdf.exeSSCN_12462020pdf.exe
    PID 3004 wrote to memory of 49723004SSCN_12462020pdf.exeSSCN_12462020pdf.exe
    PID 3004 wrote to memory of 49723004SSCN_12462020pdf.exeSSCN_12462020pdf.exe
    PID 3004 wrote to memory of 49723004SSCN_12462020pdf.exeSSCN_12462020pdf.exe
    PID 3004 wrote to memory of 49723004SSCN_12462020pdf.exeSSCN_12462020pdf.exe
    PID 3004 wrote to memory of 49723004SSCN_12462020pdf.exeSSCN_12462020pdf.exe
    PID 3004 wrote to memory of 49723004SSCN_12462020pdf.exeSSCN_12462020pdf.exe
    PID 3004 wrote to memory of 49723004SSCN_12462020pdf.exeSSCN_12462020pdf.exe
    PID 3004 wrote to memory of 49723004SSCN_12462020pdf.exeSSCN_12462020pdf.exe
    PID 4972 wrote to memory of 19804972SSCN_12462020pdf.exenetsh.exe
    PID 4972 wrote to memory of 19804972SSCN_12462020pdf.exenetsh.exe
    PID 4972 wrote to memory of 19804972SSCN_12462020pdf.exenetsh.exe
  • outlook_office_path
    SSCN_12462020pdf.exe

    Reported IOCs

    descriptioniocprocess
    Key opened\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676SSCN_12462020pdf.exe
  • outlook_win_path
    SSCN_12462020pdf.exe

    Reported IOCs

    descriptioniocprocess
    Key opened\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676SSCN_12462020pdf.exe
Processes 5
  • C:\Users\Admin\AppData\Local\Temp\SSCN_12462020pdf.exe
    "C:\Users\Admin\AppData\Local\Temp\SSCN_12462020pdf.exe"
    Checks computer location settings
    Suspicious use of SetThreadContext
    Suspicious behavior: EnumeratesProcesses
    Suspicious use of AdjustPrivilegeToken
    Suspicious use of WriteProcessMemory
    PID:3004
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\XkNVCBG" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9D6D.tmp"
      Creates scheduled task(s)
      PID:704
    • C:\Users\Admin\AppData\Local\Temp\SSCN_12462020pdf.exe
      "{path}"
      PID:3608
    • C:\Users\Admin\AppData\Local\Temp\SSCN_12462020pdf.exe
      "{path}"
      Accesses Microsoft Outlook profiles
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      outlook_office_path
      outlook_win_path
      PID:4972
      • C:\Windows\SysWOW64\netsh.exe
        "netsh" wlan show profile
        PID:1980
Network
MITRE ATT&CK Matrix
Command and Control
    Credential Access
    Defense Evasion
      Execution
        Exfiltration
          Impact
            Initial Access
              Lateral Movement
                Persistence
                Privilege Escalation
                  Replay Monitor
                  00:00 00:00
                  Downloads
                  • C:\Users\Admin\AppData\Local\Temp\tmp9D6D.tmp

                    MD5

                    66538ecbbb86302bf17efbd5c7486c36

                    SHA1

                    9631498fb79b9f73995ecb6948397db6e619d53f

                    SHA256

                    c1a6d9c948a90a9faab03ff52971bfb5a7d2ac7e765f747a73acbcc0469cfb40

                    SHA512

                    8c03d105c7c8aceecef6c2caf4fffe04745b771a9685cb84228c4ec78c40f7a7db57c9ba418a67dbe8fdd7b1d88b1b3c599392c60638fd27279a67a0e151f4cb

                  • memory/704-131-0x0000000000000000-mapping.dmp

                  • memory/1980-137-0x0000000000000000-mapping.dmp

                  • memory/3004-130-0x0000000075320000-0x00000000758D1000-memory.dmp

                  • memory/3608-133-0x0000000000000000-mapping.dmp

                  • memory/4972-134-0x0000000000000000-mapping.dmp

                  • memory/4972-135-0x0000000000400000-0x0000000000452000-memory.dmp

                  • memory/4972-136-0x0000000075320000-0x00000000758D1000-memory.dmp