Analysis
-
max time kernel
133s -
max time network
98s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
29-03-2024 09:25
Static task
static1
Behavioral task
behavioral1
Sample
RFQ REF R2100131410.pdf.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
RFQ REF R2100131410.pdf.exe
Resource
win10v2004-20240226-en
General
-
Target
RFQ REF R2100131410.pdf.exe
-
Size
637KB
-
MD5
5c590fcb32aedec16532aa857eec28b5
-
SHA1
d72754476c6339fd6469b7a1a6e6ca3af718673b
-
SHA256
61e5a9d4e73fd837d919eedcdf4afcca159875f4ec7b0a1a57c873c54c442c9c
-
SHA512
7ba191c522fcb1fbf21fc223faa338156695bdae1e74489620cd2afcd282326cd3115166daf1bc1e96ed7d215cd8fcdc873dd9bc2960d9d91a5d89e026355c8b
-
SSDEEP
12288:/I+asIz+XShvzObsgg1S9p0HEjtR3hwuOUY6yjKMlfp/WmMQCfDZEJ0:7qCeSj0HEjTCuOgy+Ip/F2De
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.vivaldi.net - Port:
587 - Username:
[email protected] - Password:
pYtLbiBtpF6mtjE
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/2752-12-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla behavioral2/memory/2752-17-0x0000000005070000-0x0000000005080000-memory.dmp family_agenttesla -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
RFQ REF R2100131410.pdf.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RFQ REF R2100131410.pdf.exe Key opened \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RFQ REF R2100131410.pdf.exe Key opened \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RFQ REF R2100131410.pdf.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
RFQ REF R2100131410.pdf.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\YYtJku = "C:\\Users\\Admin\\AppData\\Roaming\\YYtJku\\YYtJku.exe" RFQ REF R2100131410.pdf.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
RFQ REF R2100131410.pdf.exedescription pid process target process PID 4656 set thread context of 2752 4656 RFQ REF R2100131410.pdf.exe RFQ REF R2100131410.pdf.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
RFQ REF R2100131410.pdf.exeRFQ REF R2100131410.pdf.exepid process 4656 RFQ REF R2100131410.pdf.exe 4656 RFQ REF R2100131410.pdf.exe 2752 RFQ REF R2100131410.pdf.exe 2752 RFQ REF R2100131410.pdf.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
RFQ REF R2100131410.pdf.exepid process 2752 RFQ REF R2100131410.pdf.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
RFQ REF R2100131410.pdf.exeRFQ REF R2100131410.pdf.exedescription pid process Token: SeDebugPrivilege 4656 RFQ REF R2100131410.pdf.exe Token: SeDebugPrivilege 2752 RFQ REF R2100131410.pdf.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
RFQ REF R2100131410.pdf.exedescription pid process target process PID 4656 wrote to memory of 676 4656 RFQ REF R2100131410.pdf.exe RFQ REF R2100131410.pdf.exe PID 4656 wrote to memory of 676 4656 RFQ REF R2100131410.pdf.exe RFQ REF R2100131410.pdf.exe PID 4656 wrote to memory of 676 4656 RFQ REF R2100131410.pdf.exe RFQ REF R2100131410.pdf.exe PID 4656 wrote to memory of 2752 4656 RFQ REF R2100131410.pdf.exe RFQ REF R2100131410.pdf.exe PID 4656 wrote to memory of 2752 4656 RFQ REF R2100131410.pdf.exe RFQ REF R2100131410.pdf.exe PID 4656 wrote to memory of 2752 4656 RFQ REF R2100131410.pdf.exe RFQ REF R2100131410.pdf.exe PID 4656 wrote to memory of 2752 4656 RFQ REF R2100131410.pdf.exe RFQ REF R2100131410.pdf.exe PID 4656 wrote to memory of 2752 4656 RFQ REF R2100131410.pdf.exe RFQ REF R2100131410.pdf.exe PID 4656 wrote to memory of 2752 4656 RFQ REF R2100131410.pdf.exe RFQ REF R2100131410.pdf.exe PID 4656 wrote to memory of 2752 4656 RFQ REF R2100131410.pdf.exe RFQ REF R2100131410.pdf.exe PID 4656 wrote to memory of 2752 4656 RFQ REF R2100131410.pdf.exe RFQ REF R2100131410.pdf.exe -
