Analysis
-
max time kernel
20s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
05-12-2023 16:45
Static task
static1
Behavioral task
behavioral1
Sample
paymentstatus.pdf.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
paymentstatus.pdf.exe
Resource
win10v2004-20231127-en
General
-
Target
paymentstatus.pdf.exe
-
Size
1020KB
-
MD5
95db39b63d249c820c8f4049e0f6cb47
-
SHA1
c7aea8439dc96bdbedb2f6c132ec3507818b66c4
-
SHA256
411b46ed90780c211a99c7b85b753aade4eb1d5e63f3172f0a8149edf109237a
-
SHA512
1bfe8a034f2411498768819e2c4511f657512cf8fe51c7f868557e7a1e507ca08f514a01433261b5116232886546732151c1b1f17f7af742761f2ff3afbeab06
-
SSDEEP
24576:HR34/up+pJCy9lInPiYgpcU7GPm8UXYz1q:x38PJCQ3IPqXV
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.bezzleauto.com - Port:
587 - Username:
[email protected] - Password:
kex#-rHjHM4qKk52 - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
paymentstatus.pdf.exedescription pid process target process PID 2284 wrote to memory of 1412 2284 paymentstatus.pdf.exe powershell.exe PID 2284 wrote to memory of 1412 2284 paymentstatus.pdf.exe powershell.exe PID 2284 wrote to memory of 1412 2284 paymentstatus.pdf.exe powershell.exe PID 2284 wrote to memory of 1412 2284 paymentstatus.pdf.exe powershell.exe PID 2284 wrote to memory of 1948 2284 paymentstatus.pdf.exe powershell.exe PID 2284 wrote to memory of 1948 2284 paymentstatus.pdf.exe powershell.exe PID 2284 wrote to memory of 1948 2284 paymentstatus.pdf.exe powershell.exe PID 2284 wrote to memory of 1948 2284 paymentstatus.pdf.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\paymentstatus.pdf.exe"C:\Users\Admin\AppData\Local\Temp\paymentstatus.pdf.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\zcEARB" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5928.tmp"2⤵
- Creates scheduled task(s)
PID:2804 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵PID:2828
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\zcEARB.exe"2⤵PID:1948
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\paymentstatus.pdf.exe"2⤵PID:1412
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD57e0d67e4171c8f645966fdca580f9149
SHA1461fcc828c8c8c24cbaa1ec53538da92c4c3fd7c
SHA25620ab98238ed3333283b0bc739402bafa54bf4480c75f6eb902905069eb29ad8d
SHA51202ac970a9bb912bf74769516f1550c7989e2b8b34222eaaeb2d725c5da820916571bc5f78e5de85ad321e08fc8ab008d62767067af72a94ead900eab8a0e5024
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\PJC2YJ5T4QKUV586V40H.temp
Filesize7KB
MD513ac23bb216fe719463cfde6a721aa92
SHA190b4310cb9fc985e858dac5d7697fe5a29270062
SHA256c57200a708cfdb267bce12139c86d0598ca889085c75d7b51f33d2fe05bd44f9
SHA512a94964ee8073ee1c7166bac309ced9fc0222e709dae2f6737f7c958215ba38c5791b4540f4014fd7d52b3487d8c106b74e508b827d5e2fe0794e5f8763dc6e91
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize7KB
MD513ac23bb216fe719463cfde6a721aa92
SHA190b4310cb9fc985e858dac5d7697fe5a29270062
SHA256c57200a708cfdb267bce12139c86d0598ca889085c75d7b51f33d2fe05bd44f9
SHA512a94964ee8073ee1c7166bac309ced9fc0222e709dae2f6737f7c958215ba38c5791b4540f4014fd7d52b3487d8c106b74e508b827d5e2fe0794e5f8763dc6e91