Analysis
-
max time kernel
122s -
max time network
170s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
27-07-2021 20:27
Static task
static1
Behavioral task
behavioral1
Sample
DHL-AW1258901FE2021_pdf.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
DHL-AW1258901FE2021_pdf.exe
Resource
win10v20210408
General
-
Target
DHL-AW1258901FE2021_pdf.exe
-
Size
797KB
-
MD5
8ae76778cf4bd4ea09d7c6fe8e5ceb7c
-
SHA1
c81411a8d7abcd68fcec07a67dd33a520767f8e3
-
SHA256
4d50e241422bc31d14cac7c4fafc411b53e165e27e6f70f33ce0c4266b817157
-
SHA512
05a76a99b07c2402b87f0f1424161ed24070eb88598f2ab3943ec6ace1febb2e734290e4e49137748a5e6c35c1808f4e35f415f546d6a89a347ff0afec4bc000
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtpout.secureserver.net - Port:
587 - Username:
sales1@ashtavinayaka.com - Password:
123456789
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/876-65-0x00000000004374EE-mapping.dmp family_agenttesla behavioral1/memory/876-64-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla -
Suspicious use of SetThreadContext 1 IoCs
Processes:
DHL-AW1258901FE2021_pdf.exedescription pid process target process PID 2024 set thread context of 876 2024 DHL-AW1258901FE2021_pdf.exe DHL-AW1258901FE2021_pdf.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
DHL-AW1258901FE2021_pdf.exeDHL-AW1258901FE2021_pdf.exepid process 2024 DHL-AW1258901FE2021_pdf.exe 876 DHL-AW1258901FE2021_pdf.exe 876 DHL-AW1258901FE2021_pdf.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
DHL-AW1258901FE2021_pdf.exeDHL-AW1258901FE2021_pdf.exedescription pid process Token: SeDebugPrivilege 2024 DHL-AW1258901FE2021_pdf.exe Token: SeDebugPrivilege 876 DHL-AW1258901FE2021_pdf.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
DHL-AW1258901FE2021_pdf.exeDHL-AW1258901FE2021_pdf.exedescription pid process target process PID 2024 wrote to memory of 380 2024 DHL-AW1258901FE2021_pdf.exe schtasks.exe PID 2024 wrote to memory of 380 2024 DHL-AW1258901FE2021_pdf.exe schtasks.exe PID 2024 wrote to memory of 380 2024 DHL-AW1258901FE2021_pdf.exe schtasks.exe PID 2024 wrote to memory of 380 2024 DHL-AW1258901FE2021_pdf.exe schtasks.exe PID 2024 wrote to memory of 876 2024 DHL-AW1258901FE2021_pdf.exe DHL-AW1258901FE2021_pdf.exe PID 2024 wrote to memory of 876 2024 DHL-AW1258901FE2021_pdf.exe DHL-AW1258901FE2021_pdf.exe PID 2024 wrote to memory of 876 2024 DHL-AW1258901FE2021_pdf.exe DHL-AW1258901FE2021_pdf.exe PID 2024 wrote to memory of 876 2024 DHL-AW1258901FE2021_pdf.exe DHL-AW1258901FE2021_pdf.exe PID 2024 wrote to memory of 876 2024 DHL-AW1258901FE2021_pdf.exe DHL-AW1258901FE2021_pdf.exe PID 2024 wrote to memory of 876 2024 DHL-AW1258901FE2021_pdf.exe DHL-AW1258901FE2021_pdf.exe PID 2024 wrote to memory of 876 2024 DHL-AW1258901FE2021_pdf.exe DHL-AW1258901FE2021_pdf.exe PID 2024 wrote to memory of 876 2024 DHL-AW1258901FE2021_pdf.exe DHL-AW1258901FE2021_pdf.exe PID 2024 wrote to memory of 876 2024 DHL-AW1258901FE2021_pdf.exe DHL-AW1258901FE2021_pdf.exe PID 876 wrote to memory of 1668 876 DHL-AW1258901FE2021_pdf.exe dw20.exe PID 876 wrote to memory of 1668 876 DHL-AW1258901FE2021_pdf.exe dw20.exe PID 876 wrote to memory of 1668 876 DHL-AW1258901FE2021_pdf.exe dw20.exe PID 876 wrote to memory of 1668 876 DHL-AW1258901FE2021_pdf.exe dw20.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\DHL-AW1258901FE2021_pdf.exe"C:\Users\Admin\AppData\Local\Temp\DHL-AW1258901FE2021_pdf.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\tshiAyXHtrWPz" /XML "C:\Users\Admin\AppData\Local\Temp\tmp7DA8.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\DHL-AW1258901FE2021_pdf.exe"C:\Users\Admin\AppData\Local\Temp\DHL-AW1258901FE2021_pdf.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 5163⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp7DA8.tmpMD5
d3d1f1763662ee2841bb72ecefc8b169
SHA14d68d0a5588d5ae28951e595d93aba9e8cebb92d
SHA2563b166ce6df7699244953346939863b890d9a344858ac74b38d05c93fe31f7fe5
SHA5120e8c226b723b0069b4edb40e0d78137e87924c4864dc0a704d6f097f2b78b131fbbf8418af74914ebfd856ded2d65886f910966ad1eed3e0d31259b4e17ddd92
-
memory/380-62-0x0000000000000000-mapping.dmp
-
memory/876-65-0x00000000004374EE-mapping.dmp
-
memory/876-64-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/876-67-0x0000000000E40000-0x0000000000E41000-memory.dmpFilesize
4KB
-
memory/1668-68-0x0000000000000000-mapping.dmp
-
memory/1668-70-0x0000000000620000-0x0000000000621000-memory.dmpFilesize
4KB
-
memory/2024-59-0x0000000076A81000-0x0000000076A83000-memory.dmpFilesize
8KB
-
memory/2024-60-0x00000000002A0000-0x00000000002A1000-memory.dmpFilesize
4KB
-
memory/2024-61-0x00000000002A1000-0x00000000002A2000-memory.dmpFilesize
4KB