Analysis
-
max time kernel
67s -
max time network
53s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
29-04-2024 10:32
Static task
static1
Behavioral task
behavioral1
Sample
Overdue Account.pdf.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Overdue Account.pdf.exe
Resource
win10v2004-20240419-en
General
-
Target
Overdue Account.pdf.exe
-
Size
670KB
-
MD5
81937e479c70381a7527b21693ab3e6c
-
SHA1
fbac04ef1e0315bff71d908496309d731da30c75
-
SHA256
e48b7b9ba50d500f569024126a2ff8981db13525ff378ea2151ce8d6b7e4e452
-
SHA512
35b56dce2a110c145a4c4bef02a5e0151835ea1f1d64891e346f77bf3ce4a3cae2b81f098e819183a2f664f28997845a22b071805e76c97a009b2f6241bbaded
-
SSDEEP
12288:PBB778QJ5RBdmrRwANBlJi/l/XbBzN5L/ObdOC0uCnGbmSAnJGXuY7GzkR:ZBDB0rqclJeNvL/EpV5bmJKu0
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.nooshdaroodc.com - Port:
587 - Username:
[email protected] - Password:
Nou$h@Darou - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Overdue Account.pdf.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation Overdue Account.pdf.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
RegSvcs.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\boqXv = "C:\\Users\\Admin\\AppData\\Roaming\\boqXv\\boqXv.exe" RegSvcs.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Overdue Account.pdf.exedescription pid process target process PID 1096 set thread context of 5064 1096 Overdue Account.pdf.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 15 IoCs
Processes:
Overdue Account.pdf.exepowershell.exepowershell.exeRegSvcs.exepid process 1096 Overdue Account.pdf.exe 1096 Overdue Account.pdf.exe 1096 Overdue Account.pdf.exe 1096 Overdue Account.pdf.exe 1096 Overdue Account.pdf.exe 1096 Overdue Account.pdf.exe 2976 powershell.exe 2788 powershell.exe 2788 powershell.exe 1096 Overdue Account.pdf.exe 1096 Overdue Account.pdf.exe 2976 powershell.exe 1096 Overdue Account.pdf.exe 5064 RegSvcs.exe 5064 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
Overdue Account.pdf.exepowershell.exepowershell.exeRegSvcs.exedescription pid process Token: SeDebugPrivilege 1096 Overdue Account.pdf.exe Token: SeDebugPrivilege 2976 powershell.exe Token: SeDebugPrivilege 2788 powershell.exe Token: SeDebugPrivilege 5064 RegSvcs.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
Overdue Account.pdf.exedescription pid process target process PID 1096 wrote to memory of 2976 1096 Overdue Account.pdf.exe powershell.exe PID 1096 wrote to memory of 2976 1096 Overdue Account.pdf.exe powershell.exe PID 1096 wrote to memory of 2976 1096 Overdue Account.pdf.exe powershell.exe PID 1096 wrote to memory of 2788 1096 Overdue Account.pdf.exe powershell.exe PID 1096 wrote to memory of 2788 1096 Overdue Account.pdf.exe powershell.exe PID 1096 wrote to memory of 2788 1096 Overdue Account.pdf.exe powershell.exe PID 1096 wrote to memory of 1552 1096 Overdue Account.pdf.exe schtasks.exe PID 1096 wrote to memory of 1552 1096 Overdue Account.pdf.exe schtasks.exe PID 1096 wrote to memory of 1552 1096 Overdue Account.pdf.exe schtasks.exe PID 1096 wrote to memory of 1176 1096 Overdue Account.pdf.exe RegSvcs.exe PID 1096 wrote to memory of 1176 1096 Overdue Account.pdf.exe RegSvcs.exe PID 1096 wrote to memory of 1176 1096 Overdue Account.pdf.exe RegSvcs.exe PID 1096 wrote to memory of 5064 1096 Overdue Account.pdf.exe RegSvcs.exe PID 1096 wrote to memory of 5064 1096 Overdue Account.pdf.exe RegSvcs.exe PID 1096 wrote to memory of 5064 1096 Overdue Account.pdf.exe RegSvcs.exe PID 1096 wrote to memory of 5064 1096 Overdue Account.pdf.exe RegSvcs.exe PID 1096 wrote to memory of 5064 1096 Overdue Account.pdf.exe RegSvcs.exe PID 1096 wrote to memory of 5064 1096 Overdue Account.pdf.exe RegSvcs.exe PID 1096 wrote to memory of 5064 1096 Overdue Account.pdf.exe RegSvcs.exe PID 1096 wrote to memory of 5064 1096 Overdue Account.pdf.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Overdue Account.pdf.exe"C:\Users\Admin\AppData\Local\Temp\Overdue Account.pdf.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Overdue Account.pdf.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\kpSYqS.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\kpSYqS" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8D5B.tmp"2⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_o1ddq3bw.lbe.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\tmp8D5B.tmpFilesize
