Analysis
-
max time kernel
3s -
max time network
11s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
19-01-2021 13:07
Static task
static1
Behavioral task
behavioral1
Sample
DHL Notification -AWB DHL-2021011293002.exe
Resource
win7v20201028
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
DHL Notification -AWB DHL-2021011293002.exe
Resource
win10v20201028
0 signatures
0 seconds
General
-
Target
DHL Notification -AWB DHL-2021011293002.exe
-
Size
317KB
-
MD5
6bb9d9d948d3c88ff49e6b2712e6b09b
-
SHA1
95d08d7ef9c8ca30bf763eada0ca4742a3ffce78
-
SHA256
9980343cf5395db3a941411223c889da9abd8862b7ff5e1dcf30d8e4b2439db6
-
SHA512
a182761757f352605d89d555383a3d4c341bdde4de313d89675f4efc14c7bec8cab9f7c1e7f25a5b681f7e9732d9d7d7a7352ea3cb09068bcd80e2fc4197ea3b
Score
10/10
Malware Config
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/324-27-0x0000000000400000-0x000000000044D000-memory.dmp family_agenttesla -
Suspicious use of WriteProcessMemory 48 IoCs
Processes:
DHL Notification -AWB DHL-2021011293002.exeDHL Notification -AWB DHL-2021011293002.exeDHL Notification -AWB DHL-2021011293002.exeDHL Notification -AWB DHL-2021011293002.exeDHL Notification -AWB DHL-2021011293002.exeDHL Notification -AWB DHL-2021011293002.exeDHL Notification -AWB DHL-2021011293002.exeDHL Notification -AWB DHL-2021011293002.exeDHL Notification -AWB DHL-2021011293002.exeDHL Notification -AWB DHL-2021011293002.exeDHL Notification -AWB DHL-2021011293002.exeDHL Notification -AWB DHL-2021011293002.exedescription pid process target process PID 1924 wrote to memory of 1980 1924 DHL Notification -AWB DHL-2021011293002.exe DHL Notification -AWB DHL-2021011293002.exe PID 1924 wrote to memory of 1980 1924 DHL Notification -AWB DHL-2021011293002.exe DHL Notification -AWB DHL-2021011293002.exe PID 1924 wrote to memory of 1980 1924 DHL Notification -AWB DHL-2021011293002.exe DHL Notification -AWB DHL-2021011293002.exe PID 1924 wrote to memory of 1980 1924 DHL Notification -AWB DHL-2021011293002.exe DHL Notification -AWB DHL-2021011293002.exe PID 1980 wrote to memory of 1972 1980 DHL Notification -AWB DHL-2021011293002.exe DHL Notification -AWB DHL-2021011293002.exe PID 1980 wrote to memory of 1972 1980 DHL Notification -AWB DHL-2021011293002.exe DHL Notification -AWB DHL-2021011293002.exe PID 1980 wrote to memory of 1972 1980 DHL Notification -AWB DHL-2021011293002.exe DHL Notification -AWB DHL-2021011293002.exe PID 1980 wrote to memory of 1972 1980 DHL Notification -AWB DHL-2021011293002.exe DHL Notification -AWB DHL-2021011293002.exe PID 1972 wrote to memory of 1788 1972 DHL Notification -AWB DHL-2021011293002.exe DHL Notification -AWB DHL-2021011293002.exe PID 1972 wrote to memory of 1788 1972 DHL Notification -AWB DHL-2021011293002.exe DHL Notification -AWB DHL-2021011293002.exe PID 1972 wrote to memory of 1788 1972 DHL Notification -AWB DHL-2021011293002.exe DHL Notification -AWB DHL-2021011293002.exe PID 1972 wrote to memory of 1788 1972 DHL Notification -AWB DHL-2021011293002.exe DHL Notification -AWB DHL-2021011293002.exe PID 1788 wrote to memory of 1776 1788 DHL Notification -AWB DHL-2021011293002.exe DHL Notification -AWB DHL-2021011293002.exe PID 1788 wrote to memory of 1776 1788 DHL Notification -AWB DHL-2021011293002.exe DHL Notification -AWB DHL-2021011293002.exe PID 1788 wrote to memory of 1776 1788 DHL Notification -AWB DHL-2021011293002.exe DHL Notification -AWB DHL-2021011293002.exe PID 1788 wrote to memory of 1776 1788 DHL Notification -AWB DHL-2021011293002.exe DHL Notification -AWB