Analysis
-
max time kernel
328s -
max time network
329s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
12-04-2024 07:08
Static task
static1
Behavioral task
behavioral1
Sample
PO 12.04 pdf.exe
Resource
win7-20231129-en
General
-
Target
PO 12.04 pdf.exe
-
Size
1.1MB
-
MD5
d90a72256615ac3ba74c924012fea42c
-
SHA1
b9590a8777fac1b545be42ab89ca14f5facd163b
-
SHA256
887199f41d24aa708148968e98abb902ba2d4e3d346420bdc602b77cdcbc2c2f
-
SHA512
17b122e88d398660aec334dae1589ae79259c6bd4ab3616e3486624f2117422e290d1c2c63a3ee346c4b51693130e03eae79af2ad0b66b0629153288154b6418
-
SSDEEP
24576:7AHnh+eWsN3skA4RV1Hom2KXMmHavPFb1MCgQ1WKK/utU5:Wh+ZkldoPK8YavPLMSY
Malware Config
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Detect ZGRat V1 33 IoCs
Processes:
resource yara_rule behavioral2/memory/224-17-0x0000000003090000-0x00000000030E4000-memory.dmp family_zgrat_v1 behavioral2/memory/224-23-0x0000000003450000-0x00000000034A2000-memory.dmp family_zgrat_v1 behavioral2/memory/224-24-0x0000000003450000-0x000000000349D000-memory.dmp family_zgrat_v1 behavioral2/memory/224-25-0x0000000003450000-0x000000000349D000-memory.dmp family_zgrat_v1 behavioral2/memory/224-27-0x0000000003450000-0x000000000349D000-memory.dmp family_zgrat_v1 behavioral2/memory/224-29-0x0000000003450000-0x000000000349D000-memory.dmp family_zgrat_v1 behavioral2/memory/224-31-0x0000000003450000-0x000000000349D000-memory.dmp family_zgrat_v1 behavioral2/memory/224-33-0x0000000003450000-0x000000000349D000-memory.dmp family_zgrat_v1 behavioral2/memory/224-35-0x0000000003450000-0x000000000349D000-memory.dmp family_zgrat_v1 behavioral2/memory/224-37-0x0000000003450000-0x000000000349D000-memory.dmp family_zgrat_v1 behavioral2/memory/224-39-0x0000000003450000-0x000000000349D000-memory.dmp family_zgrat_v1 behavioral2/memory/224-41-0x0000000003450000-0x000000000349D000-memory.dmp family_zgrat_v1 behavioral2/memory/224-43-0x0000000003450000-0x000000000349D000-memory.dmp family_zgrat_v1 behavioral2/memory/224-45-0x0000000003450000-0x000000000349D000-memory.dmp family_zgrat_v1 behavioral2/memory/224-47-0x0000000003450000-0x000000000349D000-memory.dmp family_zgrat_v1 behavioral2/memory/224-49-0x0000000003450000-0x000000000349D000-memory.dmp family_zgrat_v1 behavioral2/memory/224-51-0x0000000003450000-0x000000000349D000-memory.dmp family_zgrat_v1 behavioral2/memory/224-53-0x0000000003450000-0x000000000349D000-memory.dmp family_zgrat_v1 behavioral2/memory/224-55-0x0000000003450000-0x000000000349D000-memory.dmp family_zgrat_v1 behavioral2/memory/224-57-0x0000000003450000-0x000000000349D000-memory.dmp family_zgrat_v1 behavioral2/memory/224-59-0x0000000003450000-0x000000000349D000-memory.dmp family_zgrat_v1 behavioral2/memory/224-61-0x0000000003450000-0x000000000349D000-memory.dmp family_zgrat_v1 behavioral2/memory/224-63-0x0000000003450000-0x000000000349D000-memory.dmp family_zgrat_v1 behavioral2/memory/224-65-0x0000000003450000-0x000000000349D000-memory.dmp family_zgrat_v1 behavioral2/memory/224-67-0x0000000003450000-0x000000000349D000-memory.dmp family_zgrat_v1 behavioral2/memory/224-69-0x0000000003450000-0x000000000349D000-memory.dmp family_zgrat_v1 behavioral2/memory/224-71-0x0000000003450000-0x000000000349D000-memory.dmp