Analysis
-
max time kernel
114s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
21-05-2022 12:05
Static task
static1
Behavioral task
behavioral1
Sample
DHL.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
DHL.exe
Resource
win10v2004-20220414-en
General
-
Target
DHL.exe
-
Size
475KB
-
MD5
16135ed5d62f8ca7f63ba5a681e9efa7
-
SHA1
7a963aac589f84f446bef0b1758879065e4d3780
-
SHA256
c0c639e1f923a3dd8e88f2ee1b6a397db9f62c5688f6e04181f43f8b950e8914
-
SHA512
d84c7f051d2b696a8b7b83db87c6786375460f4f4463587ba0534f28db54a6cb378a2162c745f45a46caf4a1176028933b642ee628199e119e5e4844fe9c212a
Malware Config
Extracted
Protocol: smtp- Host:
mail.privateemail.com - Port:
587 - Username:
[email protected] - Password:
mmm777
Extracted
agenttesla
Protocol: smtp- Host:
mail.privateemail.com - Port:
587 - Username:
[email protected] - Password:
mmm777
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/396-134-0x0000000000400000-0x0000000000450000-memory.dmp family_agenttesla -
Drops file in Drivers directory 1 IoCs
Processes:
DHL.exedescription ioc process File opened for modification C:\Windows\system32\drivers\etc\hosts DHL.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
DHL.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation DHL.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
DHL.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 DHL.exe Key opened \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 DHL.exe Key opened \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 DHL.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
DHL.exedescription pid process target process PID 4704 set thread context of 396 4704 DHL.exe DHL.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
DHL.exepid process 396 DHL.exe 396 DHL.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
DHL.exedescription pid process Token: SeDebugPrivilege 396 DHL.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
DHL.exedescription pid process target process PID 4704 wrote to memory of 480 4704 DHL.exe schtasks.exe PID 4704 wrote to memory of 480 4704 DHL.exe schtasks.exe PID 4704 wrote to memory of 480 4704 DHL.exe schtasks.exe PID 4704 wrote to memory of 396 4704 DHL.exe DHL.exe PID 4704 wrote to memory of 396 4704 DHL.exe DHL.exe PID 4704 wrote to memory of 396 4704 DHL.exe DHL.exe PID 4704 wrote to memory of 396 4704 DHL.exe DHL.exe PID 4704 wrote to memory of 396 4704 DHL.exe DHL.exe PID 4704 wrote to memory of 396 4704 DHL.exe DHL.exe PID 4704 wrote to memory of 396 4704 DHL.exe DHL.exe PID 4704 wrote to memory of 396 4704 DHL.exe DHL.exe -
outlook_office_path 1 IoCs
Processes:
DHL.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 DHL.exe -
outlook_win_path 1 IoCs
Processes:
DHL.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 DHL.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\DHL.exe"C:\Users\Admin\AppData\Local\Temp\DHL.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\NxwXqvPNXDOJ" /XML "C:\Users\Admin\AppData\Local\Temp\tmp45E2.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\DHL.exe"{path}"2⤵
- Drops file in Drivers directory
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\DHL.exe.logFilesize
667B
MD5fad44290d2f569240416a287677a6b34
SHA10799266664e37852987cc24398f9a70c7e56742b
SHA256e955c99499359471526e95c22a084d1578997c39ecab988badf6798cfbd995b0
SHA512ee4136ac147d41646368eeb16390598c1da2b9e3bb8331b43062a72e4ad1d05eec56dcc727f9b5b447756c3edc855b08ef0c241073a5f88e749714f2beb98bc3
-
C:\Users\Admin\AppData\Local\Temp\tmp45E2.tmpFilesize
1KB
MD5622f836768602da1ddd8e3cbce612d2e
SHA100c05cf286acfbe965d4ecd278a2dfbbcd417e04
SHA256f97b800cba2cbfead758fedd7e21bdadcdd3eafb46d3f13788103a93764b4902
SHA512d6e1178359c2aed357b5f5a51c7748c6e740f8fdb13790f43b8433dba73f8d879d7ca628789f8468d1e4f931985a3c5670eda4e27ec356e7c5bed272d9f77baa
-
memory/396-133-0x0000000000000000-mapping.dmp
-
memory/396-134-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/396-136-0x00000000748C0000-0x0000000074E71000-memory.dmpFilesize
5.7MB
-
memory/480-131-0x0000000000000000-mapping.dmp
-
memory/4704-130-0x00000000748C0000-0x0000000074E71000-memory.dmpFilesize
5.7MB