Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 18:27
Static task
static1
Behavioral task
behavioral1
Sample
PURCHASE ORDERPO2RU2024.pdf.exe
Resource
win7-20240215-en
General
-
Target
PURCHASE ORDERPO2RU2024.pdf.exe
-
Size
655KB
-
MD5
0218ec5f4de9dc0121ed37aa6fa29955
-
SHA1
f27dd6706c8ff4fee9f44014c678a39051a07b7f
-
SHA256
63dc3769ba6c3bfb7c98266782f767689ec924d22c83d707f46a2166899463fa
-
SHA512
8e2399fd27d811ea093bd63a8adee2099d4f32d2235804304405dedfcd32c5042388de0cbd1d7e3c19bc9ca547634293a5ba59b0bafbed4218b362ac4f00deb3
-
SSDEEP
12288:Ucjmzi8LkpEav2CIqkV3cPSzbKohtG6dyh7tl5sitFQsIlFPlC37tMnpkaqJ:tS2jEr1VV3cP8bKgG6IZl5BFIlFPc3p7
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.alfainterplast.com.ua - Port:
587 - Username:
[email protected] - Password:
pay2024password$$ - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
PURCHASE ORDERPO2RU2024.pdf.exedescription pid process target process PID 2616 set thread context of 2840 2616 PURCHASE ORDERPO2RU2024.pdf.exe PURCHASE ORDERPO2RU2024.pdf.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
PURCHASE ORDERPO2RU2024.pdf.exePURCHASE ORDERPO2RU2024.pdf.exepowershell.exepid process 2616 PURCHASE ORDERPO2RU2024.pdf.exe 2616 PURCHASE ORDERPO2RU2024.pdf.exe 2840 PURCHASE ORDERPO2RU2024.pdf.exe 2840 PURCHASE ORDERPO2RU2024.pdf.exe 2640 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
PURCHASE ORDERPO2RU2024.pdf.exePURCHASE ORDERPO2RU2024.pdf.exepowershell.exedescription pid process Token: SeDebugPrivilege 2616 PURCHASE ORDERPO2RU2024.pdf.exe Token: SeDebugPrivilege 2840 PURCHASE ORDERPO2RU2024.pdf.exe Token: SeDebugPrivilege 2640 powershell.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
PURCHASE ORDERPO2RU2024.pdf.exedescription pid process target process PID 2616 wrote to memory of 2640 2616 PURCHASE ORDERPO2RU2024.pdf.exe powershell.exe PID 2616 wrote to memory of 2640 2616 PURCHASE ORDERPO2RU2024.pdf.exe powershell.exe PID 2616 wrote to memory of 2640 2616 PURCHASE ORDERPO2RU2024.pdf.exe powershell.exe PID 2616 wrote to memory of 2640 2616 PURCHASE ORDERPO2RU2024.pdf.exe powershell.exe PID 2616 wrote to memory of 2840 2616 PURCHASE ORDERPO2RU2024.pdf.exe PURCHASE ORDERPO2RU2024.pdf.exe PID 2616 wrote to memory of 2840 2616 PURCHASE ORDERPO2RU2024.pdf.exe PURCHASE ORDERPO2RU2024.pdf.exe PID 2616 wrote to memory of 2840 2616 PURCHASE ORDERPO2RU2024.pdf.exe PURCHASE ORDERPO2RU2024.pdf.exe PID 2616 wrote to memory of 2840 2616 PURCHASE ORDERPO2RU2024.pdf.exe PURCHASE ORDERPO2RU2024.pdf.exe PID 2616 wrote to memory of 2840 2616 PURCHASE ORDERPO2RU2024.pdf.exe PURCHASE ORDERPO2RU2024.pdf.exe PID 2616 wrote to memory of 2840 2616 PURCHASE ORDERPO2RU2024.pdf.exe PURCHASE ORDERPO2RU2024.pdf.exe PID 2616 wrote to memory of 2840 2616 PURCHASE ORDERPO2RU2024.pdf.exe PURCHASE ORDERPO2RU2024.pdf.exe PID 2616 wrote to memory of 2840 2616 PURCHASE ORDERPO2RU2024.pdf.exe PURCHASE ORDERPO2RU2024.pdf.exe PID 2616 wrote to memory of 2840 2616 PURCHASE ORDERPO2RU2024.pdf.exe PURCHASE ORDERPO2RU2024.pdf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDERPO2RU2024.pdf.exe"C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDERPO2RU2024.pdf.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDERPO2RU2024.pdf.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2640
-
-
C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDERPO2RU2024.pdf.exe"C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDERPO2RU2024.pdf.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2840
-