Analysis
-
max time kernel
130s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
19-09-2024 00:26
Static task
static1
Behavioral task
behavioral1
Sample
PDF4563784.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
PDF4563784.exe
Resource
win10v2004-20240802-en
General
-
Target
PDF4563784.exe
-
Size
1.1MB
-
MD5
f716b9d1dfef7d20b0afc1b4084f39b6
-
SHA1
01536c02c2e8b232a36cf338c3f1007774830702
-
SHA256
18a2826ae0c8ce3e76a5cb806e89d0070f70cc372cf37468721b8caf8529f401
-
SHA512
ac69e2ff2f18462cd251bee3c9667e794f2156ab89cd57ca73603c308fe298a2b9f20d262161a2ba4d098ec0ba49b08dcc033d6373c4d6f27763c9ddf446b782
-
SSDEEP
24576:qTiZucOaCrYz4jEmW/g+bRrSPMzIW3C453xSo4uKNPlS:CcyrKmW/PFSPNU53xUPA
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.totallyanonymous.com - Port:
587 - Username:
honebots@totallyanonymous.com - Password:
572h094S - Email To:
jaffinco@cock.li
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload 1 IoCs
resource yara_rule behavioral2/memory/4500-15-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla -
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation PDF4563784.exe -
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key opened \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key opened \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4396 set thread context of 4500 4396 PDF4563784.exe 94 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PDF4563784.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSBuild.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1628 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4396 PDF4563784.exe 4396 PDF4563784.exe 4396 PDF4563784.exe 4396 PDF4563784.exe 4500 MSBuild.exe 4500 MSBuild.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4396 PDF4563784.exe Token: SeDebugPrivilege 4500 MSBuild.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 4396 wrote to memory of 1628 4396 PDF4563784.exe 92 PID 4396 wrote to memory of 1628 4396 PDF4563784.exe 92 PID 4396 wrote to memory of 1628 4396 PDF4563784.exe 92 PID 4396 wrote to memory of 4500 4396 PDF4563784.exe 94 PID 4396 wrote to memory of 4500 4396 PDF4563784.exe 94 PID 4396 wrote to memory of 4500 4396 PDF4563784.exe 94 PID 4396 wrote to memory of 4500 4396 PDF4563784.exe 94 PID 4396 wrote to memory of 4500 4396 PDF4563784.exe 94 PID 4396 wrote to memory of 4500 4396 PDF4563784.exe 94 PID 4396 wrote to memory of 4500 4396 PDF4563784.exe 94 PID 4396 wrote to memory of 4500 4396 PDF4563784.exe 94 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PDF4563784.exe"C:\Users\Admin\AppData\Local\Temp\PDF4563784.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4396 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\QauPVUBK" /XML "C:\Users\Admin\AppData\Local\Temp\tmp20C2.tmp"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1628
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"{path}"2⤵
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:4500
-
Network
-
Remote address:8.8.8.8:53Request154.239.44.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request240.221.184.93.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request240.221.184.93.in-addr.arpaIN PTR
-
Remote address:8.8.8.8:53Request14.160.190.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTR
-
Remote address:8.8.8.8:53Request133.211.185.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request13.86.106.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request26.165.165.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request171.39.242.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request232.135.221.88.in-addr.arpaIN PTRResponse232.135.221.88.in-addr.arpaIN PTRa88-221-135-232deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request77.190.18.2.in-addr.arpaIN PTRResponse77.190.18.2.in-addr.arpaIN PTRa2-18-190-77deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request79.190.18.2.in-addr.arpaIN PTRResponse79.190.18.2.in-addr.arpaIN PTRa2-18-190-79deploystaticakamaitechnologiescom
-
72 B 158 B 1 1
DNS Request
154.239.44.20.in-addr.arpa
-
146 B 144 B 2 1
DNS Request
240.221.184.93.in-addr.arpa
DNS Request
240.221.184.93.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
14.160.190.20.in-addr.arpa
-
146 B 144 B 2 1
DNS Request
95.221.229.192.in-addr.arpa
DNS Request
95.221.229.192.in-addr.arpa
-
73 B 147 B 1 1
DNS Request
133.211.185.52.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
13.86.106.20.in-addr.arpa
-
72 B 146 B 1 1
DNS Request
26.165.165.52.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
171.39.242.20.in-addr.arpa
-
73 B 139 B 1 1
DNS Request
232.135.221.88.in-addr.arpa
-
70 B 133 B 1 1
DNS Request
77.190.18.2.in-addr.arpa
-
70 B 133 B 1 1
DNS Request
79.190.18.2.in-addr.arpa
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5a8688a1f992d14cca82c1392b3612317
SHA116e19eef6e73cffe0d1b5f45643e9b2351c656bc
SHA2560aaca862e3def48ebebb60f63faae842535cda96ebc826bc063bb5d5143e0dbf
SHA512a8eab0fff9cbc88fdbf2ded0f48b233b5cdb57d759fe533940d5e8d770a51b11f31b38ac3523a57e84bfaa7111f19572c66552a42b9bb963e1decc6901c66fef