Analysis
-
max time kernel
146s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 10:36
Static task
static1
Behavioral task
behavioral1
Sample
Shipmment Details.doc.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
Shipmment Details.doc.exe
Resource
win10v2004-20220414-en
General
-
Target
Shipmment Details.doc.exe
-
Size
1.5MB
-
MD5
a29e9f883a0d0f00346ce97fdc82dd9e
-
SHA1
4187e3d1a8f2c6bdde6de47df1c55d12a9f3388d
-
SHA256
6a102b33ef9b7e28ed7767acd9d4787e6d35c7cf80df8921d33eb734775d2509
-
SHA512
973c458f344400f9318c8b3aeaa314cd693c527d8863329c44303dab23267bd137d0d4eca34102c527aa6bddd13dca91d4204582db2e661d91520b5ef051ea01
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.hotel71.com.bd - Port:
587 - Username:
[email protected] - Password:
9+^va&phP1v9
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1944-57-0x0000000000400000-0x0000000000450000-memory.dmp family_agenttesla behavioral1/memory/1944-62-0x000000000044AC5E-mapping.dmp family_agenttesla behavioral1/memory/1944-63-0x0000000000400000-0x0000000000450000-memory.dmp family_agenttesla behavioral1/memory/1944-64-0x0000000000400000-0x0000000000450000-memory.dmp family_agenttesla -
Disables Task Manager via registry modification
-
Drops file in Drivers directory 1 IoCs
Processes:
MSBuild.exedescription ioc process File opened for modification C:\Windows\system32\drivers\etc\hosts MSBuild.exe -
Drops startup file 1 IoCs
Processes:
Shipmment Details.doc.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\omadmprc.url Shipmment Details.doc.exe -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
MSBuild.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key opened \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key opened \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Shipmment Details.doc.exedescription pid process target process PID 1968 set thread context of 1944 1968 Shipmment Details.doc.exe MSBuild.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 15 IoCs
Processes:
MSBuild.exeShipmment Details.doc.exepid process 1944 MSBuild.exe 1944 MSBuild.exe 1968 Shipmment Details.doc.exe 1968 Shipmment Details.doc.exe 1968 Shipmment Details.doc.exe 1968 Shipmment Details.doc.exe 1968 Shipmment Details.doc.exe 1968 Shipmment Details.doc.exe 1968 Shipmment Details.doc.exe 1968 Shipmment Details.doc.exe 1968 Shipmment Details.doc.exe 1968 Shipmment Details.doc.exe 1968 Shipmment Details.doc.exe 1968 Shipmment Details.doc.exe 1968 Shipmment Details.doc.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
MSBuild.exedescription pid process Token: SeDebugPrivilege 1944 MSBuild.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
Shipmment Details.doc.exepid process 1968 Shipmment Details.doc.exe 1968 Shipmment Details.doc.exe 1968 Shipmment Details.doc.exe -
Suspicious use of SendNotifyMessage 3 IoCs
Processes:
Shipmment Details.doc.exepid process 1968 Shipmment Details.doc.exe 1968 Shipmment Details.doc.exe 1968 Shipmment Details.doc.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
Shipmment Details.doc.exeMSBuild.exedescription pid process target process PID 1968 wrote to memory of 1944 1968 Shipmment Details.doc.exe MSBuild.exe PID 1968 wrote to memory of 1944 1968 Shipmment Details.doc.exe MSBuild.exe PID 1968 wrote to memory of 1944 1968 Shipmment Details.doc.exe MSBuild.exe PID 1968 wrote to memory of 1944 1968 Shipmment Details.doc.exe MSBuild.exe PID 1968 wrote to memory of 1944 1968 Shipmment Details.doc.exe MSBuild.exe PID 1968 wrote to memory of 1944 1968 Shipmment Details.doc.exe MSBuild.exe PID 1944 wrote to memory of 648 1944 MSBuild.exe REG.exe PID 1944 wrote to memory of 648 1944 MSBuild.exe REG.exe PID 1944 wrote to memory of 648 1944 MSBuild.exe REG.exe PID 1944 wrote to memory of 648 1944 MSBuild.exe REG.exe PID 1944 wrote to memory of 1856 1944 MSBuild.exe netsh.exe PID 1944 wrote to memory of 1856 1944 MSBuild.exe netsh.exe PID 1944 wrote to memory of 1856 1944 MSBuild.exe netsh.exe PID 1944 wrote to memory of 1856 1944 MSBuild.exe netsh.exe -
outlook_office_path 1 IoCs
Processes:
MSBuild.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe -
outlook_win_path 1 IoCs
Processes:
MSBuild.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Shipmment Details.doc.exe"C:\Users\Admin\AppData\Local\Temp\Shipmment Details.doc.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\\\\Windows\\\\Microsoft.NET\\\\Framework\\\\v4.0.30319\\\\MSBuild.exe"2⤵
- Drops file in Drivers directory
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:1944 -
C:\Windows\SysWOW64\REG.exeREG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f3⤵
- Modifies registry key
PID:648 -
C:\Windows\SysWOW64\netsh.exe"netsh" wlan show profile3⤵PID:1856
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/648-68-0x0000000000000000-mapping.dmp
-
memory/1856-69-0x0000000000000000-mapping.dmp
-
memory/1944-55-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/1944-57-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/1944-62-0x000000000044AC5E-mapping.dmp
-
memory/1944-63-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/1944-64-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/1968-54-0x0000000075EF1000-0x0000000075EF3000-memory.dmpFilesize
8KB
-
memory/1968-66-0x0000000000200000-0x0000000000294000-memory.dmpFilesize
592KB
-
memory/1968-67-0x0000000002A90000-0x0000000002B24000-memory.dmpFilesize
592KB