Analysis
-
max time kernel
138s -
max time network
121s -
platform
windows10_x64 -
resource
win10-en-20211104 -
submitted
01-12-2021 17:28
Static task
static1
Behavioral task
behavioral1
Sample
DHL Delivery Documents.pdf.exe
Resource
win7-en-20211104
Behavioral task
behavioral2
Sample
DHL Delivery Documents.pdf.exe
Resource
win10-en-20211104
General
-
Target
DHL Delivery Documents.pdf.exe
-
Size
619KB
-
MD5
b25de32c3e31abcfb2b051d2d753e79b
-
SHA1
b0675fa9794f8bc58183e23f368f04c9fb8f1da5
-
SHA256
b77b44a682f3bbfeb6bdfeb66fd97bd0796f5fae706661350d767ab585c9d49f
-
SHA512
7f8c61d1170067737a240ac069b386cac64fff86762a866d96ed4820618bedb847e5819bce839deeb750acdb21f9b38546d8c8bc167af48ba4a536aab01c0d65
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.bhgautopartes.com - Port:
587 - Username:
[email protected] - Password:
icui4cu2@@
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/2744-127-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla behavioral2/memory/2744-128-0x0000000000436DCE-mapping.dmp family_agenttesla behavioral2/memory/2744-134-0x0000000005530000-0x0000000005A2E000-memory.dmp family_agenttesla -
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
DHL Delivery Documents.pdf.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 DHL Delivery Documents.pdf.exe Key opened \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 DHL Delivery Documents.pdf.exe Key opened \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 DHL Delivery Documents.pdf.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
DHL Delivery Documents.pdf.exedescription pid process target process PID 3716 set thread context of 2744 3716 DHL Delivery Documents.pdf.exe DHL Delivery Documents.pdf.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
DHL Delivery Documents.pdf.exepid process 2744 DHL Delivery Documents.pdf.exe 2744 DHL Delivery Documents.pdf.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
DHL Delivery Documents.pdf.exedescription pid process Token: SeDebugPrivilege 2744 DHL Delivery Documents.pdf.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
DHL Delivery Documents.pdf.exedescription pid process target process PID 3716 wrote to memory of 2744 3716 DHL Delivery Documents.pdf.exe DHL Delivery Documents.pdf.exe PID 3716 wrote to memory of 2744 3716 DHL Delivery Documents.pdf.exe DHL Delivery Documents.pdf.exe PID 3716 wrote to memory of 2744 3716 DHL Delivery Documents.pdf.exe DHL Delivery Documents.pdf.exe PID 3716 wrote to memory of 2744 3716 DHL Delivery Documents.pdf.exe DHL Delivery Documents.pdf.exe PID 3716 wrote to memory of 2744 3716 DHL Delivery Documents.pdf.exe DHL Delivery Documents.pdf.exe PID 3716 wrote to memory of 2744 3716 DHL Delivery Documents.pdf.exe DHL Delivery Documents.pdf.exe PID 3716 wrote to memory of 2744 3716 DHL Delivery Documents.pdf.exe DHL Delivery Documents.pdf.exe PID 3716 wrote to memory of 2744 3716 DHL Delivery Documents.pdf.exe DHL Delivery Documents.pdf.exe -
outlook_office_path 1 IoCs
Processes:
DHL Delivery Documents.pdf.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 DHL Delivery Documents.pdf.exe -
outlook_win_path 1 IoCs
Processes:
DHL Delivery Documents.pdf.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 DHL Delivery Documents.pdf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\DHL Delivery Documents.pdf.exe"C:\Users\Admin\AppData\Local\Temp\DHL Delivery Documents.pdf.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\DHL Delivery Documents.pdf.exe"C:\Users\Admin\AppData\Local\Temp\DHL Delivery Documents.pdf.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\DHL Delivery Documents.pdf.exe.logMD5
0c2899d7c6746f42d5bbe088c777f94c
SHA1622f66c5f7a3c91b28a9f43ce7c6cabadbf514f1
SHA2565b0b99740cadaeff7b9891136644b396941547e20cc7eea646560d0dad5a5458
SHA512ab7a3409ed4b6ca00358330a3aa4ef6de7d81eb21a5e24bb629ef6a7c7c4e2a70ca3accfbc989ed6e495fdb8eb6203a26d6f2a37b2a5809af4276af375b49078
-
memory/2744-127-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/2744-136-0x0000000006220000-0x0000000006221000-memory.dmpFilesize
4KB
-
memory/2744-135-0x0000000005980000-0x0000000005981000-memory.dmpFilesize
4KB
-
memory/2744-134-0x0000000005530000-0x0000000005A2E000-memory.dmpFilesize
5.0MB
-
memory/2744-128-0x0000000000436DCE-mapping.dmp
-
memory/3716-122-0x0000000004950000-0x0000000004951000-memory.dmpFilesize
4KB
-
memory/3716-126-0x0000000008480000-0x0000000008510000-memory.dmpFilesize
576KB
-
memory/3716-125-0x0000000008240000-0x0000000008241000-memory.dmpFilesize
4KB
-
memory/3716-124-0x0000000004D40000-0x0000000004D46000-memory.dmpFilesize
24KB
-
memory/3716-123-0x0000000004900000-0x0000000004DFE000-memory.dmpFilesize
5.0MB
-
memory/3716-118-0x0000000000060000-0x0000000000061000-memory.dmpFilesize
4KB
-
memory/3716-121-0x00000000049A0000-0x00000000049A1000-memory.dmpFilesize
4KB
-
memory/3716-120-0x0000000004E00000-0x0000000004E01000-memory.dmpFilesize
4KB