Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
01-07-2024 05:12
Static task
static1
Behavioral task
behavioral1
Sample
Price 10243975 Bekotas A.S scan.pdf.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
Price 10243975 Bekotas A.S scan.pdf.exe
Resource
win10v2004-20240611-en
General
-
Target
Price 10243975 Bekotas A.S scan.pdf.exe
-
Size
847KB
-
MD5
fe5d4da9b40dbb8d7e87cbe36b35b68d
-
SHA1
a32438e13f0834cd0fec5335f88994e22050401f
-
SHA256
88fc5d96ebc31042f41c8d80e87a1d6b8c4fabe33f11717dbf417f969604af70
-
SHA512
1f887ec149fbced0e92213ed417a8459029307388725ec04d2e7b1120a482e63e0381ccb1f2d642c49dfa8a84318a5d196a0e3f7c862254471a61f7bec41f0af
-
SSDEEP
12288:c/EE8GILjWLWgHeBoH4vzEe94RRIMMRRc+VhDKujWhNqdgfQOlFutTM7b:RcHBY4eX8+VhBWh0WQQ8
Malware Config
Extracted
Protocol: smtp- Host:
mail.musabody.com - Port:
587 - Username:
[email protected] - Password:
MUSAbody_victoria2018
Extracted
agenttesla
Protocol: smtp- Host:
mail.musabody.com - Port:
587 - Username:
[email protected] - Password:
MUSAbody_victoria2018 - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Price 10243975 Bekotas A.S scan.pdf.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation Price 10243975 Bekotas A.S scan.pdf.exe -
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
Price 10243975 Bekotas A.S scan.pdf.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ctsdvwT = "C:\\Users\\Admin\\AppData\\Roaming\\ctsdvwT\\ctsdvwT.exe" Price 10243975 Bekotas A.S scan.pdf.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Price 10243975 Bekotas A.S scan.pdf.exedescription pid process target process PID 516 set thread context of 2008 516 Price 10243975 Bekotas A.S scan.pdf.exe Price 10243975 Bekotas A.S scan.pdf.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
Price 10243975 Bekotas A.S scan.pdf.exePrice 10243975 Bekotas A.S scan.pdf.exepowershell.exepid process 516 Price 10243975 Bekotas A.S scan.pdf.exe 516 Price 10243975 Bekotas A.S scan.pdf.exe 516 Price 10243975 Bekotas A.S scan.pdf.exe 516 Price 10243975 Bekotas A.S scan.pdf.exe 516 Price 10243975 Bekotas A.S scan.pdf.exe 516 Price 10243975 Bekotas A.S scan.pdf.exe 2008 Price 10243975 Bekotas A.S scan.pdf.exe 2008 Price 10243975 Bekotas A.S scan.pdf.exe 4568 powershell.exe 4568 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
Price 10243975 Bekotas A.S scan.pdf.exePrice 10243975 Bekotas A.S scan.pdf.exepowershell.exedescription pid process Token: SeDebugPrivilege 516 Price 10243975 Bekotas A.S scan.pdf.exe Token: SeDebugPrivilege 2008 Price 10243975 Bekotas A.S scan.pdf.exe Token: SeDebugPrivilege 4568 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Price 10243975 Bekotas A.S scan.pdf.exepid process 2008 Price 10243975 Bekotas A.S scan.pdf.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
Price 10243975 Bekotas A.S scan.pdf.exedescription pid process target process PID 516 wrote to memory of 4568 516 Price 10243975 Bekotas A.S scan.pdf.exe powershell.exe PID 516 wrote to memory of 4568 516 Price 10243975 Bekotas A.S scan.pdf.exe powershell.exe PID 516 wrote to memory of 4568 516 Price 10243975 Bekotas A.S scan.pdf.exe powershell.exe PID 516 wrote to memory of 1584 516 Price 10243975 Bekotas A.S scan.pdf.exe Price 10243975 Bekotas A.S scan.pdf.exe PID 516 wrote to memory of 1584 516 Price 10243975 Bekotas A.S scan.pdf.exe Price 10243975 Bekotas A.S scan.pdf.exe PID 516 wrote to memory of 1584 516 Price 10243975 Bekotas A.S scan.pdf.exe Price 10243975 Bekotas A.S scan.pdf.exe PID 516 wrote to memory of 4320 516 Price 10243975 Bekotas A.S scan.pdf.exe Price 10243975 Bekotas A.S scan.pdf.exe PID 516 wrote to memory of 4320 516 Price 10243975 Bekotas A.S scan.pdf.exe Price 10243975 Bekotas A.S scan.pdf.exe PID 516 wrote to memory of 4320 516 Price 10243975 Bekotas A.S scan.pdf.exe Price 10243975 Bekotas A.S scan.pdf.exe PID 516 wrote to memory of 2008 516 Price 10243975 Bekotas A.S scan.pdf.exe Price 10243975 Bekotas A.S scan.pdf.exe PID 516 wrote to memory of 2008 516 Price 10243975 Bekotas A.S scan.pdf.exe Price 10243975 Bekotas A.S scan.pdf.exe PID 516 wrote to memory of 2008 516 Price 10243975 Bekotas A.S scan.pdf.exe Price 10243975 Bekotas A.S scan.pdf.exe PID 516 wrote to memory of 2008 516 Price 10243975 Bekotas A.S scan.pdf.exe Price 10243975 Bekotas A.S scan.pdf.exe PID 516 wrote to memory of 2008 516 Price 10243975 Bekotas A.S scan.pdf.exe Price 10243975 Bekotas A.S scan.pdf.exe PID 516 wrote to memory of 2008 516 Price 10243975 Bekotas A.S scan.pdf.exe Price 10243975 Bekotas A.S scan.pdf.exe PID 516 wrote to memory of 2008 516 Price 10243975 Bekotas A.S scan.pdf.exe Price 10243975 Bekotas A.S scan.pdf.exe PID 516 wrote to memory of 2008 516 Price 10243975 Bekotas A.S scan.pdf.exe Price 10243975 Bekotas A.S scan.pdf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Price 10243975 Bekotas A.S scan.pdf.exe"C:\Users\Admin\AppData\Local\Temp\Price 10243975 Bekotas A.S scan.pdf.