DHL-2021011293002.exe PID 1776 wrote to memory of 1748 1776 DHL Notification -AWB DHL-2021011293002.exe DHL Notification -AWB DHL-2021011293002.exe PID 1776 wrote to memory of 1748 1776 DHL Notification -AWB DHL-2021011293002.exe DHL Notification -AWB DHL-2021011293002.exe PID 1776 wrote to memory of 1748 1776 DHL Notification -AWB DHL-2021011293002.exe DHL Notification -AWB DHL-2021011293002.exe PID 1776 wrote to memory of 1748 1776 DHL Notification -AWB DHL-2021011293002.exe DHL Notification -AWB DHL-2021011293002.exe PID 1748 wrote to memory of 1796 1748 DHL Notification -AWB DHL-2021011293002.exe DHL Notification -AWB DHL-2021011293002.exe PID 1748 wrote to memory of 1796 1748 DHL Notification -AWB DHL-2021011293002.exe DHL Notification -AWB DHL-2021011293002.exe PID 1748 wrote to memory of 1796 1748 DHL Notification -AWB DHL-2021011293002.exe DHL Notification -AWB DHL-2021011293002.exe PID 1748 wrote to memory of 1796 1748 DHL Notification -AWB DHL-2021011293002.exe DHL Notification -AWB DHL-2021011293002.exe PID 1796 wrote to memory of 1732 1796 DHL Notification -AWB DHL-2021011293002.exe DHL Notification -AWB DHL-2021011293002.exe PID 1796 wrote to memory of 1732 1796 DHL Notification -AWB DHL-2021011293002.exe DHL Notification -AWB DHL-2021011293002.exe PID 1796 wrote to memory of 1732 1796 DHL Notification -AWB DHL-2021011293002.exe DHL Notification -AWB DHL-2021011293002.exe PID 1796 wrote to memory of 1732 1796 DHL Notification -AWB DHL-2021011293002.exe DHL Notification -AWB DHL-2021011293002.exe PID 1732 wrote to memory of 1644 1732 DHL Notification -AWB DHL-2021011293002.exe DHL Notification -AWB DHL-2021011293002.exe PID 1732 wrote to memory of 1644 1732 DHL Notification -AWB DHL-2021011293002.exe DHL Notification -AWB DHL-2021011293002.exe PID 1732 wrote to memory of 1644 1732 DHL Notification -AWB DHL-2021011293002.exe DHL Notification -AWB DHL-2021011293002.exe PID 1732 wrote to memory of 1644 1732 DHL Notification -AWB DHL-2021011293002.exe DHL Notification -AWB DHL-2021011293002.exe PID 1644 wrote to memory of 1636 1644 DHL Notification -AWB DHL-2021011293002.exe DHL Notification -AWB DHL-2021011293002.exe PID 1644 wrote to memory of 1636 1644 DHL Notification -AWB DHL-2021011293002.exe DHL Notification -AWB DHL-2021011293002.exe PID 1644 wrote to memory of 1636 1644 DHL Notification -AWB DHL-2021011293002.exe DHL Notification -AWB DHL-2021011293002.exe PID 1644 wrote to memory of 1636 1644 DHL Notification -AWB DHL-2021011293002.exe DHL Notification -AWB DHL-2021011293002.exe PID 1636 wrote to memory of 316 1636 DHL Notification -AWB DHL-2021011293002.exe DHL Notification -AWB DHL-2021011293002.exe PID 1636 wrote to memory of 316 1636 DHL Notification -AWB DHL-2021011293002.exe DHL Notification -AWB DHL-2021011293002.exe PID 1636 wrote to memory of 316 1636 DHL Notification -AWB DHL-2021011293002.exe DHL Notification -AWB DHL-2021011293002.exe PID 1636 wrote to memory of 316 1636 DHL Notification -AWB DHL-2021011293002.exe DHL Notification -AWB DHL-2021011293002.exe PID 316 wrote to memory of 300 316 DHL Notification -AWB DHL-2021011293002.exe DHL Notification -AWB DHL-2021011293002.exe PID 316 wrote to memory of 300 316 DHL Notification -AWB DHL-2021011293002.exe DHL Notification -AWB DHL-2021011293002.exe PID 316 wrote to memory of 300 316 DHL Notification -AWB DHL-2021011293002.exe DHL Notification -AWB DHL-2021011293002.exe PID 316 wrote to memory of 300 316 DHL Notification -AWB DHL-2021011293002.exe DHL Notification -AWB DHL-2021011293002.exe PID 300 wrote to memory of 324 300 DHL Notification -AWB DHL-2021011293002.exe DHL Notification -AWB DHL-2021011293002.exe PID 300 wrote to memory of 324 300 DHL Notification -AWB DHL-2021011293002.exe DHL Notification -AWB DHL-2021011293002.exe PID 300 wrote to memory of 324 300 DHL Notification -AWB DHL-2021011293002.exe DHL Notification -AWB DHL-2021011293002.exe PID 300 wrote to memory of 324 300 DHL Notification -AWB DHL-2021011293002.exe DHL Notification -AWB DHL-2021011293002.