Analysis
-
max time kernel
113s -
max time network
119s -
platform
windows7_x64 -
resource
win7 -
submitted
31-07-2020 11:18
Static task
static1
Behavioral task
behavioral1
Sample
DHL EXPRESS AWB 3245888693- Shipment notification.exe
Resource
win7
Behavioral task
behavioral2
Sample
DHL EXPRESS AWB 3245888693- Shipment notification.exe
Resource
win10v200722
General
-
Target
DHL EXPRESS AWB 3245888693- Shipment notification.exe
-
Size
761KB
-
MD5
dba92db43e4ff19b5b935619c8790d43
-
SHA1
024838721ec8488ee609e859c150c451e5e8deb7
-
SHA256
44f1c379aadd01897d008e197ea88d004ca0013b640d3450dacab6623b16b8e1
-
SHA512
43d5cb19d461287a483f89373b3fbd0cbae1e868e9acedc0e24d386de9866d873c5c82e784ba97e97b46eb299b15d9160f2eee72219cbd4519a3207c57b25475
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.totallyanonymous.com - Port:
587 - Username:
myofficeworkforce@totallyanonymous.com - Password:
WNap~n5E#_rD
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/308-5-0x0000000000400000-0x000000000044A000-memory.dmp family_agenttesla behavioral1/memory/308-6-0x000000000044598E-mapping.dmp family_agenttesla behavioral1/memory/308-7-0x0000000000400000-0x000000000044A000-memory.dmp family_agenttesla behavioral1/memory/308-8-0x0000000000400000-0x000000000044A000-memory.dmp family_agenttesla -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
RegSvcs.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\AppSource = "C:\\Users\\Admin\\AppData\\Roaming\\AppSource\\AppSource.exe" RegSvcs.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
DHL EXPRESS AWB 3245888693- Shipment notification.exedescription pid process target process PID 1460 set thread context of 308 1460 DHL EXPRESS AWB 3245888693- Shipment notification.exe RegSvcs.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
DHL EXPRESS AWB 3245888693- Shipment notification.exeRegSvcs.exepid process 1460 DHL EXPRESS AWB 3245888693- Shipment notification.exe 1460 DHL EXPRESS AWB 3245888693- Shipment notification.exe 1460 DHL EXPRESS AWB 3245888693- Shipment notification.exe 1460 DHL EXPRESS AWB 3245888693- Shipment notification.exe 308 RegSvcs.exe 308 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
DHL EXPRESS AWB 3245888693- Shipment notification.exeRegSvcs.exedescription pid process Token: SeDebugPrivilege 1460 DHL EXPRESS AWB 3245888693- Shipment notification.exe Token: SeDebugPrivilege 308 RegSvcs.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
RegSvcs.exepid process 308 RegSvcs.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
DHL EXPRESS AWB 3245888693- Shipment notification.exedescription pid process target process PID 1460 wrote to memory of 308 1460 DHL EXPRESS AWB 3245888693- Shipment notification.exe RegSvcs.exe PID 1460 wrote to memory of 308 1460 DHL EXPRESS AWB 3245888693- Shipment notification.exe RegSvcs.exe PID 1460 wrote to memory of 308 1460 DHL EXPRESS AWB 3245888693- Shipment notification.exe RegSvcs.exe PID 1460 wrote to memory of 308 1460 DHL EXPRESS AWB 3245888693- Shipment notification.exe RegSvcs.exe PID 1460 wrote to memory of 308 1460 DHL EXPRESS AWB 3245888693- Shipment notification.exe RegSvcs.exe PID 1460 wrote to memory of 308 1460 DHL EXPRESS AWB 3245888693- Shipment notification.exe RegSvcs.exe PID 1460 wrote to memory of 308 1460 DHL EXPRESS AWB 3245888693- Shipment notification.exe RegSvcs.exe PID 1460 wrote to memory of 308 1460 DHL EXPRESS AWB 3245888693- Shipment notification.exe RegSvcs.exe PID 1460 wrote to memory of 308 1460 DHL EXPRESS AWB 3245888693- Shipment notification.exe RegSvcs.exe PID 1460 wrote to memory of 308 1460 DHL EXPRESS AWB 3245888693- Shipment notification.exe RegSvcs.exe PID 1460 wrote to memory of 308 1460 DHL EXPRESS AWB 3245888693- Shipment notification.exe RegSvcs.exe PID 1460 wrote to memory of 308 1460 DHL EXPRESS AWB 3245888693- Shipment notification.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\DHL EXPRESS AWB 3245888693- Shipment notification.exe"C:\Users\Admin\AppData\Local\Temp\DHL EXPRESS AWB 3245888693- Shipment notification.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/308-5-0x0000000000400000-0x000000000044A000-memory.dmpFilesize
296KB
-
memory/308-6-0x000000000044598E-mapping.dmp
-
memory/308-7-0x0000000000400000-0x000000000044A000-memory.dmpFilesize
296KB
-
memory/308-8-0x0000000000400000-0x000000000044A000-memory.dmpFilesize
296KB
-
memory/1460-1-0x0000000000000000-0x0000000000000000-disk.dmp