Analysis
-
max time kernel
128s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
19/01/2024, 01:01
General
-
Target
Adobe-Reader-v8.0-latest-installer.exe
-
Size
739KB
-
MD5
ea4d51289540e3f418cff48fc0f8396e
-
SHA1
0a753425bd0b51897295ad85af3be6713f3c4cd7
-
SHA256
47a05b7efdfad238172f1e804fb8a681b88281fae68e9a6efabe9b175c1572f7
-
SHA512
4fb55ed3d90bf47b23fcf558d045ef8fb05e7e8f7901e5cdcd6707972c0b7b6f675a7408462d409e7bf067028bf9f27187b7971ff03f23e44d1a9bfae81ae19e
-
SSDEEP
12288:ybSh1Au/reSjYYp3w1l3zO07iZBo7ZjqxE7iMK7x/n5HbbvC1pAFofnA9zEGG9Qj:ybS3Au/reSsYp3wasiro7tq4a/n1C1qL
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.profilatieffe.it - Port:
587 - Username:
[email protected] - Password:
Pasu4Bio - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Loads dropped DLL 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Adobe-Reader-v8.0-latest-installer.exe"C:\Users\Admin\AppData\Local\Temp\Adobe-Reader-v8.0-latest-installer.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"C:\Users\Admin\AppData\Local\Temp\Adobe-Reader-v8.0-latest-installer.exe"2⤵
- Adds Run key to start application
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2360 -s 19643⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2360 -ip 23601⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12KB
MD5cff85c549d536f651d4fb8387f1976f2
SHA1d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
SHA2568dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
SHA512531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
-
Filesize
18.3MB
-
Filesize
20.7MB
-
Filesize
7.7MB
-
Filesize
20.7MB
-
Filesize
4KB
-
Filesize
7.7MB
-
Filesize
1.1MB
-
Filesize
18.3MB
-
Filesize
28KB
-
Filesize
20.7MB
-
Filesize
1.1MB
-
Filesize
20.7MB