Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
28-03-2024 13:22
Static task
static1
Behavioral task
behavioral1
Sample
quotation#247833.pdf.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
quotation#247833.pdf.exe
Resource
win10v2004-20240226-en
General
-
Target
quotation#247833.pdf.exe
-
Size
612KB
-
MD5
52bbe58331758dd37f776189080a5ead
-
SHA1
2542cfdfee6da01c4657c13b3327ebf6f91d42da
-
SHA256
825a37255a61598eaa9eb15897dbc89f7e3637193c4e17775fbbc145ca523528
-
SHA512
a99a78ccc4ccc8fd2797d4f2f2c766c9043dd1dbbc7a588680d0472c43c44a78e31212c38f1753196cf0609e65b079b12656a59a934ae36ed4ff3e4f9312e5b8
-
SSDEEP
12288:S5+SDlnIqMoroxB4559YxaxO2b0NJk+mYRSn9//kcCR8gyn8M4Rxg:CzM7xy559YxaxT0NJkiRU+cCR8VD4fg
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
email.globeauto.in - Port:
587 - Username:
ch02a_warranty@globeauto.in - Password:
Mohali@@1# - Email To:
omdbox@protonmail.com
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
quotation#247833.pdf.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation quotation#247833.pdf.exe -
Executes dropped EXE 1 IoCs
Processes:
svchost.exepid process 2996 svchost.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
quotation#247833.pdf.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost = "\"C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe\"" quotation#247833.pdf.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
svchost.exedescription pid process target process PID 2996 set thread context of 3856 2996 svchost.exe regasm.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 4276 timeout.exe -
Suspicious behavior: EnumeratesProcesses 28 IoCs
Processes:
quotation#247833.pdf.exeregasm.exepid process 4456 quotation#247833.pdf.exe 4456 quotation#247833.pdf.exe 4456 quotation#247833.pdf.exe 4456 quotation#247833.pdf.exe 4456 quotation#247833.pdf.exe 4456 quotation#247833.pdf.exe 4456 quotation#247833.pdf.exe 4456 quotation#247833.pdf.exe 4456 quotation#247833.pdf.exe 4456 quotation#247833.pdf.exe 4456 quotation#247833.pdf.exe 4456 quotation#247833.pdf.exe 4456 quotation#247833.pdf.exe 4456 quotation#247833.pdf.exe 4456 quotation#247833.pdf.exe 4456 quotation#247833.pdf.exe 4456 quotation#247833.pdf.exe 4456 quotation#247833.pdf.exe 4456 quotation#247833.pdf.exe 4456 quotation#247833.pdf.exe 4456 quotation#247833.pdf.exe 4456 quotation#247833.pdf.exe 4456 quotation#247833.pdf.exe 4456 quotation#247833.pdf.exe 4456 quotation#247833.pdf.exe 4456 quotation#247833.pdf.exe 3856 regasm.exe 3856 regasm.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
quotation#247833.pdf.exesvchost.exeregasm.exedescription pid process Token: SeDebugPrivilege 4456 quotation#247833.pdf.exe Token: SeDebugPrivilege 2996 svchost.exe Token: SeDebugPrivilege 3856 regasm.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
quotation#247833.pdf.execmd.execmd.exesvchost.exedescription pid process target process PID 4456 wrote to memory of 1528 4456 quotation#247833.pdf.exe cmd.exe PID 4456 wrote to memory of 1528 4456 quotation#247833.pdf.exe cmd.exe PID 4456 wrote to memory of 2308 4456 quotation#247833.pdf.exe cmd.exe PID 4456 wrote to memory of 2308 4456 quotation#247833.pdf.exe cmd.exe PID 1528 wrote to memory of 2016 1528 cmd.exe schtasks.exe PID 1528 wrote to memory of 2016 1528 cmd.exe schtasks.exe PID 2308 wrote to memory of 