Analysis

  • max time kernel
    93s
  • max time network
    95s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-09-2024 23:16

General

  • Target

    Quotation MAK-2009-15-1 Turbine & Centrifugal Pumps.pdf.exe

  • Size

    366KB

  • MD5

    4359be59a0835b7e548eaf0095515710

  • SHA1

    2929309853d9c0dc36de86c88c92cd4af6fb56e5

  • SHA256

    954bbd9e612117e2fa3f8c71e72ca98461f7ec20fc028d9910f8629cd170ec2b

  • SHA512

    6530cd13d234154426a5153c1d0798726d8648579fa04d0cd410d7094f673bac211fd9420fa91fd480f015f197f860f68c3af0eb1317d80c6780254122605c40

  • SSDEEP

    6144:j0Sxpig6daiXufpZ+fOGeTscz+6O84XUl9MTsTGJcaAmob86XJ0uduWiT26Op:Xx7iXuf3+fOzsC+X8z0Py86+ap

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    smtp.yandex.ru
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    Qwerty2020@@$

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • AgentTesla payload 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Quotation MAK-2009-15-1 Turbine & Centrifugal Pumps.pdf.exe
    "C:\Users\Admin\AppData\Local\Temp\Quotation MAK-2009-15-1 Turbine & Centrifugal Pumps.pdf.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2160
    • C:\Users\Admin\AppData\Local\Temp\Quotation MAK-2009-15-1 Turbine & Centrifugal Pumps.pdf.exe
      "{path}"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2412
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
        dw20.exe -x -s 776
        3⤵
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Checks processor information in registry
        • Enumerates system info in registry
        • Suspicious use of AdjustPrivilegeToken
        PID:1136

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\Quotation MAK-2009-15-1 Turbine & Centrifugal Pumps.pdf.exe.log

    Filesize

    676B

    MD5

    69ec437ef3f34224c9af6e6cbc940477

    SHA1

    9ddf40da2a8240876bf279b75124599067343909

    SHA256

    2b9cca1b480197e8b6130bfd8d3ea4be1c298e9fb863d7bb8ab3ecd6bd1e479b

    SHA512

    c538b6bf962b6a9acba6a7183172ba4c601bc6eadda9579613f63f7730a60baea93413388e682f669dc6170cd908f9e7cedd44cb65793c3619c7e6822ce94527

  • memory/2160-0-0x0000000074662000-0x0000000074663000-memory.dmp

    Filesize

    4KB

  • memory/2160-1-0x0000000074660000-0x0000000074C11000-memory.dmp

    Filesize

    5.7MB

  • memory/2160-2-0x0000000074660000-0x0000000074C11000-memory.dmp

    Filesize

    5.7MB

  • memory/2160-3-0x0000000074662000-0x0000000074663000-memory.dmp

    Filesize

    4KB

  • memory/2160-4-0x0000000074660000-0x0000000074C11000-memory.dmp

    Filesize

    5.7MB

  • memory/2160-5-0x0000000074660000-0x0000000074C11000-memory.dmp

    Filesize

    5.7MB

  • memory/2160-11-0x0000000074660000-0x0000000074C11000-memory.dmp

    Filesize

    5.7MB

  • memory/2412-6-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB

  • memory/2412-9-0x0000000074660000-0x0000000074C11000-memory.dmp

    Filesize

    5.7MB

  • memory/2412-10-0x0000000074660000-0x0000000074C11000-memory.dmp

    Filesize

    5.7MB

  • memory/2412-18-0x0000000074660000-0x0000000074C11000-memory.dmp

    Filesize

    5.7MB