Analysis
-
max time kernel
121s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
05-12-2023 17:43
Static task
static1
Behavioral task
behavioral1
Sample
RFQMI0016047.pdf.pdf.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
RFQMI0016047.pdf.pdf.exe
Resource
win10v2004-20231130-en
General
-
Target
RFQMI0016047.pdf.pdf.exe
-
Size
726KB
-
MD5
c2cf87df8ae0643cc3fabb68833ee93a
-
SHA1
b086db553cbe24f70a6c8e79ace0323d6bc93553
-
SHA256
e9f611aaae38af4a81b3dda7c5997a4c8e852b6b87f4462b70bf5b5fa016e584
-
SHA512
96f8ff4226e3637fe254a3892397109ee2db3e3e17bf4b48eeaf596823d8adc2a62d8a66e4d69132212d6168c0975fa890fd0d0eaef39fda891d2e88d4ec20be
-
SSDEEP
12288:hgKE6jD/62iNG5nF81Gh2OojBxMHRaw3HaboW9IQM76K3y0Q9:hgKtD/61I4Gh2nrMHRaw3HabzINGwy0e
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
us2.smtp.mailhostbox.com - Port:
587 - Username:
[email protected] - Password:
JUGCRsm9 - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
RegSvcs.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe Key opened \REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe Key opened \REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
RFQMI0016047.pdf.pdf.exedescription pid process target process PID 2072 set thread context of 2948 2072 RFQMI0016047.pdf.pdf.exe RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RegSvcs.exedescription pid process Token: SeDebugPrivilege 2948 RegSvcs.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
RFQMI0016047.pdf.pdf.exedescription pid process target process PID 2072 wrote to memory of 2948 2072 RFQMI0016047.pdf.pdf.exe RegSvcs.exe PID 2072 wrote to memory of 2948 2072 RFQMI0016047.pdf.pdf.exe RegSvcs.exe PID 2072 wrote to memory of 2948 2072 RFQMI0016047.pdf.pdf.exe RegSvcs.exe PID 2072 wrote to memory of 2948 2072 RFQMI0016047.pdf.pdf.exe RegSvcs.exe PID 2072 wrote to memory of 2948 2072 RFQMI0016047.pdf.pdf.exe RegSvcs.exe PID 2072 wrote to memory of 2948 2072 RFQMI0016047.pdf.pdf.exe RegSvcs.exe PID 2072 wrote to memory of 2948 2072 RFQMI0016047.pdf.pdf.exe RegSvcs.exe PID 2072 wrote to memory of 2948 2072 RFQMI0016047.pdf.pdf.exe RegSvcs.exe PID 2072 wrote to memory of 2948 2072 RFQMI0016047.pdf.pdf.exe RegSvcs.exe PID 2072 wrote to memory of 2948 2072 RFQMI0016047.pdf.pdf.exe RegSvcs.exe PID 2072 wrote to memory of 2948 2072 RFQMI0016047.pdf.pdf.exe RegSvcs.exe PID 2072 wrote to memory of 2948 2072 RFQMI0016047.pdf.pdf.exe RegSvcs.exe -
outlook_office_path 1 IoCs
Processes:
RegSvcs.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe -
outlook_win_path 1 IoCs
Processes:
RegSvcs.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\RFQMI0016047.pdf.pdf.exe"C:\Users\Admin\AppData\Local\Temp\RFQMI0016047.pdf.pdf.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:2948