Analysis
-
max time kernel
145s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
26-04-2024 12:46
Static task
static1
Behavioral task
behavioral1
Sample
Packing List PDF.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Packing List PDF.exe
Resource
win10v2004-20240226-en
General
-
Target
Packing List PDF.exe
-
Size
822KB
-
MD5
5a12438b3b4c926c12a9376c7bf13426
-
SHA1
c3185c6a5e5f07a5befbe4af7131d05634f5d1a3
-
SHA256
1a794211deaa0ecb6abc6101d7c1bd61111b4dd2d895ee7ecf78fbf17f4c9ab3
-
SHA512
16c1e0e18eb8b3345b8b05443b782cb1dd35492ac986811c39f3cdce8dfe85b003aba029ffca0e38aa33c951d0d08281825152b0e239471eac3de18ac67864d0
-
SSDEEP
12288:tEqnHvjNIrpf9rN/mc/CaBmIwsyaPSIir97G6NLOZCGKEgbjuPBB5uO12rq:txPjKr5BNDWVxcSIiRG6atlB5N
Malware Config
Extracted
Protocol: smtp- Host:
mail.fascia-arch.com - Port:
587 - Username:
[email protected] - Password:
HERbertstown1987
Extracted
agenttesla
Protocol: smtp- Host:
mail.fascia-arch.com - Port:
587 - Username:
[email protected] - Password:
HERbertstown1987 - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Packing List PDF.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation Packing List PDF.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
Packing List PDF.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BjTxJte = "C:\\Users\\Admin\\AppData\\Roaming\\BjTxJte\\BjTxJte.exe" Packing List PDF.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 43 api.ipify.org 44 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Packing List PDF.exedescription pid process target process PID 3868 set thread context of 1268 3868 Packing List PDF.exe Packing List PDF.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
Packing List PDF.exepowershell.exepowershell.exePacking List PDF.exepid process 3868 Packing List PDF.exe 3868 Packing List PDF.exe 3868 Packing List PDF.exe 3868 Packing List PDF.exe 2428 powershell.exe 2428 powershell.exe 2988 powershell.exe 2988 powershell.exe 3868 Packing List PDF.exe 1268 Packing List PDF.exe 1268 Packing List PDF.exe 1268 Packing List PDF.exe 2428 powershell.exe 2988 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
Packing List PDF.exepowershell.exepowershell.exePacking List PDF.exedescription pid process Token: SeDebugPrivilege 3868 Packing List PDF.exe Token: SeDebugPrivilege 2988 powershell.exe Token: SeDebugPrivilege 2428 powershell.exe Token: SeDebugPrivilege 1268 Packing List PDF.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Packing List PDF.exepid process 1268 Packing List PDF.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
Packing List PDF.exedescription pid process target process PID 3868 wrote to memory of 2428 3868 Packing List PDF.exe powershell.exe PID 3868 wrote to memory of 2428 3868 Packing List PDF.exe powershell.exe PID 3868 wrote to memory of 2428 3868 Packing List PDF.exe powershell.exe PID 3868 wrote to memory of 2988 3868 Packing List PDF.exe powershell.exe PID 3868 wrote to memory of 2988 3868 Packing List PDF.exe powershell.exe PID 3868 wrote to memory of 2988 3868 Packing List PDF.exe powershell.exe PID 3868 wrote to memory of 3052 3868 Packing List PDF.exe schtasks.exe PID 3868 wrote to memory of 3052 3868 Packing List PDF.exe schtasks.exe PID 3868 wrote to memory of 3052 3868 Packing List PDF.exe schtasks.exe PID 3868 wrote to memory of 1268 3868 Packing List PDF.exe Packing List PDF.exe PID 3868 wrote to memory of 1268 3868 Packing List PDF.exe Packing List PDF.exe PID 3868 wrote to memory of 1268 3868 Packing List PDF.exe Packing List PDF.exe PID 3868 wrote to memory of 1268 3868 Packing List PDF.exe Packing List PDF.exe PID 3868 wrote to memory of 1268 3868 Packing List PDF.exe Packing List PDF.exe PID 3868 wrote to memory of 1268 3868 Packing List PDF.exe Packing List PDF.exe PID 3868 wrote to memory of 1268 3868 Packing List PDF.exe Packing List PDF.exe PID 3868 wrote to memory of 1268 3868 Packing List PDF.exe Packing List PDF.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Packing List PDF.exe"C:\Users\Admin\AppData\Local\Temp\Packing List PDF.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Packing List PDF.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\CmxzrHBB.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\CmxzrHBB" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8047.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\Packing List PDF.exe"C:\Users\Admin\AppData\Local\Temp\Packing List PDF.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1040 --field-trial-handle=2264,i,15001568551143786084,90255922961447677,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD599add4d3aec88a03bcaaab3db53cbda7
