Analysis
-
max time kernel
93s -
max time network
113s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
21-05-2022 00:38
Static task
static1
Behavioral task
behavioral1
Sample
shipping doument.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
shipping doument.exe
Resource
win10v2004-20220414-en
General
-
Target
shipping doument.exe
-
Size
606KB
-
MD5
df464a927fa22e0d5a60ab2cfb494167
-
SHA1
837f52e134d62a29cf638b4b0b26055a11355870
-
SHA256
fb48b5cc967c5bea1799607218168a28acf394c89b5d89de2b7a98ad1a2e0c8c
-
SHA512
328ffbb284f4b24fe02c200bc173986d259ad86661af8bc4a3e45cfcb52307dbae316bf587adbe88d8c42f412c198528cb8dea269f4abe2c23359e5416147959
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.millndustries.com - Port:
587 - Username:
[email protected] - Password:
s@X?j9y~sK3g
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4376-134-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
MSBuild.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key opened \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key opened \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
shipping doument.exedescription pid process target process PID 332 set thread context of 4376 332 shipping doument.exe MSBuild.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
shipping doument.exeMSBuild.exepid process 332 shipping doument.exe 332 shipping doument.exe 332 shipping doument.exe 332 shipping doument.exe 4376 MSBuild.exe 4376 MSBuild.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
shipping doument.exeMSBuild.exedescription pid process Token: SeDebugPrivilege 332 shipping doument.exe Token: SeDebugPrivilege 4376 MSBuild.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
MSBuild.exepid process 4376 MSBuild.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
shipping doument.exedescription pid process target process PID 332 wrote to memory of 4376 332 shipping doument.exe MSBuild.exe PID 332 wrote to memory of 4376 332 shipping doument.exe MSBuild.exe PID 332 wrote to memory of 4376 332 shipping doument.exe MSBuild.exe PID 332 wrote to memory of 4376 332 shipping doument.exe MSBuild.exe PID 332 wrote to memory of 4376 332 shipping doument.exe MSBuild.exe PID 332 wrote to memory of 4376 332 shipping doument.exe MSBuild.exe PID 332 wrote to memory of 4376 332 shipping doument.exe MSBuild.exe PID 332 wrote to memory of 4376 332 shipping doument.exe MSBuild.exe -
outlook_office_path 1 IoCs
Processes:
MSBuild.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe -
outlook_win_path 1 IoCs
Processes:
MSBuild.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\shipping doument.exe"C:\Users\Admin\AppData\Local\Temp\shipping doument.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"{path}"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/332-130-0x0000000000780000-0x000000000081E000-memory.dmpFilesize
632KB
-
memory/332-131-0x0000000005190000-0x000000000522C000-memory.dmpFilesize
624KB
-
memory/332-132-0x00000000052D0000-0x0000000005362000-memory.dmpFilesize
584KB
-
memory/4376-133-0x0000000000000000-mapping.dmp
-
memory/4376-134-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/4376-135-0x0000000005D10000-0x00000000062B4000-memory.dmpFilesize
5.6MB
-
memory/4376-136-0x00000000065B0000-0x0000000006616000-memory.dmpFilesize
408KB
-
memory/4376-137-0x0000000006D90000-0x0000000006DE0000-memory.dmpFilesize
320KB
-
memory/4376-138-0x0000000006D80000-0x0000000006D8A000-memory.dmpFilesize
40KB