Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
29-04-2024 10:26
Static task
static1
Behavioral task
behavioral1
Sample
Overdue Account.pdf.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Overdue Account.pdf.exe
Resource
win10v2004-20240426-en
General
-
Target
Overdue Account.pdf.exe
-
Size
670KB
-
MD5
81937e479c70381a7527b21693ab3e6c
-
SHA1
fbac04ef1e0315bff71d908496309d731da30c75
-
SHA256
e48b7b9ba50d500f569024126a2ff8981db13525ff378ea2151ce8d6b7e4e452
-
SHA512
35b56dce2a110c145a4c4bef02a5e0151835ea1f1d64891e346f77bf3ce4a3cae2b81f098e819183a2f664f28997845a22b071805e76c97a009b2f6241bbaded
-
SSDEEP
12288:PBB778QJ5RBdmrRwANBlJi/l/XbBzN5L/ObdOC0uCnGbmSAnJGXuY7GzkR:ZBDB0rqclJeNvL/EpV5bmJKu0
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.nooshdaroodc.com - Port:
587 - Username:
[email protected] - Password:
Nou$h@Darou - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Overdue Account.pdf.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation Overdue Account.pdf.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
RegSvcs.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\boqXv = "C:\\Users\\Admin\\AppData\\Roaming\\boqXv\\boqXv.exe" RegSvcs.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Overdue Account.pdf.exedescription pid process target process PID 2008 set thread context of 3844 2008 Overdue Account.pdf.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 15 IoCs
Processes:
Overdue Account.pdf.exepowershell.exepowershell.exeRegSvcs.exepid process 2008 Overdue Account.pdf.exe 2008 Overdue Account.pdf.exe 2008 Overdue Account.pdf.exe 2008 Overdue Account.pdf.exe 2008 Overdue Account.pdf.exe 2008 Overdue Account.pdf.exe 1136 powershell.exe 3164 powershell.exe 2008 Overdue Account.pdf.exe 2008 Overdue Account.pdf.exe 2008 Overdue Account.pdf.exe 3844 RegSvcs.exe 3844 RegSvcs.exe 1136 powershell.exe 3164 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
Overdue Account.pdf.exepowershell.exepowershell.exeRegSvcs.exedescription pid process Token: SeDebugPrivilege 2008 Overdue Account.pdf.exe Token: SeDebugPrivilege 1136 powershell.exe Token: SeDebugPrivilege 3164 powershell.exe Token: SeDebugPrivilege 3844 RegSvcs.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
Overdue Account.pdf.exedescription pid process target process PID 2008 wrote to memory of 1136 2008 Overdue Account.pdf.exe powershell.exe PID 2008 wrote to memory of 1136 2008 Overdue Account.pdf.exe powershell.exe PID 2008 wrote to memory of 1136 2008 Overdue Account.pdf.exe powershell.exe PID 2008 wrote to memory of 3164 2008 Overdue Account.pdf.exe powershell.exe PID 2008 wrote to memory of 3164 2008 Overdue Account.pdf.exe powershell.exe PID 2008 wrote to memory of 3164 2008 Overdue Account.pdf.exe powershell.exe PID 2008 wrote to memory of 4568 2008 Overdue Account.pdf.exe schtasks.exe PID 2008 wrote to memory of 4568 2008 Overdue Account.pdf.exe schtasks.exe PID 2008 wrote to memory of 4568 2008 Overdue Account.pdf.exe schtasks.exe PID 2008 wrote to memory of 2924 2008 Overdue Account.pdf.exe RegSvcs.exe PID 2008 wrote to memory of 2924 2008 Overdue Account.pdf.exe RegSvcs.exe PID 2008 wrote to memory of 2924 2008 Overdue Account.pdf.exe RegSvcs.exe PID 2008 wrote to memory of 3844 2008 Overdue Account.pdf.exe RegSvcs.exe PID 2008 wrote to memory of 3844 2008 Overdue Account.pdf.exe RegSvcs.exe PID 2008 wrote to memory of 3844 2008 Overdue Account.pdf.exe RegSvcs.exe PID 2008 wrote to memory of 3844 2008 Overdue Account.pdf.exe RegSvcs.exe PID 2008 wrote to memory of 3844 2008 Overdue Account.pdf.exe RegSvcs.exe PID 2008 wrote to memory of 3844 2008 Overdue Account.pdf.exe RegSvcs.exe PID 2008 wrote to memory of 3844 2008 Overdue Account.pdf.exe RegSvcs.exe PID 2008 wrote to memory of 3844 2008 Overdue Account.pdf.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Overdue Account.pdf.exe"C:\Users\Admin\AppData\Local\Temp\Overdue Account.pdf.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Overdue Account.pdf.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\kpSYqS.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\kpSYqS" /XML "C:\Users\Admin\AppData\Local\Temp\tmp94ED.tmp"2⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD53d086a433708053f9bf9523e1d87a4e8
SHA1b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA2566f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