SHA1d23bdf5b9ce380964ec00d66dfcc6e93a32124d0
SHA256b3a4484a9c809ca40c34041f8cccf4e1ac078d5d83f37a15644f035bd54189e4
SHA5129c73ec231b2168d3f389dc67b5a384d86960e51c5afdad486f205245e8a521d396033912687a70201cbacc0470802ef225e652e7e0398d4abc242eda4bbfdd7b
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_s01l3053.lrh.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\tmp8047.tmpFilesize
1KB
MD50e73d2dca6013b786d3f4488abcd0281
SHA1dfb14305fd7c8ed55a1043badb48ceacaa9f46e8
SHA256b3684748e5f6c389e9c628ba64d433917b5d787ff685c9970f0a83a4dde758fb
SHA512a0c899956758cb7238fdd878f21a93ea2c2ac7da8b900e84c0a4bbba8a960f4d85c90d4ecdb215f5c14c024c840fcb71c8c41c8a8e7f159d9082750085a02241
-
memory/1268-80-0x0000000006CA0000-0x0000000006CF0000-memory.dmpFilesize
320KB
-
memory/1268-45-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2428-74-0x00000000055A0000-0x00000000055BA000-memory.dmpFilesize
104KB
-
memory/2428-76-0x0000000007E00000-0x0000000007E96000-memory.dmpFilesize
600KB
-
memory/2428-90-0x0000000075290000-0x0000000075A40000-memory.dmpFilesize
7.7MB
-
memory/2428-84-0x0000000007EA0000-0x0000000007EA8000-memory.dmpFilesize
32KB
-
memory/2428-82-0x0000000007EC0000-0x0000000007EDA000-memory.dmpFilesize
104KB
-
memory/2428-79-0x0000000007DB0000-0x0000000007DBE000-memory.dmpFilesize
56KB
-
memory/2428-15-0x00000000052A0000-0x00000000052D6000-memory.dmpFilesize
216KB
-
memory/2428-17-0x00000000052E0000-0x00000000052F0000-memory.dmpFilesize
64KB
-
memory/2428-16-0x0000000075290000-0x0000000075A40000-memory.dmpFilesize
7.7MB
-
memory/2428-50-0x0000000007A10000-0x0000000007A42000-memory.dmpFilesize
200KB
-
memory/2428-19-0x0000000005920000-0x0000000005F48000-memory.dmpFilesize
6.2MB
-
memory/2428-52-0x0000000071A40000-0x0000000071A8C000-memory.dmpFilesize
304KB
-
memory/2428-48-0x0000000006850000-0x000000000686E000-memory.dmpFilesize
120KB
-
memory/2428-44-0x0000000006370000-0x00000000066C4000-memory.dmpFilesize
3.3MB
-
memory/2988-81-0x0000000007610000-0x0000000007624000-memory.dmpFilesize
80KB
-
memory/2988-21-0x00000000027A0000-0x00000000027B0000-memory.dmpFilesize
64KB
-
memory/2988-72-0x00000000072C0000-0x0000000007363000-memory.dmpFilesize
652KB
-
memory/2988-27-0x0000000005A90000-0x0000000005AF6000-memory.dmpFilesize
408KB
-
memory/2988-83-0x00000000076F0000-0x00000000076F8000-memory.dmpFilesize
32KB
-
memory/2988-26-0x00000000059B0000-0x0000000005A16000-memory.dmpFilesize
408KB
-
memory/2988-75-0x0000000007440000-0x000000000744A000-memory.dmpFilesize
40KB
-
memory/2988-73-0x00000000079F0000-0x000000000806A000-memory.dmpFilesize
6.5MB
-
memory/2988-49-0x0000000006620000-0x000000000666C000-memory.dmpFilesize
304KB
-
memory/2988-70-0x0000000006670000-0x000000000668E000-memory.dmpFilesize
120KB
-
memory/2988-20-0x0000000075290000-0x0000000075A40000-memory.dmpFilesize
7.7MB
-
memory/2988-51-0x0000000071A40000-0x0000000071A8C000-memory.dmpFilesize
304KB
-
memory/2988-89-0x0000000075290000-0x0000000075A40000-memory.dmpFilesize
7.7MB
-
memory/2988-25-0x0000000005910000-0x0000000005932000-memory.dmpFilesize
136KB
-
memory/2988-77-0x00000000075D0000-0x00000000075E1000-memory.dmpFilesize
68KB
-
memory/3868-1-0x0000000000420000-0x00000000004F4000-memory.dmpFilesize
848KB
-
memory/3868-47-0x0000000075290000-0x0000000075A40000-memory.dmpFilesize
7.7MB
-
memory/3868-6-0x0000000005150000-0x0000000005170000-memory.dmpFilesize
128KB
-
memory/3868-0-0x0000000075290000-0x0000000075A40000-memory.dmpFilesize
7.7MB
-
memory/3868-10-0x0000000075290000-0x0000000075A40000-memory.dmpFilesize
7.7MB
-
memory/3868-2-0x0000000005420000-0x00000000059C4000-memory.dmpFilesize
5.6MB
-
memory/3868-3-0x0000000004F10000-0x0000000004FA2000-memory.dmpFilesize
584KB
-
memory/3868-9-0x000000000C270000-0x000000000C30C000-memory.dmpFilesize
624KB
-
memory/3868-8-0x0000000009150000-0x00000000091D4000-memory.dmpFilesize
528KB
-
memory/3868-5-0x0000000004EC0000-0x0000000004ECA000-memory.dmpFilesize
40KB
-
memory/3868-18-0x0000000004E10000-0x0000000004E20000-memory.dmpFilesize
64KB
-
memory/3868-7-0x0000000006840000-0x0000000006854000-memory.dmpFilesize
80KB
-
memory/3868-4-0x0000000004E10000-0x0000000004E20000-memory.dmpFilesize
64KB