family_zgrat_v1 behavioral2/memory/224-73-0x0000000003450000-0x000000000349D000-memory.dmp family_zgrat_v1 behavioral2/memory/224-75-0x0000000003450000-0x000000000349D000-memory.dmp family_zgrat_v1 behavioral2/memory/224-77-0x0000000003450000-0x000000000349D000-memory.dmp family_zgrat_v1 behavioral2/memory/224-79-0x0000000003450000-0x000000000349D000-memory.dmp family_zgrat_v1 behavioral2/memory/224-81-0x0000000003450000-0x000000000349D000-memory.dmp family_zgrat_v1 behavioral2/memory/224-83-0x0000000003450000-0x000000000349D000-memory.dmp family_zgrat_v1 -
Suspicious use of SetThreadContext 1 IoCs
Processes:
PO 12.04 pdf.exedescription pid process target process PID 3304 set thread context of 224 3304 PO 12.04 pdf.exe RegSvcs.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
RegSvcs.exepid process 224 RegSvcs.exe 224 RegSvcs.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
PO 12.04 pdf.exepid process 3304 PO 12.04 pdf.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RegSvcs.exedescription pid process Token: SeDebugPrivilege 224 RegSvcs.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
PO 12.04 pdf.exepid process 3304 PO 12.04 pdf.exe 3304 PO 12.04 pdf.exe -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
PO 12.04 pdf.exepid process 3304 PO 12.04 pdf.exe 3304 PO 12.04 pdf.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
PO 12.04 pdf.exedescription pid process target process PID 3304 wrote to memory of 224 3304 PO 12.04 pdf.exe RegSvcs.exe PID 3304 wrote to memory of 224 3304 PO 12.04 pdf.exe RegSvcs.exe PID 3304 wrote to memory of 224 3304 PO 12.04 pdf.exe RegSvcs.exe PID 3304 wrote to memory of 224 3304 PO 12.04 pdf.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PO 12.04 pdf.exe"C:\Users\Admin\AppData\Local\Temp\PO 12.04 pdf.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\PO 12.04 pdf.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\aut4D35.tmpFilesize
261KB
MD54b25952eeb9e4cc3a0c4488258f0d4e7
SHA114dd1fbefd98be6df8b4bf9f902a809d886c53a7
SHA25634c219a98744e882eb09c42bc52f2ceba1fcd08c1a7bd18735c51ffc459d42e6
SHA512073075d778f33d4710dea4267be1712bd8186ace522f683d53195c934a44535dfcdd9c939a978cbb937d6330c113199db5bd54149fe8e1e4ec60c0ac2b2a5ca1
-
memory/224-13-0x0000000000400000-0x0000000000446000-memory.dmpFilesize
280KB
-
memory/224-14-0x0000000000400000-0x0000000000446000-memory.dmpFilesize
280KB
-
memory/224-15-0x0000000000400000-0x0000000000446000-memory.dmpFilesize
280KB
-
memory/224-16-0x0000000000400000-0x0000000000446000-memory.dmpFilesize
280KB
-
memory/224-17-0x0000000003090000-0x00000000030E4000-memory.dmpFilesize
336KB
-
memory/224-18-0x0000000074C10000-0x00000000753C0000-memory.dmpFilesize
7.7MB
-
memory/224-19-0x0000000005BD0000-0x0000000005BE0000-memory.dmpFilesize
64KB
-
memory/224-20-0x0000000005BD0000-0x0000000005BE0000-memory.dmpFilesize
64KB
-
memory/224-21-0x0000000005BD0000-0x0000000005BE0000-memory.dmpFilesize
64KB
-
memory/224-22-0x0000000006190000-0x0000000006734000-memory.dmpFilesize
5.6MB
-
memory/224-23-0x0000000003450000-0x00000000034A2000-memory.dmpFilesize
328KB
-
memory/224-24-0x0000000003450000-0x000000000349D000-memory.dmpFilesize
