Analysis
-
max time kernel
146s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
21-05-2022 10:36
Static task
static1
Behavioral task
behavioral1
Sample
Shipmment Details.doc.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
Shipmment Details.doc.exe
Resource
win10v2004-20220414-en
General
-
Target
Shipmment Details.doc.exe
-
Size
1.5MB
-
MD5
a29e9f883a0d0f00346ce97fdc82dd9e
-
SHA1
4187e3d1a8f2c6bdde6de47df1c55d12a9f3388d
-
SHA256
6a102b33ef9b7e28ed7767acd9d4787e6d35c7cf80df8921d33eb734775d2509
-
SHA512
973c458f344400f9318c8b3aeaa314cd693c527d8863329c44303dab23267bd137d0d4eca34102c527aa6bddd13dca91d4204582db2e661d91520b5ef051ea01
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.hotel71.com.bd - Port:
587 - Username:
[email protected] - Password:
9+^va&phP1v9
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/1824-133-0x0000000000400000-0x0000000000450000-memory.dmp family_agenttesla -
Disables Task Manager via registry modification
-
Drops file in Drivers directory 1 IoCs
Processes:
MSBuild.exedescription ioc process File opened for modification C:\Windows\system32\drivers\etc\hosts MSBuild.exe -
Drops startup file 1 IoCs
Processes:
Shipmment Details.doc.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\omadmprc.url Shipmment Details.doc.exe -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
MSBuild.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key opened \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key opened \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Shipmment Details.doc.exedescription pid process target process PID 3124 set thread context of 1824 3124 Shipmment Details.doc.exe MSBuild.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 24 IoCs
Processes:
MSBuild.exeShipmment Details.doc.exepid process 1824 MSBuild.exe 1824 MSBuild.exe 3124 Shipmment Details.doc.exe 3124 Shipmment Details.doc.exe 3124 Shipmment Details.doc.exe 3124 Shipmment Details.doc.exe 3124 Shipmment Details.doc.exe 3124 Shipmment Details.doc.exe 3124 Shipmment Details.doc.exe 3124 Shipmment Details.doc.exe 3124 Shipmment Details.doc.exe 3124 Shipmment Details.doc.exe 3124 Shipmment Details.doc.exe 3124 Shipmment Details.doc.exe 3124 Shipmment Details.doc.exe 3124 Shipmment Details.doc.exe 3124 Shipmment Details.doc.exe 3124 Shipmment Details.doc.exe 3124 Shipmment Details.doc.exe 3124 Shipmment Details.doc.exe 3124 Shipmment Details.doc.exe 3124 Shipmment Details.doc.exe 3124 Shipmment Details.doc.exe 3124 Shipmment Details.doc.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
MSBuild.exedescription pid process Token: SeDebugPrivilege 1824 MSBuild.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
Shipmment Details.doc.exepid process 3124 Shipmment Details.doc.exe 3124 Shipmment Details.doc.exe 3124 Shipmment Details.doc.exe -
Suspicious use of SendNotifyMessage 3 IoCs
Processes:
Shipmment Details.doc.exepid process 3124 Shipmment Details.doc.exe 3124 Shipmment Details.doc.exe 3124 Shipmment Details.doc.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
Shipmment Details.doc.exeMSBuild.exedescription pid process target process PID 3124 wrote to memory of 1824 3124 Shipmment Details.doc.exe MSBuild.exe PID 3124 wrote to memory of 1824 3124 Shipmment Details.doc.exe MSBuild.exe PID 3124 wrote to memory of 1824 3124 Shipmment Details.doc.exe MSBuild.exe PID 3124 wrote to memory of 1824 3124 Shipmment Details.doc.exe MSBuild.exe PID 3124 wrote to memory of 1824 3124 Shipmment Details.doc.exe MSBuild.exe PID 1824 wrote to memory of 4964 1824 MSBuild.exe REG.exe PID 1824 wrote to memory of 4964 1824 MSBuild.exe REG.exe PID 1824 wrote to memory of 4964 1824 MSBuild.exe REG.exe PID 1824 wrote to memory of 2420 1824 MSBuild.exe netsh.exe PID 1824 wrote to memory of 2420 1824 MSBuild.exe netsh.exe PID 1824 wrote to memory of 2420 1824 MSBuild.exe netsh.exe -
outlook_office_path 1 IoCs
Processes:
MSBuild.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe -
outlook_win_path 1 IoCs
Processes:
MSBuild.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Shipmment Details.doc.exe"C:\Users\Admin\AppData\Local\Temp\Shipmment Details.doc.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\\\\Windows\\\\Microsoft.NET\\\\Framework\\\\v4.0.30319\\\\MSBuild.exe"2⤵
- Drops file in Drivers directory
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
-
C:\Windows\SysWOW64\REG.exeREG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f3⤵
- Modifies registry key
-
C:\Windows\SysWOW64\netsh.exe"netsh" wlan show profile3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1824-132-0x0000000000000000-mapping.dmp
-
memory/1824-133-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/1824-138-0x0000000005710000-0x0000000005CB4000-memory.dmpFilesize
5.6MB
-
memory/1824-139-0x0000000004EE0000-0x0000000004F72000-memory.dmpFilesize
584KB
-
memory/1824-140-0x0000000005200000-0x000000000529C000-memory.dmpFilesize
624KB
-
memory/1824-141-0x00000000056A0000-0x0000000005706000-memory.dmpFilesize
408KB
-
memory/1824-143-0x0000000006DB0000-0x0000000006E00000-memory.dmpFilesize
320KB
-
memory/1824-145-0x0000000005F40000-0x0000000005F4A000-memory.dmpFilesize
40KB
-
memory/2420-144-0x0000000000000000-mapping.dmp
-
memory/3124-130-0x0000000004250000-0x00000000042E4000-memory.dmpFilesize
592KB
-
memory/3124-131-0x0000000005200000-0x0000000005294000-memory.dmpFilesize
592KB
-
memory/4964-142-0x0000000000000000-mapping.dmp