1KB
MD5ee141fd7a64ec11841cd98e5f4e24f96
SHA16512eb51e15ffa417beb66fa6969e62c38dd75ac
SHA2563d52d8ac9c997fc03176d5184738fdb8a2aa2284d816a6694d231cd8b8da621f
SHA51293a1f14451cf62d4b79ee686a0648c7357b75bd3dc01a1dbf69dd27277688372e8bd6f22f6cbb5061fc12a010d312ed2d31daf9fe2fac6dcf5a1a9089f30cd4e
-
memory/1096-16-0x0000000075150000-0x0000000075900000-memory.dmpFilesize
7.7MB
-
memory/1096-1-0x0000000075150000-0x0000000075900000-memory.dmpFilesize
7.7MB
-
memory/1096-4-0x00000000055F0000-0x0000000005600000-memory.dmpFilesize
64KB
-
memory/1096-5-0x0000000005720000-0x000000000572A000-memory.dmpFilesize
40KB
-
memory/1096-6-0x0000000006C80000-0x0000000006C98000-memory.dmpFilesize
96KB
-
memory/1096-7-0x0000000006890000-0x000000000689E000-memory.dmpFilesize
56KB
-
memory/1096-8-0x00000000068A0000-0x00000000068B6000-memory.dmpFilesize
88KB
-
memory/1096-9-0x0000000006920000-0x00000000069A2000-memory.dmpFilesize
520KB
-
memory/1096-10-0x0000000009080000-0x000000000911C000-memory.dmpFilesize
624KB
-
memory/1096-52-0x0000000075150000-0x0000000075900000-memory.dmpFilesize
7.7MB
-
memory/1096-0-0x0000000000D50000-0x0000000000DFA000-memory.dmpFilesize
680KB
-
memory/1096-21-0x00000000055F0000-0x0000000005600000-memory.dmpFilesize
64KB
-
memory/1096-3-0x0000000005640000-0x00000000056D2000-memory.dmpFilesize
584KB
-
memory/1096-2-0x0000000005CD0000-0x0000000006274000-memory.dmpFilesize
5.6MB
-
memory/2788-64-0x00000000060A0000-0x00000000060BE000-memory.dmpFilesize
120KB
-
memory/2788-26-0x00000000046C0000-0x00000000046D0000-memory.dmpFilesize
64KB
-
memory/2788-82-0x00000000070B0000-0x00000000070C4000-memory.dmpFilesize
80KB
-
memory/2788-79-0x00000000070F0000-0x0000000007186000-memory.dmpFilesize
600KB
-
memory/2788-81-0x00000000070A0000-0x00000000070AE000-memory.dmpFilesize
56KB
-
memory/2788-27-0x00000000046C0000-0x00000000046D0000-memory.dmpFilesize
64KB
-
memory/2788-80-0x0000000007070000-0x0000000007081000-memory.dmpFilesize
68KB
-
memory/2788-78-0x0000000006EF0000-0x0000000006EFA000-memory.dmpFilesize
40KB
-
memory/2788-25-0x0000000075150000-0x0000000075900000-memory.dmpFilesize
7.7MB
-
memory/2788-83-0x00000000071B0000-0x00000000071CA000-memory.dmpFilesize
104KB
-
memory/2788-75-0x0000000006D40000-0x0000000006DE3000-memory.dmpFilesize
652KB
-
memory/2788-54-0x0000000070350000-0x000000007039C000-memory.dmpFilesize
304KB
-
memory/2788-89-0x0000000075150000-0x0000000075900000-memory.dmpFilesize
7.7MB
-
memory/2788-51-0x00000000060E0000-0x000000000612C000-memory.dmpFilesize
304KB
-
memory/2788-49-0x0000000005B50000-0x0000000005B6E000-memory.dmpFilesize
120KB
-
memory/2788-53-0x0000000006140000-0x0000000006172000-memory.dmpFilesize
200KB
-
memory/2976-88-0x0000000075150000-0x0000000075900000-memory.dmpFilesize
7.7MB
-
memory/2976-23-0x0000000004EB0000-0x0000000004F16000-memory.dmpFilesize
408KB
-
memory/2976-33-0x00000000057B0000-0x0000000005B04000-memory.dmpFilesize
3.3MB
-
memory/2976-24-0x0000000005600000-0x0000000005666000-memory.dmpFilesize
408KB
-
memory/2976-77-0x0000000007100000-0x000000000711A000-memory.dmpFilesize
104KB
-
memory/2976-76-0x0000000007750000-0x0000000007DCA000-memory.dmpFilesize
6.5MB
-
memory/2976-22-0x0000000004E10000-0x0000000004E32000-memory.dmpFilesize
136KB
-
memory/2976-65-0x0000000070350000-0x000000007039C000-memory.dmpFilesize
304KB
-
memory/2976-17-0x0000000004FD0000-0x00000000055F8000-memory.dmpFilesize
6.2MB
-
memory/2976-18-0x0000000075150000-0x0000000075900000-memory.dmpFilesize
7.7MB
-
memory/2976-19-0x00000000025E0000-0x00000000025F0000-memory.dmpFilesize
64KB
-
memory/2976-20-0x00000000025E0000-0x00000000025F0000-memory.dmpFilesize
64KB
-
memory/2976-85-0x0000000007420000-0x0000000007428000-memory.dmpFilesize
32KB
-
memory/2976-15-0x00000000024F0000-0x0000000002526000-memory.dmpFilesize
216KB
-
memory/5064-48-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/5064-90-0x00000000066F0000-0x0000000006740000-memory.dmpFilesize
320KB