308KB
-
memory/224-25-0x0000000003450000-0x000000000349D000-memory.dmpFilesize
308KB
-
memory/224-27-0x0000000003450000-0x000000000349D000-memory.dmpFilesize
308KB
-
memory/224-29-0x0000000003450000-0x000000000349D000-memory.dmpFilesize
308KB
-
memory/224-31-0x0000000003450000-0x000000000349D000-memory.dmpFilesize
308KB
-
memory/224-33-0x0000000003450000-0x000000000349D000-memory.dmpFilesize
308KB
-
memory/224-35-0x0000000003450000-0x000000000349D000-memory.dmpFilesize
308KB
-
memory/224-37-0x0000000003450000-0x000000000349D000-memory.dmpFilesize
308KB
-
memory/224-39-0x0000000003450000-0x000000000349D000-memory.dmpFilesize
308KB
-
memory/224-41-0x0000000003450000-0x000000000349D000-memory.dmpFilesize
308KB
-
memory/224-43-0x0000000003450000-0x000000000349D000-memory.dmpFilesize
308KB
-
memory/224-45-0x0000000003450000-0x000000000349D000-memory.dmpFilesize
308KB
-
memory/224-47-0x0000000003450000-0x000000000349D000-memory.dmpFilesize
308KB
-
memory/224-49-0x0000000003450000-0x000000000349D000-memory.dmpFilesize
308KB
-
memory/224-51-0x0000000003450000-0x000000000349D000-memory.dmpFilesize
308KB
-
memory/224-53-0x0000000003450000-0x000000000349D000-memory.dmpFilesize
308KB
-
memory/224-55-0x0000000003450000-0x000000000349D000-memory.dmpFilesize
308KB
-
memory/224-57-0x0000000003450000-0x000000000349D000-memory.dmpFilesize
308KB
-
memory/224-59-0x0000000003450000-0x000000000349D000-memory.dmpFilesize
308KB
-
memory/224-61-0x0000000003450000-0x000000000349D000-memory.dmpFilesize
308KB
-
memory/224-63-0x0000000003450000-0x000000000349D000-memory.dmpFilesize
308KB
-
memory/224-65-0x0000000003450000-0x000000000349D000-memory.dmpFilesize
308KB
-
memory/224-67-0x0000000003450000-0x000000000349D000-memory.dmpFilesize
308KB
-
memory/224-69-0x0000000003450000-0x000000000349D000-memory.dmpFilesize
308KB
-
memory/224-71-0x0000000003450000-0x000000000349D000-memory.dmpFilesize
308KB
-
memory/224-73-0x0000000003450000-0x000000000349D000-memory.dmpFilesize
308KB
-
memory/224-75-0x0000000003450000-0x000000000349D000-memory.dmpFilesize
308KB
-
memory/224-77-0x0000000003450000-0x000000000349D000-memory.dmpFilesize
308KB
-
memory/224-79-0x0000000003450000-0x000000000349D000-memory.dmpFilesize
308KB
-
memory/224-81-0x0000000003450000-0x000000000349D000-memory.dmpFilesize
308KB
-
memory/224-83-0x0000000003450000-0x000000000349D000-memory.dmpFilesize
308KB
-
memory/224-1054-0x0000000005BD0000-0x0000000005BE0000-memory.dmpFilesize
64KB
-
memory/224-1055-0x0000000005BE0000-0x0000000005C46000-memory.dmpFilesize
408KB
-
memory/224-1056-0x00000000069D0000-0x0000000006A20000-memory.dmpFilesize
320KB
-
memory/224-1057-0x0000000006AC0000-0x0000000006B52000-memory.dmpFilesize
584KB
-
memory/224-1058-0x0000000006A20000-0x0000000006A2A000-memory.dmpFilesize
40KB
-
memory/224-1059-0x0000000000400000-0x0000000000446000-memory.dmpFilesize
280KB
-
memory/224-1060-0x0000000074C10000-0x00000000753C0000-memory.dmpFilesize
7.7MB
-
memory/224-1061-0x0000000005BD0000-0x0000000005BE0000-memory.dmpFilesize
64KB
-
memory/224-1062-0x0000000005BD0000-0x0000000005BE0000-memory.dmpFilesize
64KB
-
memory/3304-12-0x00000000015C0000-0x00000000015C4000-memory.dmpFilesize
16KB