outlook_office_path 1 IoCs
Processes:
RFQ REF R2100131410.pdf.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RFQ REF R2100131410.pdf.exe -
outlook_win_path 1 IoCs
Processes:
RFQ REF R2100131410.pdf.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RFQ REF R2100131410.pdf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\RFQ REF R2100131410.pdf.exe"C:\Users\Admin\AppData\Local\Temp\RFQ REF R2100131410.pdf.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4656 -
C:\Users\Admin\AppData\Local\Temp\RFQ REF R2100131410.pdf.exe"C:\Users\Admin\AppData\Local\Temp\RFQ REF R2100131410.pdf.exe"2⤵PID:676
-
C:\Users\Admin\AppData\Local\Temp\RFQ REF R2100131410.pdf.exe"C:\Users\Admin\AppData\Local\Temp\RFQ REF R2100131410.pdf.exe"2⤵
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:2752
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RFQ REF R2100131410.pdf.exe.logFilesize
2KB
MD5fbd5e75bae4e3d2db57a0f9b5ed0df97
SHA1fcb87f79f8748e213d407b78f932f105f04c98e5
SHA256d87a05d026303c360e84bf915b81bea3f8bc81edcb3a53cb1a64d3852f4e9367
SHA512639c3c4d3e57113dda7c980d2f1752579701d5371a3170b5f65a6f21ab427e130b2a3ff226de3fbbea0041be6e476ae98714d4ab75a17e2988fa5974ffa1a803
-
memory/2752-12-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/2752-24-0x0000000005070000-0x0000000005080000-memory.dmpFilesize
64KB
-
memory/2752-23-0x0000000005CF0000-0x0000000005D40000-memory.dmpFilesize
320KB
-
memory/2752-22-0x0000000005070000-0x0000000005080000-memory.dmpFilesize
64KB
-
memory/2752-21-0x0000000074850000-0x0000000075000000-memory.dmpFilesize
7.7MB
-
memory/2752-19-0x0000000005D60000-0x0000000005DC6000-memory.dmpFilesize
408KB
-
memory/2752-18-0x00000000050C0000-0x00000000050D8000-memory.dmpFilesize
96KB
-
memory/2752-17-0x0000000005070000-0x0000000005080000-memory.dmpFilesize
64KB
-
memory/2752-15-0x0000000074850000-0x0000000075000000-memory.dmpFilesize
7.7MB
-
memory/4656-10-0x00000000086F0000-0x000000000878C000-memory.dmpFilesize
624KB
-
memory/4656-11-0x0000000008830000-0x00000000088A4000-memory.dmpFilesize
464KB
-
memory/4656-0-0x0000000000F40000-0x0000000000FE6000-memory.dmpFilesize
664KB
-
memory/4656-9-0x00000000059E0000-0x00000000059F0000-memory.dmpFilesize
64KB
-
memory/4656-8-0x0000000074850000-0x0000000075000000-memory.dmpFilesize
7.7MB
-
memory/4656-16-0x0000000074850000-0x0000000075000000-memory.dmpFilesize
7.7MB
-
memory/4656-7-0x0000000005E10000-0x0000000005E28000-memory.dmpFilesize
96KB
-
memory/4656-6-0x0000000005AC0000-0x0000000005ADC000-memory.dmpFilesize
112KB
-
memory/4656-5-0x00000000059F0000-0x00000000059FA000-memory.dmpFilesize
40KB
-
memory/4656-4-0x00000000059E0000-0x00000000059F0000-memory.dmpFilesize
64KB
-
memory/4656-3-0x0000000005A00000-0x0000000005A92000-memory.dmpFilesize
584KB
-
memory/4656-2-0x0000000006100000-0x00000000066A4000-memory.dmpFilesize
5.6MB
-
memory/4656-1-0x0000000074850000-0x0000000075000000-memory.dmpFilesize
7.7MB