Analysis
-
max time kernel
98s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
21-05-2022 02:20
Static task
static1
Behavioral task
behavioral1
Sample
DHL TRACKING AWB.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
DHL TRACKING AWB.exe
Resource
win10v2004-20220414-en
General
-
Target
DHL TRACKING AWB.exe
-
Size
431KB
-
MD5
04ee28357218fa30d113db9c8d775079
-
SHA1
619d2ce20b1ae15f0fc0c6dd4d6b659271ed71e5
-
SHA256
7ae58eeb4ed1bd534122941fa3bb1c2971a982497566757b7a4b062c2756745d
-
SHA512
b7f9826b56e38990a4ca1522487533aeca42a3e205f1ced89d6e46c05b17f1383f8eaf5064bb8aebcb139878ffb97e2eebb3bdbef869bb3cc7e5899e24f140f3
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.microtechlab.in - Port:
587 - Username:
[email protected] - Password:
pune@123
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/1844-138-0x0000000000400000-0x0000000000452000-memory.dmp family_agenttesla -
Disables Task Manager via registry modification
-
Drops file in Drivers directory 1 IoCs
Processes:
RegSvcs.exedescription ioc process File opened for modification C:\Windows\system32\drivers\etc\hosts RegSvcs.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
DHL TRACKING AWB.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation DHL TRACKING AWB.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
RegSvcs.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CpSnJ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\CpSnJ\\CpSnJ.exe" RegSvcs.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
DHL TRACKING AWB.exedescription pid process target process PID 4176 set thread context of 1844 4176 DHL TRACKING AWB.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4780 1844 WerFault.exe RegSvcs.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies registry key 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
DHL TRACKING AWB.exeRegSvcs.exepid process 4176 DHL TRACKING AWB.exe 1844 RegSvcs.exe 1844 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
DHL TRACKING AWB.exeRegSvcs.exedescription pid process Token: SeDebugPrivilege 4176 DHL TRACKING AWB.exe Token: SeDebugPrivilege 1844 RegSvcs.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
DHL TRACKING AWB.exeRegSvcs.exedescription pid process target process PID 4176 wrote to memory of 5104 4176 DHL TRACKING AWB.exe schtasks.exe PID 4176 wrote to memory of 5104 4176 DHL TRACKING AWB.exe schtasks.exe PID 4176 wrote to memory of 5104 4176 DHL TRACKING AWB.exe schtasks.exe PID 4176 wrote to memory of 1844 4176 DHL TRACKING AWB.exe RegSvcs.exe PID 4176 wrote to memory of 1844 4176 DHL TRACKING AWB.exe RegSvcs.exe PID 4176 wrote to memory of 1844 4176 DHL TRACKING AWB.exe RegSvcs.exe PID 4176 wrote to memory of 1844 4176 DHL TRACKING AWB.exe RegSvcs.exe PID 4176 wrote to memory of 1844 4176 DHL TRACKING AWB.exe RegSvcs.exe PID 4176 wrote to memory of 1844 4176 DHL TRACKING AWB.exe RegSvcs.exe PID 4176 wrote to memory of 1844 4176 DHL TRACKING AWB.exe RegSvcs.exe PID 4176 wrote to memory of 1844 4176 DHL TRACKING AWB.exe RegSvcs.exe PID 1844 wrote to memory of 4320 1844 RegSvcs.exe REG.exe PID 1844 wrote to memory of 4320 1844 RegSvcs.exe REG.exe PID 1844 wrote to memory of 4320 1844 RegSvcs.exe REG.exe PID 1844 wrote to memory of 872 1844 RegSvcs.exe netsh.exe PID 1844 wrote to memory of 872 1844 RegSvcs.exe netsh.exe PID 1844 wrote to memory of 872 1844 RegSvcs.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\DHL TRACKING AWB.exe"C:\Users\Admin\AppData\Local\Temp\DHL TRACKING AWB.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\BDujLJKyjL" /XML "C:\Users\Admin\AppData\Local\Temp\tmp7B89.tmp"2⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"2⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\REG.exeREG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f3⤵
- Modifies registry key
-
C:\Windows\SysWOW64\netsh.exe"netsh" wlan show profile3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1844 -s 15803⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1844 -ip 18441⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp7B89.tmpFilesize
1KB
MD5e588a9136375de55e575b576ca07311a
SHA1e49b436b4b3b6ca956f67b62e5b9cad7e05f78ed
SHA256db9c49af40c97cac98e327a18b0ab136dc24b983c6fba2158b9fa5d5b0cf4364
SHA512ad4647c151ac5d6f0f086d4b88b98a22d8ccd3f3bcb2fcf9ee5318911341d80b5ec10d978d54d4644c5b0efcc59b8275e2c2e4920b3a0afe25a828ca00ec4148
-
memory/872-142-0x0000000000000000-mapping.dmp
-
memory/1844-139-0x00000000058F0000-0x0000000005956000-memory.dmpFilesize
408KB
-
memory/1844-137-0x0000000000000000-mapping.dmp
-
memory/1844-138-0x0000000000400000-0x0000000000452000-memory.dmpFilesize
328KB
-
memory/1844-141-0x00000000065D0000-0x0000000006620000-memory.dmpFilesize
320KB
-
memory/4176-133-0x00000000057C0000-0x00000000057CA000-memory.dmpFilesize
40KB
-
memory/4176-134-0x00000000090C0000-0x000000000915C000-memory.dmpFilesize
624KB
-
memory/4176-132-0x0000000005800000-0x0000000005892000-memory.dmpFilesize
584KB
-
memory/4176-130-0x0000000000DA0000-0x0000000000E12000-memory.dmpFilesize
456KB
-
memory/4176-131-0x0000000005EB0000-0x0000000006454000-memory.dmpFilesize
5.6MB
-
memory/4320-140-0x0000000000000000-mapping.dmp
-
memory/5104-135-0x0000000000000000-mapping.dmp