Overview

overview

10

Static

static

10

Shipping D...ft.exe

windows7_x64

10

Shipping D...ft.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    91s
  • max time network
    137s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    21-05-2022 02:29

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Shipping Document PL&BL Draft.exe

  • Size

    625KB

  • MD5

    64e4d4aa0542e49e9b08868b241e70db

  • SHA1

    8267f4704aabcc486762b13d91e3130b4e75ba10

  • SHA256

    3bae40f4ada889d55841eebf00744c945343094c081c35c146de733313d9d516

  • SHA512

    47ff8f59cf1e427d7bf77950f2004b167272da31a923e6f83ffd5c75d1b7c8e8ac658f4b2ed12621cd2f14e8b654509769935d3e201e55541e221e22fd99b582

Score
10/10
agentteslacollectionkeyloggerspywarestealertrojan

Malware Config

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    mail.flood-protection.org
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    kelex2424@

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla
  • AgentTesla Payload 1 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
    collection
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Shipping Document PL&BL Draft.exe
    "C:\Users\Admin\AppData\Local\Temp\Shipping Document PL&BL Draft.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2076
    • C:\Users\Admin\AppData\Local\Temp\Shipping Document PL&BL Draft.exe
      "C:\Users\Admin\AppData\Local\Temp\Shipping Document PL&BL Draft.exe"
      2⤵
      • Accesses Microsoft Outlook profiles
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • outlook_office_path
      • outlook_win_path
      PID:840

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2
T1081

Discovery

Lateral Movement

Collection

Data from Local System

2
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Shipping Document PL&BL Draft.exe.log
    Filesize

    1KB

    MD5

    fed4b2d02d876b77e80b88f5c5e70346

    SHA1

    d4427bb1eed013001d46f778e443412d38ea2d4e

    SHA256

    3cfd04c2bfd50f5bcc4f75f7ead4905acf43ba510f14a32caf98d7115b7c3041

    SHA512

    bed97394160275d83ffff61a4b53ddf4440e898c195819c8f8195e71af8e74989e346a85f468956d1427b360f437635fd2dfcf2fb8ef2b9182bd33824e53fe29

    Download Submit
  • memory/840-135-0x0000000000000000-mapping.dmp
    Download
  • memory/840-136-0x0000000000400000-0x000000000044A000-memory.dmp
    Filesize

    296KB

    Download
  • memory/840-138-0x0000000005830000-0x00000000058CC000-memory.dmp
    Filesize

    624KB

    Download
  • memory/840-139-0x00000000064A0000-0x0000000006506000-memory.dmp
    Filesize

    408KB

    Download
  • memory/840-140-0x0000000006980000-0x00000000069D0000-memory.dmp
    Filesize

    320KB

    Download
  • memory/840-141-0x0000000006840000-0x000000000684A000-memory.dmp
    Filesize

    40KB

    Download
  • memory/2076-130-0x0000000000CF0000-0x0000000000D92000-memory.dmp
    Filesize

    648KB

    Download
  • memory/2076-131-0x0000000005D20000-0x00000000062C4000-memory.dmp
    Filesize

    5.6MB

    Download
  • memory/2076-132-0x0000000005860000-0x00000000058F2000-memory.dmp
    Filesize

    584KB

    Download
  • memory/2076-133-0x00000000064D0000-0x0000000006514000-memory.dmp
    Filesize

    272KB

    Download
  • memory/2076-134-0x0000000006B60000-0x0000000006B82000-memory.dmp
    Filesize

    136KB

    Download