4276 2308 cmd.exe timeout.exe PID 2308 wrote to memory of 4276 2308 cmd.exe timeout.exe PID 2308 wrote to memory of 2996 2308 cmd.exe svchost.exe PID 2308 wrote to memory of 2996 2308 cmd.exe svchost.exe PID 2996 wrote to memory of 3856 2996 svchost.exe regasm.exe PID 2996 wrote to memory of 3856 2996 svchost.exe regasm.exe PID 2996 wrote to memory of 3856 2996 svchost.exe regasm.exe PID 2996 wrote to memory of 3856 2996 svchost.exe regasm.exe PID 2996 wrote to memory of 3856 2996 svchost.exe regasm.exe PID 2996 wrote to memory of 3856 2996 svchost.exe regasm.exe PID 2996 wrote to memory of 3856 2996 svchost.exe regasm.exe PID 2996 wrote to memory of 3856 2996 svchost.exe regasm.exe PID 2996 wrote to memory of 1656 2996 svchost.exe regasm.exe PID 2996 wrote to memory of 1656 2996 svchost.exe regasm.exe PID 2996 wrote to memory of 1656 2996 svchost.exe regasm.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\quotation#247833.pdf.exe"C:\Users\Admin\AppData\Local\Temp\quotation#247833.pdf.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"'3⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp67A3.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\svchost.exe"C:\Users\Admin\AppData\Roaming\svchost.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"4⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp67A3.tmp.batFilesize
151B
MD550fc69ac01444ed043bf7cc217dd8c4e
SHA155dd5ecf23bd71ab0971fefbc6380500aad7b147
SHA2566e9eea4954c83e81b16dabdc6a41f9c57e5390e5e63b99f370a0ab8385af5dd5
SHA512dc0cd12cf246772e54c19f1da2a3451910a84c87e77fc7d678e04c0ba128f18338da466b6510201a29e19c03f02d9de90f9a063dc0141a23d40b760b16cc463a
-
C:\Users\Admin\AppData\Roaming\svchost.exeFilesize
612KB
MD552bbe58331758dd37f776189080a5ead
SHA12542cfdfee6da01c4657c13b3327ebf6f91d42da
SHA256825a37255a61598eaa9eb15897dbc89f7e3637193c4e17775fbbc145ca523528
SHA512a99a78ccc4ccc8fd2797d4f2f2c766c9043dd1dbbc7a588680d0472c43c44a78e31212c38f1753196cf0609e65b079b12656a59a934ae36ed4ff3e4f9312e5b8
-
memory/2996-19-0x00007FFCE5560000-0x00007FFCE6021000-memory.dmpFilesize
10.8MB
-
memory/2996-13-0x00007FFCE5560000-0x00007FFCE6021000-memory.dmpFilesize
10.8MB
-
memory/3856-14-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/3856-20-0x00000000066D0000-0x0000000006720000-memory.dmpFilesize
320KB
-
memory/3856-24-0x0000000005A60000-0x0000000005A70000-memory.dmpFilesize
64KB
-
memory/3856-23-0x0000000074CC0000-0x0000000075470000-memory.dmpFilesize
7.7MB
-
memory/3856-22-0x0000000006730000-0x000000000673A000-memory.dmpFilesize
40KB
-
memory/3856-15-0x0000000074CC0000-0x0000000075470000-memory.dmpFilesize
7.7MB
-
memory/3856-16-0x0000000006020000-0x00000000065C4000-memory.dmpFilesize
5.6MB
-
memory/3856-17-0x0000000005A60000-0x0000000005A70000-memory.dmpFilesize
64KB
-
memory/3856-18-0x00000000059C0000-0x0000000005A26000-memory.dmpFilesize
408KB
-
memory/3856-21-0x00000000068D0000-0x0000000006962000-memory.dmpFilesize
584KB
-
memory/4456-9-0x00007FFCE62C0000-0x00007FFCE6D81000-memory.dmpFilesize
10.8MB
-
memory/4456-1-0x00007FFCE62C0000-0x00007FFCE6D81000-memory.dmpFilesize
10.8MB
-
memory/4456-0-0x0000025670F30000-0x0000025670F3C000-memory.dmpFilesize
48KB
-
memory/4456-2-0x0000025673510000-0x0000025673520000-memory.dmpFilesize
64KB
-
memory/4456-3-0x00000256742E0000-0x0000025674376000-memory.dmpFilesize
600KB