Analysis
- max time kernel
101s - max time network
105s - platform
windows11-21h2_x64 - resource
win11-20250619-en - resource tags
- submitted
22/07/2025, 04:35
General
- Target Purchase_Order_07222025.pdf.exe
- Size 742KB
- Sample250722-e7yrcsspt7
- SHA256 30cbfa02438f1323a65cba36353b3f4b5754480c1a8d53a8a96459063e957c84
Malware Config
Extracted
-
agenttesla
-
Protocol
ftp
-
Host
ftp://ftp.dorasanat.com.tr
-
Port
21
-
Username
-
Password
RoJ_+]WfmkqN
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Agenttesla family
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- SmartAssembly .NET packer 1 IoCs
Detects SmartAssembly .NET packer.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Purchase_Order_07222025.pdf.exe"C:\Users\Admin\AppData\Local\Temp\Purchase_Order_07222025.pdf.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Purchase_Order_07222025.pdf.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\CoXhBpio.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\CoXhBpio" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB45C.tmp"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
__PSScriptPolicyTest_0ebaoeci.ses.ps1
tmpB45C.tmp
memory/960-3-0x0000000005400000-0x0000000005410000-memory.dmp
memory/960-5-0x00000000054B0000-0x000000000554C000-memory.dmp
memory/960-6-0x0000000005580000-0x0000000005594000-memory.dmp
memory/960-7-0x0000000005400000-0x0000000005410000-memory.dmp
memory/960-8-0x0000000006A10000-0x0000000006A96000-memory.dmp
memory/960-4-0x0000000005340000-0x000000000534A000-memory.dmp
memory/960-0-0x0000000000640000-0x0000000000700000-memory.dmp
memory/960-2-0x00000000051A0000-0x0000000005232000-memory.dmp
memory/960-1-0x0000000005660000-0x0000000005C06000-memory.dmp
memory/3732-17-0x0000000002400000-0x0000000002410000-memory.dmp
memory/3732-69-0x0000000007100000-0x0000000007111000-memory.dmp
memory/3732-18-0x0000000004EF0000-0x000000000551A000-memory.dmp
memory/3732-74-0x0000000007230000-0x0000000007238000-memory.dmp
memory/3732-65-0x0000000007530000-0x0000000007BAA000-memory.dmp
memory/3732-68-0x0000000007180000-0x0000000007216000-memory.dmp
memory/3732-16-0x0000000002400000-0x0000000002410000-memory.dmp
memory/3732-72-0x0000000007240000-0x000000000725A000-memory.dmp
memory/3732-71-0x0000000007140000-0x0000000007155000-memory.dmp
memory/3732-42-0x0000000005BA0000-0x0000000005BBE000-memory.dmp
memory/3732-70-0x0000000007130000-0x000000000713E000-memory.dmp
memory/3732-45-0x0000000071000000-0x000000007104C000-memory.dmp
memory/3732-44-0x0000000006160000-0x0000000006194000-memory.dmp
memory/3732-67-0x0000000006F70000-0x0000000006F7A000-memory.dmp
memory/3732-56-0x0000000006BA0000-0x0000000006BBE000-memory.dmp
memory/3732-64-0x0000000006BC0000-0x0000000006C64000-memory.dmp
memory/4328-28-0x0000000000400000-0x0000000000442000-memory.dmp
memory/4328-73-0x0000000006750000-0x00000000067A0000-memory.dmp
memory/4356-13-0x0000000002820000-0x0000000002856000-memory.dmp
memory/4356-66-0x0000000007340000-0x000000000735A000-memory.dmp
memory/4356-54-0x0000000071000000-0x000000007104C000-memory.dmp
memory/4356-43-0x00000000060A0000-0x00000000060EC000-memory.dmp
memory/4356-29-0x0000000005BC0000-0x0000000005F17000-memory.dmp
memory/4356-20-0x0000000005180000-0x00000000051A2000-memory.dmp
memory/4356-22-0x0000000005380000-0x00000000053E6000-memory.dmp
memory/4356-21-0x0000000005260000-0x00000000052C6000-memory.dmp
memory/4356-15-0x0000000004E50000-0x0000000004E60000-memory.dmp
memory/4356-14-0x0000000004E50000-0x0000000004E60000-memory.dmp