Analysis
-
max time kernel
117s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
29-04-2024 10:32
Static task
static1
Behavioral task
behavioral1
Sample
Overdue Account.pdf.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Overdue Account.pdf.exe
Resource
win10v2004-20240419-en
General
-
Target
Overdue Account.pdf.exe
-
Size
670KB
-
MD5
81937e479c70381a7527b21693ab3e6c
-
SHA1
fbac04ef1e0315bff71d908496309d731da30c75
-
SHA256
e48b7b9ba50d500f569024126a2ff8981db13525ff378ea2151ce8d6b7e4e452
-
SHA512
35b56dce2a110c145a4c4bef02a5e0151835ea1f1d64891e346f77bf3ce4a3cae2b81f098e819183a2f664f28997845a22b071805e76c97a009b2f6241bbaded
-
SSDEEP
12288:PBB778QJ5RBdmrRwANBlJi/l/XbBzN5L/ObdOC0uCnGbmSAnJGXuY7GzkR:ZBDB0rqclJeNvL/EpV5bmJKu0
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.nooshdaroodc.com - Port:
587 - Username:
[email protected] - Password:
Nou$h@Darou - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
RegSvcs.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\boqXv = "C:\\Users\\Admin\\AppData\\Roaming\\boqXv\\boqXv.exe" RegSvcs.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Overdue Account.pdf.exedescription pid process target process PID 2776 set thread context of 552 2776 Overdue Account.pdf.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 11 IoCs
Processes:
Overdue Account.pdf.exeRegSvcs.exepowershell.exepowershell.exepid process 2776 Overdue Account.pdf.exe 2776 Overdue Account.pdf.exe 2776 Overdue Account.pdf.exe 2776 Overdue Account.pdf.exe 2776 Overdue Account.pdf.exe 2776 Overdue Account.pdf.exe 2776 Overdue Account.pdf.exe 552 RegSvcs.exe 552 RegSvcs.exe 2756 powershell.exe 2708 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
Overdue Account.pdf.exeRegSvcs.exepowershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 2776 Overdue Account.pdf.exe Token: SeDebugPrivilege 552 RegSvcs.exe Token: SeDebugPrivilege 2756 powershell.exe Token: SeDebugPrivilege 2708 powershell.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
Overdue Account.pdf.exedescription pid process target process PID 2776 wrote to memory of 2708 2776 Overdue Account.pdf.exe powershell.exe PID 2776 wrote to memory of 2708 2776 Overdue Account.pdf.exe powershell.exe PID 2776 wrote to memory of 2708 2776 Overdue Account.pdf.exe powershell.exe PID 2776 wrote to memory of 2708 2776 Overdue Account.pdf.exe powershell.exe PID 2776 wrote to memory of 2756 2776 Overdue Account.pdf.exe powershell.exe PID 2776 wrote to memory of 2756 2776 Overdue Account.pdf.exe powershell.exe PID 2776 wrote to memory of 2756 2776 Overdue Account.pdf.exe powershell.exe PID 2776 wrote to memory of 2756 2776 Overdue Account.pdf.exe powershell.exe PID 2776 wrote to memory of 2432 2776 Overdue Account.pdf.exe schtasks.exe PID 2776 wrote to memory of 2432 2776 Overdue Account.pdf.exe schtasks.exe PID 2776 wrote to memory of 2432 2776 Overdue Account.pdf.exe schtasks.exe PID 2776 wrote to memory of 2432 2776 Overdue Account.pdf.exe schtasks.exe PID 2776 wrote to memory of 552 2776 Overdue Account.pdf.exe RegSvcs.exe PID 2776 wrote to memory of 552 2776 Overdue Account.pdf.exe RegSvcs.exe PID 2776 wrote to memory of 552 2776 Overdue Account.pdf.exe RegSvcs.exe PID 2776 wrote to memory of 552 2776 Overdue Account.pdf.exe RegSvcs.exe PID 2776 wrote to memory of 552 2776 Overdue Account.pdf.exe RegSvcs.exe PID 2776 wrote to memory of 552 2776 Overdue Account.pdf.exe RegSvcs.exe PID 2776 wrote to memory of 552 2776 Overdue Account.pdf.exe RegSvcs.exe PID 2776 wrote to memory of 552 2776 Overdue Account.pdf.exe RegSvcs.exe PID 2776 wrote to memory of 552 2776 Overdue Account.pdf.exe RegSvcs.exe PID 2776 wrote to memory of 552 2776 Overdue Account.pdf.exe RegSvcs.exe PID 2776 wrote to memory of 552 2776 Overdue Account.pdf.exe RegSvcs.exe PID 2776 wrote to memory of 552 2776 Overdue Account.pdf.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Overdue Account.pdf.exe"C:\Users\Admin\AppData\Local\Temp\Overdue Account.pdf.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Overdue Account.pdf.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\kpSYqS.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\kpSYqS" /XML "C:\Users\Admin\AppData\Local\Temp\tmpEA6E.tmp"2⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpEA6E.tmpFilesize
1KB
MD58f6d0e7a685c9baf87d4937e8199cff4
SHA1a3e56d080dce0f4f5047a3567f46db536344aa69
SHA25617b4a7c6007b97350c2dcd27e360fe1930394cadd70a84be4e5b45902c2eb3f4
SHA51241513877f017c88f5d5cc4436c31a5c2ac4bc145a2741d0cb30acf92ae6f60390c11be5740c7ed8d7fac8a26b29e2d02f90f28d59a4d22b625ed2fc01ec37635
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\SCIAQMLKJMRPE8VXBJ6V.tempFilesize
7KB
MD528b78157358fef62eb2b0542c138b246
SHA1d8d72306ee03212453eb892e3e6f95b6faf5cbd9
SHA25647414ca24c8b0e1cf348a5d7aa34a1d1c0ec6043064a04fd1b3604e1c429b273
SHA5126718d583e7597c29b2d2c3d174847b0a38cdb18777cc1c243b3a508540c6c4728b006a434864c042afe084c38e2471b3b0b26f648c78baa2e2dd01afd076200d
-
memory/552-21-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/552-23-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/552-25-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/552-27-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/552-29-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/552-31-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/552-32-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/552-30-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2776-5-0x0000000000A50000-0x0000000000A66000-memory.dmpFilesize
88KB
-
memory/2776-20-0x0000000004D50000-0x0000000004D90000-memory.dmpFilesize
256KB
-
memory/2776-7-0x0000000074A30000-0x000000007511E000-memory.dmpFilesize
6.9MB
-
memory/2776-6-0x0000000005050000-0x00000000050D2000-memory.dmpFilesize
520KB
-
memory/2776-33-0x0000000074A30000-0x000000007511E000-memory.dmpFilesize
6.9MB
-
memory/2776-0-0x00000000011A0000-0x000000000124A000-memory.dmpFilesize
680KB
-
memory/2776-4-0x0000000000630000-0x000000000063E000-memory.dmpFilesize
56KB
-
memory/2776-3-0x0000000000610000-0x0000000000628000-memory.dmpFilesize
96KB
-
memory/2776-2-0x0000000004D50000-0x0000000004D90000-memory.dmpFilesize
256KB
-
memory/2776-1-0x0000000074A30000-0x000000007511E000-memory.dmpFilesize
6.9MB