Analysis
-
max time kernel
119s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system -
submitted
03-12-2023 16:22
Static task
static1
Behavioral task
behavioral1
Sample
CBDPOFAEDSWIFTREF8290019999210000082881914822PDF.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
CBDPOFAEDSWIFTREF8290019999210000082881914822PDF.exe
Resource
win10v2004-20231127-en
General
-
Target
CBDPOFAEDSWIFTREF8290019999210000082881914822PDF.exe
-
Size
3.5MB
-
MD5
996e8a56754289b12368c9241074ae5e
-
SHA1
776be5998df180449446f656548b586c04e4576a
-
SHA256
1d8e06ad54176ef3faa63ff7f9cc4f6309d0f90ac75d9379308a36b85e6c4955
-
SHA512
a8190cdff462125b33716761d08359918397f3abad5cc3d08d3177f823f7ada68f1399d53bdb96d8e188cfbe23bfbc8793b997b2c18f3d04252c1be8f590dcd8
-
SSDEEP
49152:q05SIbcRH7CT+crs48aWjE/gF/NmkK+c3XSMkbhe:bRC/vg
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot6899220110:AAEhS6HDsWPgi27wKN8gxlKUKVJ8RH74u0w/
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
CasPol.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Windows\CurrentVersion\Run\mxbVhQE = "C:\\Users\\Admin\\AppData\\Roaming\\mxbVhQE\\mxbVhQE.exe" CasPol.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 api.ipify.org 5 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
CBDPOFAEDSWIFTREF8290019999210000082881914822PDF.exedescription pid process target process PID 1108 set thread context of 3056 1108 CBDPOFAEDSWIFTREF8290019999210000082881914822PDF.exe CasPol.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
CasPol.exepid process 3056 CasPol.exe 3056 CasPol.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
CasPol.exedescription pid process Token: SeDebugPrivilege 3056 CasPol.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
CasPol.exepid process 3056 CasPol.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
CBDPOFAEDSWIFTREF8290019999210000082881914822PDF.exedescription pid process target process PID 1108 wrote to memory of 2520 1108 CBDPOFAEDSWIFTREF8290019999210000082881914822PDF.exe CasPol.exe PID 1108 wrote to memory of 2520 1108 CBDPOFAEDSWIFTREF8290019999210000082881914822PDF.exe CasPol.exe PID 1108 wrote to memory of 2520 1108 CBDPOFAEDSWIFTREF8290019999210000082881914822PDF.exe CasPol.exe PID 1108 wrote to memory of 2520 1108 CBDPOFAEDSWIFTREF8290019999210000082881914822PDF.exe CasPol.exe PID 1108 wrote to memory of 3056 1108 CBDPOFAEDSWIFTREF8290019999210000082881914822PDF.exe CasPol.exe PID 1108 wrote to memory of 3056 1108 CBDPOFAEDSWIFTREF8290019999210000082881914822PDF.exe CasPol.exe PID 1108 wrote to memory of 3056 1108 CBDPOFAEDSWIFTREF8290019999210000082881914822PDF.exe CasPol.exe PID 1108 wrote to memory of 3056 1108 CBDPOFAEDSWIFTREF8290019999210000082881914822PDF.exe CasPol.exe PID 1108 wrote to memory of 3056 1108 CBDPOFAEDSWIFTREF8290019999210000082881914822PDF.exe CasPol.exe PID 1108 wrote to memory of 3056 1108 CBDPOFAEDSWIFTREF8290019999210000082881914822PDF.exe CasPol.exe PID 1108 wrote to memory of 3056 1108 CBDPOFAEDSWIFTREF8290019999210000082881914822PDF.exe CasPol.exe PID 1108 wrote to memory of 3056 1108 CBDPOFAEDSWIFTREF8290019999210000082881914822PDF.exe CasPol.exe PID 1108 wrote to memory of 3056 1108 CBDPOFAEDSWIFTREF8290019999210000082881914822PDF.exe CasPol.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\CBDPOFAEDSWIFTREF8290019999210000082881914822PDF.exe"C:\Users\Admin\AppData\Local\Temp\CBDPOFAEDSWIFTREF8290019999210000082881914822PDF.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"2⤵PID:2520
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3056