Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system -
submitted
23/02/2024, 11:30
Static task
static1
Behavioral task
behavioral1
Sample
SRF Industries (Thailand) Ltd.pdf.exe
Resource
win7-20240221-en
General
-
Target
SRF Industries (Thailand) Ltd.pdf.exe
-
Size
40KB
-
MD5
26c95e5acba77d7fd14d109c94f75cca
-
SHA1
56359d96cd63d66b51eb49acd46d8df25f170c30
-
SHA256
32272f676a500007b4321f7c076ec3169305615e230dad3d89c63e0cfd24c1c6
-
SHA512
6b2bd0a6240a13b641d005dc34cd364fd5eb2bb861d49d33bf826766ea0daf4a264f1182905363720b6a8bfad03d97386e965863578e57cf2cf5403d1309363a
-
SSDEEP
768:1pc7ngE+7L+Phy83dWrz7lwHZjl7GdoUNIBBv5r:1Aj+7100rz7lwHj7QSBvJ
Malware Config
Extracted
Protocol: smtp- Host:
mail.supplyvan.xyz - Port:
587 - Username:
[email protected] - Password:
Ifeanyi1987@
Extracted
agenttesla
Protocol: smtp- Host:
mail.supplyvan.xyz - Port:
587 - Username:
[email protected] - Password:
Ifeanyi1987@ - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Contacts a large (4590) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 8088 ip-api.com -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4720 set thread context of 4136 4720 SRF Industries (Thailand) Ltd.pdf.exe 91 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4136 CasPol.exe 4136 CasPol.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4720 SRF Industries (Thailand) Ltd.pdf.exe Token: SeDebugPrivilege 4136 CasPol.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 4720 wrote to memory of 4136 4720 SRF Industries (Thailand) Ltd.pdf.exe 91 PID 4720 wrote to memory of 4136 4720 SRF Industries (Thailand) Ltd.pdf.exe 91 PID 4720 wrote to memory of 4136 4720 SRF Industries (Thailand) Ltd.pdf.exe 91 PID 4720 wrote to memory of 4136 4720 SRF Industries (Thailand) Ltd.pdf.exe 91 PID 4720 wrote to memory of 4136 4720 SRF Industries (Thailand) Ltd.pdf.exe 91 PID 4720 wrote to memory of 4136 4720 SRF Industries (Thailand) Ltd.pdf.exe 91 PID 4720 wrote to memory of 4136 4720 SRF Industries (Thailand) Ltd.pdf.exe 91 PID 4720 wrote to memory of 4136 4720 SRF Industries (Thailand) Ltd.pdf.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\SRF Industries (Thailand) Ltd.pdf.exe"C:\Users\Admin\AppData\Local\Temp\SRF Industries (Thailand) Ltd.pdf.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4136
-