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\DHL Notification -AWB DHL-2021011293002.exe"C:\Users\Admin\AppData\Local\Temp\DHL Notification -AWB DHL-2021011293002.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\DHL Notification -AWB DHL-2021011293002.exe"C:\Users\Admin\AppData\Local\Temp\DHL Notification -AWB DHL-2021011293002.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\DHL Notification -AWB DHL-2021011293002.exe"C:\Users\Admin\AppData\Local\Temp\DHL Notification -AWB DHL-2021011293002.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\DHL Notification -AWB DHL-2021011293002.exe"C:\Users\Admin\AppData\Local\Temp\DHL Notification -AWB DHL-2021011293002.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\DHL Notification -AWB DHL-2021011293002.exe"C:\Users\Admin\AppData\Local\Temp\DHL Notification -AWB DHL-2021011293002.exe"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\DHL Notification -AWB DHL-2021011293002.exe"C:\Users\Admin\AppData\Local\Temp\DHL Notification -AWB DHL-2021011293002.exe"6⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\DHL Notification -AWB DHL-2021011293002.exe"C:\Users\Admin\AppData\Local\Temp\DHL Notification -AWB DHL-2021011293002.exe"7⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\DHL Notification -AWB DHL-2021011293002.exe"C:\Users\Admin\AppData\Local\Temp\DHL Notification -AWB DHL-2021011293002.exe"8⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\DHL Notification -AWB DHL-2021011293002.exe"C:\Users\Admin\AppData\Local\Temp\DHL Notification -AWB DHL-2021011293002.exe"9⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\DHL Notification -AWB DHL-2021011293002.exe"C:\Users\Admin\AppData\Local\Temp\DHL Notification -AWB DHL-2021011293002.exe"10⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\DHL Notification -AWB DHL-2021011293002.exe"C:\Users\Admin\AppData\Local\Temp\DHL Notification -AWB DHL-2021011293002.exe"11⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\DHL Notification -AWB DHL-2021011293002.exe"C:\Users\Admin\AppData\Local\Temp\DHL Notification -AWB DHL-2021011293002.exe"12⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\DHL Notification -AWB DHL-2021011293002.exe"C:\Users\Admin\AppData\Local\Temp\DHL Notification -AWB DHL-2021011293002.exe"13⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/300-23-0x0000000000000000-mapping.dmp
-
memory/316-21-0x0000000000000000-mapping.dmp
-
memory/324-27-0x0000000000400000-0x000000000044D000-memory.dmpFilesize
308KB
-
memory/324-25-0x0000000000000000-mapping.dmp
-
memory/1636-19-0x0000000000000000-mapping.dmp
-
memory/1644-17-0x0000000000000000-mapping.dmp
-
memory/1732-15-0x0000000000000000-mapping.dmp
-
memory/1748-11-0x0000000000000000-mapping.dmp
-
memory/1776-9-0x0000000000000000-mapping.dmp
-
memory/1788-7-0x0000000000000000-mapping.dmp
-
memory/1796-13-0x0000000000000000-mapping.dmp
-
memory/1924-2-0x0000000075AE1000-0x0000000075AE3000-memory.dmpFilesize
8KB
-
memory/1972-5-0x0000000000000000-mapping.dmp
-
memory/1980-3-0x0000000000000000-mapping.dmp