Analysis
-
max time kernel
153s -
max time network
129s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
23-10-2021 05:31
Static task
static1
Behavioral task
behavioral1
Sample
DHL DELIVERY DOCUMENT.exe
Resource
win7-en-20211014
Behavioral task
behavioral2
Sample
DHL DELIVERY DOCUMENT.exe
Resource
win10-en-20211014
General
-
Target
DHL DELIVERY DOCUMENT.exe
-
Size
732KB
-
MD5
a686c00744d975ed8775855e3885eff4
-
SHA1
8e10da37654b53a3ccfa5fbec2c0f445e553c6bf
-
SHA256
24282f64129f9eb662558f7e0c401065a699701d88ad717000d8fca8bbeba2af
-
SHA512
2c1baa0309fa346bc830ee052353b8a14bc8b6d931460a0cb48a502d2f2588ed674bdf4574863c00060503b5fe51b36109e15463c1f0d3ddeebf1086d3d6bca9
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.yandex.com - Port:
587 - Username:
gregowen12@yandex.ru - Password:
enugu042
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/1272-126-0x000000000043762E-mapping.dmp family_agenttesla behavioral2/memory/1272-125-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla behavioral2/memory/1272-131-0x0000000005490000-0x000000000598E000-memory.dmp family_agenttesla -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
DHL DELIVERY DOCUMENT.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 DHL DELIVERY DOCUMENT.exe Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 DHL DELIVERY DOCUMENT.exe Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 DHL DELIVERY DOCUMENT.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
DHL DELIVERY DOCUMENT.exedescription pid process target process PID 2756 set thread context of 1272 2756 DHL DELIVERY DOCUMENT.exe DHL DELIVERY DOCUMENT.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 9 IoCs
Processes:
DHL DELIVERY DOCUMENT.exeDHL DELIVERY DOCUMENT.exepid process 2756 DHL DELIVERY DOCUMENT.exe 2756 DHL DELIVERY DOCUMENT.exe 2756 DHL DELIVERY DOCUMENT.exe 2756 DHL DELIVERY DOCUMENT.exe 2756 DHL DELIVERY DOCUMENT.exe 2756 DHL DELIVERY DOCUMENT.exe 2756 DHL DELIVERY DOCUMENT.exe 1272 DHL DELIVERY DOCUMENT.exe 1272 DHL DELIVERY DOCUMENT.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
DHL DELIVERY DOCUMENT.exeDHL DELIVERY DOCUMENT.exedescription pid process Token: SeDebugPrivilege 2756 DHL DELIVERY DOCUMENT.exe Token: SeDebugPrivilege 1272 DHL DELIVERY DOCUMENT.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
DHL DELIVERY DOCUMENT.exepid process 1272 DHL DELIVERY DOCUMENT.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
DHL DELIVERY DOCUMENT.exedescription pid process target process PID 2756 wrote to memory of 3416 2756 DHL DELIVERY DOCUMENT.exe schtasks.exe PID 2756 wrote to memory of 3416 2756 DHL DELIVERY DOCUMENT.exe schtasks.exe PID 2756 wrote to memory of 3416 2756 DHL DELIVERY DOCUMENT.exe schtasks.exe PID 2756 wrote to memory of 3932 2756 DHL DELIVERY DOCUMENT.exe DHL DELIVERY DOCUMENT.exe PID 2756 wrote to memory of 3932 2756 DHL DELIVERY DOCUMENT.exe DHL DELIVERY DOCUMENT.exe PID 2756 wrote to memory of 3932 2756 DHL DELIVERY DOCUMENT.exe DHL DELIVERY DOCUMENT.exe PID 2756 wrote to memory of 1272 2756 DHL DELIVERY DOCUMENT.exe DHL DELIVERY DOCUMENT.exe PID 2756 wrote to memory of 1272 2756 DHL DELIVERY DOCUMENT.exe DHL DELIVERY DOCUMENT.exe PID 2756 wrote to memory of 1272 2756 DHL DELIVERY DOCUMENT.exe DHL DELIVERY DOCUMENT.exe PID 2756 wrote to memory of 1272 2756 DHL DELIVERY DOCUMENT.exe DHL DELIVERY DOCUMENT.exe PID 2756 wrote to memory of 1272 2756 DHL DELIVERY DOCUMENT.exe DHL DELIVERY DOCUMENT.exe PID 2756 wrote to memory of 1272 2756 DHL DELIVERY DOCUMENT.exe DHL DELIVERY DOCUMENT.exe PID 2756 wrote to memory of 1272 2756 DHL DELIVERY DOCUMENT.exe DHL DELIVERY DOCUMENT.exe PID 2756 wrote to memory of 1272 2756 DHL DELIVERY DOCUMENT.exe DHL DELIVERY DOCUMENT.exe -
outlook_office_path 1 IoCs
Processes:
DHL DELIVERY DOCUMENT.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 DHL DELIVERY DOCUMENT.exe -
outlook_win_path 1 IoCs
Processes:
DHL DELIVERY DOCUMENT.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 DHL DELIVERY DOCUMENT.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\DHL DELIVERY DOCUMENT.exe"C:\Users\Admin\AppData\Local\Temp\DHL DELIVERY DOCUMENT.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\rwbSibT" /XML "C:\Users\Admin\AppData\Local\Temp\tmp87D9.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\DHL DELIVERY DOCUMENT.exe"C:\Users\Admin\AppData\Local\Temp\DHL DELIVERY DOCUMENT.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\DHL DELIVERY DOCUMENT.exe"C:\Users\Admin\AppData\Local\Temp\DHL DELIVERY DOCUMENT.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1272-126-0x000000000043762E-mapping.dmp
-
memory/1272-133-0x0000000006180000-0x0000000006181000-memory.dmpFilesize
4KB
-
memory/1272-132-0x00000000058F0000-0x00000000058F1000-memory.dmpFilesize
4KB
-
memory/1272-131-0x0000000005490000-0x000000000598E000-memory.dmpFilesize
5.0MB
-
memory/1272-125-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/2756-119-0x0000000006EF0000-0x00000000073EE000-memory.dmpFilesize
5.0MB
-
memory/2756-122-0x0000000008160000-0x0000000008161000-memory.dmpFilesize
4KB
-
memory/2756-123-0x00000000096C0000-0x0000000009718000-memory.dmpFilesize
352KB
-
memory/2756-121-0x00000000071A0000-0x00000000071A7000-memory.dmpFilesize
28KB
-
memory/2756-120-0x0000000002440000-0x0000000002441000-memory.dmpFilesize
4KB
-
memory/2756-115-0x0000000000070000-0x0000000000071000-memory.dmpFilesize
4KB
-
memory/2756-118-0x0000000006EF0000-0x0000000006EF1000-memory.dmpFilesize
4KB
-
memory/2756-117-0x00000000073F0000-0x00000000073F1000-memory.dmpFilesize
4KB
-
memory/3416-124-0x0000000000000000-mapping.dmp