SHA512931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD52085b9dda3403c0b769280912cddccd0
SHA11f9611ccf9c307cd9e603c1f3a37eb38a3d66be4
SHA25601ad680c134feb32049d9a558024c16d319ddcfb774f8d0a63a7967d07208a55
SHA51240938027a78cfac24736a05fdef344fbca5c2121ed3ebcd5f5aeeb13b42bc675e102e34a804d523f84fea47ff5ee8f0612b9e15cb62de264d21d65fef3352f95
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2y1w421t.pgu.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\tmp94ED.tmpFilesize
1KB
MD504e31a34b7837d487f98cb62d3d381fd
SHA117d9ab4c95ee9cab9e1b1635cedde45e024a0d6f
SHA256316834d4dbfae52f01a4b9e9f5a7f68a7e02679369acbeb5a54d9628792e196b
SHA51265539c13b5a9904a1e23b31aba6fb4b7195ebf9504dca63eaf0cdc576e395edab01a7878843e7a7724f025c0c20384d1aab4469e03f15b6b75e28be09209a79d
-
memory/1136-75-0x0000000007340000-0x00000000079BA000-memory.dmpFilesize
6.5MB
-
memory/1136-15-0x0000000004470000-0x00000000044A6000-memory.dmpFilesize
216KB
-
memory/1136-53-0x00000000751E0000-0x000000007522C000-memory.dmpFilesize
304KB
-
memory/1136-63-0x0000000005F10000-0x0000000005F2E000-memory.dmpFilesize
120KB
-
memory/1136-74-0x0000000006BD0000-0x0000000006C73000-memory.dmpFilesize
652KB
-
memory/1136-76-0x0000000006CF0000-0x0000000006D0A000-memory.dmpFilesize
104KB
-
memory/1136-79-0x0000000006EF0000-0x0000000006F01000-memory.dmpFilesize
68KB
-
memory/1136-83-0x0000000007030000-0x000000000704A000-memory.dmpFilesize
104KB
-
memory/1136-17-0x0000000004AE0000-0x0000000005108000-memory.dmpFilesize
6.2MB
-
memory/1136-18-0x0000000074940000-0x00000000750F0000-memory.dmpFilesize
7.7MB
-
memory/1136-81-0x0000000006F20000-0x0000000006F2E000-memory.dmpFilesize
56KB
-
memory/1136-19-0x0000000004420000-0x0000000004430000-memory.dmpFilesize
64KB
-
memory/1136-82-0x0000000006F30000-0x0000000006F44000-memory.dmpFilesize
80KB
-
memory/1136-38-0x00000000053C0000-0x0000000005714000-memory.dmpFilesize
3.3MB
-
memory/1136-90-0x0000000074940000-0x00000000750F0000-memory.dmpFilesize
7.7MB
-
memory/1136-52-0x0000000006B90000-0x0000000006BC2000-memory.dmpFilesize
200KB
-
memory/2008-1-0x0000000074940000-0x00000000750F0000-memory.dmpFilesize
7.7MB
-
memory/2008-2-0x0000000005F20000-0x00000000064C4000-memory.dmpFilesize
5.6MB
-
memory/2008-3-0x00000000058B0000-0x0000000005942000-memory.dmpFilesize
584KB
-
memory/2008-4-0x0000000005AB0000-0x0000000005AC0000-memory.dmpFilesize
64KB
-
memory/2008-16-0x0000000074940000-0x00000000750F0000-memory.dmpFilesize
7.7MB
-
memory/2008-20-0x0000000005AB0000-0x0000000005AC0000-memory.dmpFilesize
64KB
-
memory/2008-7-0x0000000005AA0000-0x0000000005AAE000-memory.dmpFilesize
56KB
-
memory/2008-5-0x0000000005880000-0x000000000588A000-memory.dmpFilesize
40KB
-
memory/2008-10-0x0000000006D70000-0x0000000006E0C000-memory.dmpFilesize
624KB
-
memory/2008-0-0x0000000000F70000-0x000000000101A000-memory.dmpFilesize
680KB
-
memory/2008-9-0x0000000006B00000-0x0000000006B82000-memory.dmpFilesize
520KB
-
memory/2008-8-0x0000000005EC0000-0x0000000005ED6000-memory.dmpFilesize
88KB
-
memory/2008-49-0x0000000074940000-0x00000000750F0000-memory.dmpFilesize
7.7MB
-
memory/2008-6-0x0000000005EA0000-0x0000000005EB8000-memory.dmpFilesize
96KB
-
memory/3164-91-0x0000000074940000-0x00000000750F0000-memory.dmpFilesize
7.7MB
-
memory/3164-23-0x0000000004A70000-0x0000000004A80000-memory.dmpFilesize
64KB
-
memory/3164-51-0x0000000005EB0000-0x0000000005EFC000-memory.dmpFilesize
304KB
-
memory/3164-77-0x00000000071A0000-0x00000000071AA000-memory.dmpFilesize
40KB
-
memory/3164-78-0x00000000073B0000-0x0000000007446000-memory.dmpFilesize
600KB
-
memory/3164-32-0x00000000057E0000-0x0000000005846000-memory.dmpFilesize
408KB
-
memory/3164-25-0x0000000004E50000-0x0000000004E72000-memory.dmpFilesize
136KB
-
memory/3164-26-0x0000000004F70000-0x0000000004FD6000-memory.dmpFilesize
408KB
-
memory/3164-50-0x0000000005D10000-0x0000000005D2E000-memory.dmpFilesize
120KB
-
memory/3164-84-0x0000000007450000-0x0000000007458000-memory.dmpFilesize
32KB
-
memory/3164-64-0x00000000751E0000-0x000000007522C000-memory.dmpFilesize
304KB
-
memory/3164-24-0x0000000004A70000-0x0000000004A80000-memory.dmpFilesize
64KB
-
memory/3164-22-0x0000000074940000-0x00000000750F0000-memory.dmpFilesize
7.7MB
-
memory/3844-39-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/3844-92-0x0000000006200000-0x0000000006250000-memory.dmpFilesize
320KB