Analysis
-
max time kernel
107s -
max time network
44s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 04:19
Static task
static1
Behavioral task
behavioral1
Sample
SHIPPING DOCS.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
SHIPPING DOCS.exe
Resource
win10v2004-20220414-en
General
-
Target
SHIPPING DOCS.exe
-
Size
946KB
-
MD5
171ca85e67c01bde72301be27ace1050
-
SHA1
69df124e840920a7039ba089494430d6ca368675
-
SHA256
26175cc093fdbd5e8d5f16281b38028a13a27d09cf488259ac74f3116499905c
-
SHA512
fbfccfcf467778d0571f0849c6c366f5d93f92d2014dcb04e6904429508ac6efb9f1e50f086d478f2731f7c11268b06b7c6de2ad518d5da38bb1adadc6486974
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.wasstech.com - Port:
587 - Username:
[email protected] - Password:
Sunray2700@@
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/752-59-0x0000000000400000-0x0000000000464000-memory.dmp family_agenttesla behavioral1/memory/752-60-0x0000000000400000-0x0000000000464000-memory.dmp family_agenttesla behavioral1/memory/752-62-0x000000000045FD2E-mapping.dmp family_agenttesla behavioral1/memory/752-61-0x0000000000400000-0x0000000000464000-memory.dmp family_agenttesla behavioral1/memory/752-64-0x0000000000400000-0x0000000000464000-memory.dmp family_agenttesla behavioral1/memory/752-66-0x0000000000400000-0x0000000000464000-memory.dmp family_agenttesla -
Loads dropped DLL 1 IoCs
Processes:
SHIPPING DOCS.exepid process 1472 SHIPPING DOCS.exe -
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
SHIPPING DOCS.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 SHIPPING DOCS.exe Key opened \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 SHIPPING DOCS.exe Key opened \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 SHIPPING DOCS.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
SHIPPING DOCS.exedescription pid process target process PID 1472 set thread context of 752 1472 SHIPPING DOCS.exe SHIPPING DOCS.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
NTFS ADS 1 IoCs
Processes:
cmd.exedescription ioc process File created C:\Users\Admin\AppData\Local\Temp\FolderN\name.exe:Zone.Identifier cmd.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
SHIPPING DOCS.exeSHIPPING DOCS.exepid process 1472 SHIPPING DOCS.exe 1472 SHIPPING DOCS.exe 752 SHIPPING DOCS.exe 752 SHIPPING DOCS.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
SHIPPING DOCS.exeSHIPPING DOCS.exedescription pid process Token: SeDebugPrivilege 1472 SHIPPING DOCS.exe Token: SeDebugPrivilege 752 SHIPPING DOCS.exe -
Suspicious use of WriteProcessMemory 25 IoCs
Processes:
SHIPPING DOCS.execmd.exedescription pid process target process PID 1472 wrote to memory of 752 1472 SHIPPING DOCS.exe SHIPPING DOCS.exe PID 1472 wrote to memory of 752 1472 SHIPPING DOCS.exe SHIPPING DOCS.exe PID 1472 wrote to memory of 752 1472 SHIPPING DOCS.exe SHIPPING DOCS.exe PID 1472 wrote to memory of 752 1472 SHIPPING DOCS.exe SHIPPING DOCS.exe PID 1472 wrote to memory of 752 1472 SHIPPING DOCS.exe SHIPPING DOCS.exe PID 1472 wrote to memory of 752 1472 SHIPPING DOCS.exe SHIPPING DOCS.exe PID 1472 wrote to memory of 752 1472 SHIPPING DOCS.exe SHIPPING DOCS.exe PID 1472 wrote to memory of 752 1472 SHIPPING DOCS.exe SHIPPING DOCS.exe PID 1472 wrote to memory of 752 1472 SHIPPING DOCS.exe SHIPPING DOCS.exe PID 1472 wrote to memory of 1832 1472 SHIPPING DOCS.exe cmd.exe PID 1472 wrote to memory of 1832 1472 SHIPPING DOCS.exe cmd.exe PID 1472 wrote to memory of 1832 1472 SHIPPING DOCS.exe