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Price 10243975 Bekotas A.S scan.pdf.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Price 10243975 Bekotas A.S scan.pdf.exe"C:\Users\Admin\AppData\Local\Temp\Price 10243975 Bekotas A.S scan.pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Price 10243975 Bekotas A.S scan.pdf.exe"C:\Users\Admin\AppData\Local\Temp\Price 10243975 Bekotas A.S scan.pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Price 10243975 Bekotas A.S scan.pdf.exe"C:\Users\Admin\AppData\Local\Temp\Price 10243975 Bekotas A.S scan.pdf.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gydd54vs.qas.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
memory/516-14-0x0000000074410000-0x0000000074BC0000-memory.dmpFilesize
7.7MB
-
memory/516-1-0x0000000000F80000-0x0000000001058000-memory.dmpFilesize
864KB
-
memory/516-2-0x0000000005F50000-0x00000000064F4000-memory.dmpFilesize
5.6MB
-
memory/516-3-0x0000000005A40000-0x0000000005AD2000-memory.dmpFilesize
584KB
-
memory/516-4-0x0000000005BE0000-0x0000000005BEA000-memory.dmpFilesize
40KB
-
memory/516-5-0x0000000074410000-0x0000000074BC0000-memory.dmpFilesize
7.7MB
-
memory/516-6-0x0000000005CC0000-0x0000000005CD0000-memory.dmpFilesize
64KB
-
memory/516-7-0x0000000005EE0000-0x0000000005EEC000-memory.dmpFilesize
48KB
-
memory/516-8-0x0000000006500000-0x0000000006582000-memory.dmpFilesize
520KB
-
memory/516-9-0x0000000008AA0000-0x0000000008B3C000-memory.dmpFilesize
624KB
-
memory/516-0-0x000000007441E000-0x000000007441F000-memory.dmpFilesize
4KB
-
memory/2008-21-0x0000000074410000-0x0000000074BC0000-memory.dmpFilesize
7.7MB
-
memory/2008-53-0x0000000005EA0000-0x0000000005EF0000-memory.dmpFilesize
320KB
-
memory/2008-62-0x0000000074410000-0x0000000074BC0000-memory.dmpFilesize
7.7MB
-
memory/2008-10-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2008-15-0x0000000004E80000-0x0000000004EE6000-memory.dmpFilesize
408KB
-
memory/2008-11-0x0000000074410000-0x0000000074BC0000-memory.dmpFilesize
7.7MB
-
memory/4568-49-0x00000000079D0000-0x000000000804A000-memory.dmpFilesize
6.5MB
-
memory/4568-58-0x00000000076A0000-0x00000000076A8000-memory.dmpFilesize
32KB
-
memory/4568-18-0x0000000074410000-0x0000000074BC0000-memory.dmpFilesize
7.7MB
-
memory/4568-22-0x0000000074410000-0x0000000074BC0000-memory.dmpFilesize
7.7MB
-
memory/4568-17-0x0000000074410000-0x0000000074BC0000-memory.dmpFilesize
7.7MB
-
memory/4568-32-0x0000000005A40000-0x0000000005D94000-memory.dmpFilesize
3.3MB
-
memory/4568-33-0x0000000006040000-0x000000000605E000-memory.dmpFilesize
120KB
-
memory/4568-34-0x0000000006070000-0x00000000060BC000-memory.dmpFilesize
304KB
-
memory/4568-36-0x0000000070130000-0x000000007017C000-memory.dmpFilesize
304KB
-
memory/4568-35-0x0000000007240000-0x0000000007272000-memory.dmpFilesize
200KB
-
memory/4568-16-0x0000000005130000-0x0000000005758000-memory.dmpFilesize
6.2MB
-
memory/4568-19-0x0000000005840000-0x0000000005862000-memory.dmpFilesize
136KB
-
memory/4568-51-0x00000000073F0000-0x00000000073FA000-memory.dmpFilesize
40KB
-
memory/4568-50-0x0000000007380000-0x000000000739A000-memory.dmpFilesize
104KB
-
memory/4568-20-0x0000000005960000-0x00000000059C6000-memory.dmpFilesize
408KB
-
memory/4568-52-0x0000000007600000-0x0000000007696000-memory.dmpFilesize
600KB
-
memory/4568-13-0x0000000002760000-0x0000000002796000-memory.dmpFilesize
216KB
-
memory/4568-54-0x0000000007580000-0x0000000007591000-memory.dmpFilesize
68KB
-
memory/4568-55-0x00000000075B0000-0x00000000075BE000-memory.dmpFilesize
56KB
-
memory/4568-56-0x00000000075C0000-0x00000000075D4000-memory.dmpFilesize
80KB
-
memory/4568-57-0x00000000076C0000-0x00000000076DA000-memory.dmpFilesize
104KB
-
memory/4568-48-0x0000000007280000-0x0000000007323000-memory.dmpFilesize
652KB
-
memory/4568-61-0x0000000074410000-0x0000000074BC0000-memory.dmpFilesize
7.7MB
-
memory/4568-46-0x0000000006620000-0x000000000663E000-memory.dmpFilesize
120KB