Analysis
-
max time kernel
121s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20231025-en -
resource tags
arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system -
submitted
12-12-2023 14:39
Static task
static1
Behavioral task
behavioral1
Sample
OA USD 135,900,88 pdf.exe
Resource
win7-20231025-en
Behavioral task
behavioral2
Sample
OA USD 135,900,88 pdf.exe
Resource
win10v2004-20231130-en
General
-
Target
OA USD 135,900,88 pdf.exe
-
Size
636KB
-
MD5
0e1282c087e1abdbae10d7497cf9579c
-
SHA1
4dd56ae905050e061f557a34c1fdb68d19202412
-
SHA256
ee62838a0de9611ef4a274e1c876605aca8a9548fe14664ab50802aec93bef3a
-
SHA512
6aa9d730f8a4954b5259f0c2b5604e9ddfb7e5a6ac7356af97bd6bf72531a263b04e43388bcfa1e3205e92212274f70d86ccf0a0e546d71f3ad3738cba262a5e
-
SSDEEP
12288:kBgOWP6iZHiFRW3mIBpN9NbjCgtfZRCawRL7Fi54bf4ZgHh1Y:kCp3mwH9Nblfy3NG40gP
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.vrlogistic.com - Port:
587 - Username:
[email protected] - Password:
@dmin@123 - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Detect ZGRat V1 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2940-3-0x0000000000440000-0x0000000000458000-memory.dmp family_zgrat_v1 -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
RegSvcs.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Windows\CurrentVersion\Run\boqXv = "C:\\Users\\Admin\\AppData\\Roaming\\boqXv\\boqXv.exe" RegSvcs.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
OA USD 135,900,88 pdf.exedescription pid process target process PID 2940 set thread context of 2512 2940 OA USD 135,900,88 pdf.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
powershell.exepowershell.exeRegSvcs.exepid process 2104 powershell.exe 2772 powershell.exe 2512 RegSvcs.exe 2512 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
RegSvcs.exepowershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 2512 RegSvcs.exe Token: SeDebugPrivilege 2104 powershell.exe Token: SeDebugPrivilege 2772 powershell.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
OA USD 135,900,88 pdf.exedescription pid process target process PID 2940 wrote to memory of 2772 2940 OA USD 135,900,88 pdf.exe powershell.exe PID 2940 wrote to memory of 2772 2940 OA USD 135,900,88 pdf.exe powershell.exe PID 2940 wrote to memory of 2772 2940 OA USD 135,900,88 pdf.exe powershell.exe PID 2940 wrote to memory of 2772 2940 OA USD 135,900,88 pdf.exe powershell.exe PID 2940 wrote to memory of 2104 2940 OA USD 135,900,88 pdf.exe powershell.exe PID 2940 wrote to memory of 2104 2940 OA USD 135,900,88 pdf.exe powershell.exe PID 2940 wrote to memory of 2104 2940 OA USD 135,900,88 pdf.exe powershell.exe PID 2940 wrote to memory of 2104 2940 OA USD 135,900,88 pdf.exe powershell.exe PID 2940 wrote to memory of 2700 2940 OA USD 135,900,88 pdf.exe schtasks.exe PID 2940 wrote to memory of 2700 2940 OA USD 135,900,88 pdf.exe schtasks.exe PID 2940 wrote to memory of 2700 2940 OA USD 135,900,88 pdf.exe schtasks.exe PID 2940 wrote to memory of 2700 2940 OA USD 135,900,88 pdf.exe schtasks.exe PID 2940 wrote to memory of 2512 2940 OA USD 135,900,88 pdf.exe RegSvcs.exe PID 2940 wrote to memory of 2512 2940 OA USD 135,900,88 pdf.exe RegSvcs.exe PID 2940 wrote to memory of 2512 2940 OA USD 135,900,88 pdf.exe RegSvcs.exe PID 2940 wrote to memory of 2512 2940 OA USD 135,900,88 pdf.exe RegSvcs.exe PID 2940 wrote to memory of 2512 2940 OA USD 135,900,88 pdf.exe RegSvcs.exe PID 2940 wrote to memory of 2512 2940 OA USD 135,900,88 pdf.exe RegSvcs.exe PID 2940 wrote to memory of 2512 2940 OA USD 135,900,88 pdf.exe RegSvcs.exe PID 2940 wrote to memory of 2512 2940 OA USD 135,900,88 pdf.exe RegSvcs.exe PID 2940 wrote to memory of 2512 2940 OA USD 135,900,88 pdf.exe RegSvcs.exe PID 2940 wrote to memory of 2512 2940 OA USD 135,900,88 pdf.exe RegSvcs.exe PID 2940 wrote to memory of 2512 2940 OA USD 135,900,88 pdf.exe RegSvcs.exe PID 2940 wrote to memory of 2512 2940 OA USD 135,900,88 pdf.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\OA USD 135,900,88 pdf.exe"C:\Users\Admin\AppData\Local\Temp\OA USD 135,900,88 pdf.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\OA USD 135,900,88 pdf.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2772 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\qZguDG.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2104 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qZguDG" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8A65.tmp"2⤵
- Creates scheduled task(s)
PID:2700 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2512
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD595746b459e5ab29516e6d6d57c94e469
SHA1fd6544522eb36be92a0afa173bee1b01bb2a1769
SHA25640ec38a0081624fd804f86b200d3f1a90ca336d997edd2d9b6b189d0f53f3ec3
SHA5127dc3998befc129ba5488c286df81f3d97c7227cbaaa63da6c42992772132ce2dec9105a3fef67e88ae16ce2b68f03d53fc1a4d9ec491b52f40b9205c9f7c025c
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize7KB
MD51618dc474a48a22017f705cd6983bd75
SHA12226b4df7456bd90583d219574910c71b4195d83
SHA25693f350dee515fd29dbd348426eea089be38600a8e8425cfc879665182b278c01
SHA5127812b33f22ae795777d843b4d7868ad39f955d53bc749de1b8c71f1426eb6cade95689652822cb433d78da388440547330d65b704f9c26352fd6ed3367c7e52f