cmd.exe PID 1472 wrote to memory of 1832 1472 SHIPPING DOCS.exe cmd.exe PID 1472 wrote to memory of 1664 1472 SHIPPING DOCS.exe cmd.exe PID 1472 wrote to memory of 1664 1472 SHIPPING DOCS.exe cmd.exe PID 1472 wrote to memory of 1664 1472 SHIPPING DOCS.exe cmd.exe PID 1472 wrote to memory of 1664 1472 SHIPPING DOCS.exe cmd.exe PID 1664 wrote to memory of 928 1664 cmd.exe reg.exe PID 1664 wrote to memory of 928 1664 cmd.exe reg.exe PID 1664 wrote to memory of 928 1664 cmd.exe reg.exe PID 1664 wrote to memory of 928 1664 cmd.exe reg.exe PID 1472 wrote to memory of 656 1472 SHIPPING DOCS.exe cmd.exe PID 1472 wrote to memory of 656 1472 SHIPPING DOCS.exe cmd.exe PID 1472 wrote to memory of 656 1472 SHIPPING DOCS.exe cmd.exe PID 1472 wrote to memory of 656 1472 SHIPPING DOCS.exe cmd.exe -
outlook_office_path 1 IoCs
Processes:
SHIPPING DOCS.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 SHIPPING DOCS.exe -
outlook_win_path 1 IoCs
Processes:
SHIPPING DOCS.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 SHIPPING DOCS.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SHIPPING DOCS.exe"C:\Users\Admin\AppData\Local\Temp\SHIPPING DOCS.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SHIPPING DOCS.exe"C:/Users/Admin/AppData/Local/Temp/SHIPPING DOCS.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy "C:/Users/Admin/AppData/Local/Temp/SHIPPING DOCS.exe" "%temp%\FolderN\name.exe" /Y2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "%temp%\FolderN\name.exe.lnk" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\FolderN\name.exe.lnk" /f3⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c echo [zoneTransfer]ZoneID = 2 > %temp%\FolderN\name.exe:Zone.Identifier2⤵
- NTFS ADS
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\FolderN\name.exeFilesize
946KB
MD5171ca85e67c01bde72301be27ace1050
SHA169df124e840920a7039ba089494430d6ca368675
SHA25626175cc093fdbd5e8d5f16281b38028a13a27d09cf488259ac74f3116499905c
SHA512fbfccfcf467778d0571f0849c6c366f5d93f92d2014dcb04e6904429508ac6efb9f1e50f086d478f2731f7c11268b06b7c6de2ad518d5da38bb1adadc6486974
-
\Users\Admin\AppData\Local\Temp\FolderN\name.exeFilesize
946KB
MD5171ca85e67c01bde72301be27ace1050
SHA169df124e840920a7039ba089494430d6ca368675
SHA25626175cc093fdbd5e8d5f16281b38028a13a27d09cf488259ac74f3116499905c
SHA512fbfccfcf467778d0571f0849c6c366f5d93f92d2014dcb04e6904429508ac6efb9f1e50f086d478f2731f7c11268b06b7c6de2ad518d5da38bb1adadc6486974
-
memory/656-74-0x0000000000000000-mapping.dmp
-
memory/752-64-0x0000000000400000-0x0000000000464000-memory.dmpFilesize
400KB
-
memory/752-59-0x0000000000400000-0x0000000000464000-memory.dmpFilesize
400KB
-
memory/752-60-0x0000000000400000-0x0000000000464000-memory.dmpFilesize
400KB
-
memory/752-62-0x000000000045FD2E-mapping.dmp
-
memory/752-61-0x0000000000400000-0x0000000000464000-memory.dmpFilesize
400KB
-
memory/752-56-0x0000000000400000-0x0000000000464000-memory.dmpFilesize
400KB
-
memory/752-66-0x0000000000400000-0x0000000000464000-memory.dmpFilesize
400KB
-
memory/752-57-0x0000000000400000-0x0000000000464000-memory.dmpFilesize
400KB
-
memory/928-71-0x0000000000000000-mapping.dmp
-
memory/1472-67-0x0000000074F21000-0x0000000074F23000-memory.dmpFilesize
8KB
-
memory/1472-54-0x00000000001D0000-0x00000000002C2000-memory.dmpFilesize
968KB
-
memory/1472-55-0x0000000000750000-0x00000000007BC000-memory.dmpFilesize
432KB
-
memory/1664-70-0x0000000000000000-mapping.dmp
-
memory/1832-69-0x0000000000000000-mapping.dmp