Analysis

  • max time kernel
    83s
  • max time network
    127s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/05/2023, 20:53

General

  • Target

    order02390021.pdf.exe

  • Size

    577KB

  • MD5

    9b97c94ca5dfdfc77b75477e4eebe867

  • SHA1

    af95d435b3cd20e787e3aa0f50ff6437dc68ced9

  • SHA256

    0494623f46dee59028737fd272af2a35b144c38bd2a0a5f8ebcb131a45aaf71c

  • SHA512

    7cef268740957fc3537b91c9420d29b5765464d1cb90b382b90a3a1155a5657a041068e5c55573fc540190a9f5b6a00ddf5dd1ff45065252dfae3b1881edc23b

  • SSDEEP

    12288:HxMHFzrA/lsELhbTmbwBspjGP+P4MrEyTQ+K/4mIB9Y6PL:qrA/+ELha0/mPfDQ+KgmITY6PL

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot5547723454:AAHqewaHCTcN2ZyoJn_xzOGn7Rzrt3kXyY8/

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Detects Redline Stealer samples 2 IoCs

    This rule detects the presence of Redline Stealer samples based on their unique strings.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\order02390021.pdf.exe
    "C:\Users\Admin\AppData\Local\Temp\order02390021.pdf.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4256
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\qWuJJOTZmSL.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:964
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qWuJJOTZmSL" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2E53.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:2508
    • C:\Users\Admin\AppData\Local\Temp\order02390021.pdf.exe
      "C:\Users\Admin\AppData\Local\Temp\order02390021.pdf.exe"
      2⤵
      • Accesses Microsoft Outlook profiles
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • outlook_office_path
      • outlook_win_path
      PID:4592

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\order02390021.pdf.exe.log

          Filesize

          1KB

          MD5

          33d62ef2c354f839a8b2b987e6ee41e7

          SHA1

          d76f64ac411a61f3f232f7f9f7b179bd34042226

          SHA256

          f6a84062cb11ccf802324692c2c4c48543377cf717d98efd5de695ed6d0a97d9

          SHA512

          d68a426b2f4646bb45e2267d60680166a8effb9a461e5a07756ba13a3bdf36b27e6e9777d945d03a62362e6976e92214c53ffc7c4f03ec28d3fcfc9a442c5e3c

        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tkdsnnem.vqc.ps1

          Filesize

          60B

          MD5

          d17fe0a3f47be24a6453e9ef58c94641

          SHA1

          6ab83620379fc69f80c0242105ddffd7d98d5d9d

          SHA256

          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

          SHA512

          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

        • C:\Users\Admin\AppData\Local\Temp\tmp2E53.tmp

          Filesize

          1KB

          MD5

          db264ec7a58cf38309e23e4dd272893d

          SHA1

          c20ef09b9fe722ba5a1d63741c78d1dfe0a8cb78

          SHA256

          9589de96c4e1e8d8c47ce2cfc4cfdcd475b406edce1dbb76b0a604a3873485fb

          SHA512

          93c272b16982bbc988d1bfc8bbb59df31095a53e7c926415e691ccaca9abc6d7b8d3409f10eee9446fee8801093525971256e7616e474b8ee1b96deeb38f17ff

        • C:\Users\Admin\AppData\Roaming\GsHLJkZ\GsHLJkZ.exe

          Filesize

          577KB

          MD5

          9b97c94ca5dfdfc77b75477e4eebe867

          SHA1

          af95d435b3cd20e787e3aa0f50ff6437dc68ced9

          SHA256

          0494623f46dee59028737fd272af2a35b144c38bd2a0a5f8ebcb131a45aaf71c

          SHA512

          7cef268740957fc3537b91c9420d29b5765464d1cb90b382b90a3a1155a5657a041068e5c55573fc540190a9f5b6a00ddf5dd1ff45065252dfae3b1881edc23b

        • memory/964-154-0x0000000005C20000-0x0000000005C86000-memory.dmp

          Filesize

          408KB

        • memory/964-170-0x0000000070C10000-0x0000000070C5C000-memory.dmp

          Filesize

          304KB

        • memory/964-186-0x0000000007870000-0x0000000007906000-memory.dmp

          Filesize

          600KB

        • memory/964-144-0x0000000002930000-0x0000000002966000-memory.dmp

          Filesize

          216KB

        • memory/964-185-0x0000000007660000-0x000000000766A000-memory.dmp

          Filesize

          40KB

        • memory/964-146-0x0000000002AB0000-0x0000000002AC0000-memory.dmp

          Filesize

          64KB

        • memory/964-147-0x0000000002AB0000-0x0000000002AC0000-memory.dmp

          Filesize

          64KB

        • memory/964-148-0x0000000005460000-0x0000000005A88000-memory.dmp

          Filesize

          6.2MB

        • memory/964-184-0x00000000075F0000-0x000000000760A000-memory.dmp

          Filesize

          104KB

        • memory/964-183-0x0000000007C30000-0x00000000082AA000-memory.dmp

          Filesize

          6.5MB

        • memory/964-152-0x00000000051A0000-0x00000000051C2000-memory.dmp

          Filesize

          136KB

        • memory/964-153-0x0000000005B00000-0x0000000005B66000-memory.dmp

          Filesize

          408KB

        • memory/964-182-0x000000007EF30000-0x000000007EF40000-memory.dmp

          Filesize

          64KB

        • memory/964-181-0x0000000002AB0000-0x0000000002AC0000-memory.dmp

          Filesize

          64KB

        • memory/964-164-0x00000000062E0000-0x00000000062FE000-memory.dmp

          Filesize

          120KB

        • memory/964-189-0x0000000007910000-0x0000000007918000-memory.dmp

          Filesize

          32KB

        • memory/964-180-0x0000000006890000-0x00000000068AE000-memory.dmp

          Filesize

          120KB

        • memory/964-188-0x0000000007930000-0x000000000794A000-memory.dmp

          Filesize

          104KB

        • memory/964-169-0x0000000007290000-0x00000000072C2000-memory.dmp

          Filesize

          200KB

        • memory/964-187-0x0000000007820000-0x000000000782E000-memory.dmp

          Filesize

          56KB

        • memory/4256-134-0x0000000005D40000-0x00000000062E4000-memory.dmp

          Filesize

          5.6MB

        • memory/4256-135-0x00000000056A0000-0x0000000005732000-memory.dmp

          Filesize

          584KB

        • memory/4256-133-0x0000000000D90000-0x0000000000E26000-memory.dmp

          Filesize

          600KB

        • memory/4256-136-0x0000000005940000-0x0000000005950000-memory.dmp

          Filesize

          64KB

        • memory/4256-138-0x0000000005940000-0x0000000005950000-memory.dmp

          Filesize

          64KB

        • memory/4256-137-0x0000000005760000-0x000000000576A000-memory.dmp

          Filesize

          40KB

        • memory/4256-139-0x0000000007850000-0x00000000078EC000-memory.dmp

          Filesize

          624KB

        • memory/4592-149-0x0000000000400000-0x000000000042E000-memory.dmp

          Filesize

          184KB

        • memory/4592-168-0x0000000006950000-0x00000000069A0000-memory.dmp

          Filesize

          320KB

        • memory/4592-165-0x0000000005120000-0x0000000005130000-memory.dmp

          Filesize

          64KB

        • memory/4592-192-0x0000000005120000-0x0000000005130000-memory.dmp

          Filesize

          64KB