Analysis
-
max time kernel
2s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20231127-en -
resource tags
-
submitted
04-12-2023 17:09
General
-
Target
231730028-2023-Dec-04 pdf.exe
-
Size
477KB
-
MD5
38e85567ecbe691d6319179e8e42fab2
-
SHA1
72f8f419447da72e61518a7ecdf433a4b05aa458
-
SHA256
188b48895639573a36270e0693569d98f7a673c975478927559c3eadd6d83839
-
SHA512
78c77591b9e381d9b3bf962693ec00f0ae94cadee813837095d4fb1e16282a93791d03a4323a52e57870632d7e09227cba1baaeee164264fb174e64a5d7c5d75
-
SSDEEP
12288:xkNqHWr7yJzMij4kfciX/wtf7FPEvPDvmtj9yx:xUq+IIefziB8vKjQx
Malware Config
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Executes dropped EXE 2 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\231730028-2023-Dec-04 pdf.exe"C:\Users\Admin\AppData\Local\Temp\231730028-2023-Dec-04 pdf.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\cpngrtzp.exe"C:\Users\Admin\AppData\Local\Temp\cpngrtzp.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\cpngrtzp.exe"C:\Users\Admin\AppData\Local\Temp\cpngrtzp.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
335KB
MD503a408bbf961a94b9448aad8fed24336
SHA1df08dc867912e252d48d23d599e21a0c90f3d914
SHA2563d1155039ceb52969ebb93595ee5d3e2899ef72d98619c86439edd7a91d7d248
SHA51269d145792d23e45419e3070c73d410506aab6ebc091c1ab70320b92f10c1b2aca5795d70e8213458e990c4be3b3d50a98675b647a51e98c626c064bcb5944643
-
Filesize
287KB
MD5ccac95bbd8877f49efc523f125489bb1
SHA192ee3a54136bded5f1c17d25fdbb553caf2eb3aa
SHA2562025846378bd3d25c2c9d16e2132870ae30372cc8f51c330c07c36c47f6b2b6f
SHA512bc0f73899bbb8774e3fea93803be7d0b5db2074bc5fc4c704b8d877ac4612dee42199a5d5104155f3db4847aa50b253adfa93dde062747d9b5825baf5be42a3f
-
Filesize
287KB
MD5ccac95bbd8877f49efc523f125489bb1
SHA192ee3a54136bded5f1c17d25fdbb553caf2eb3aa
SHA2562025846378bd3d25c2c9d16e2132870ae30372cc8f51c330c07c36c47f6b2b6f
SHA512bc0f73899bbb8774e3fea93803be7d0b5db2074bc5fc4c704b8d877ac4612dee42199a5d5104155f3db4847aa50b253adfa93dde062747d9b5825baf5be42a3f
-
Filesize
287KB
MD5ccac95bbd8877f49efc523f125489bb1
SHA192ee3a54136bded5f1c17d25fdbb553caf2eb3aa
SHA2562025846378bd3d25c2c9d16e2132870ae30372cc8f51c330c07c36c47f6b2b6f
SHA512bc0f73899bbb8774e3fea93803be7d0b5db2074bc5fc4c704b8d877ac4612dee42199a5d5104155f3db4847aa50b253adfa93dde062747d9b5825baf5be42a3f
-
Filesize
1024KB
-
Filesize
64KB
-
Filesize
5.6MB
-
Filesize
332KB
-
Filesize
332KB
-
Filesize
64KB
-
Filesize
332KB
-
Filesize
64KB
-
Filesize
264KB
-
Filesize
7.7MB
-
Filesize
332KB
-
Filesize
408KB
-
Filesize
320KB
-
Filesize
40KB
-
Filesize
584KB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB