Analysis
-
max time kernel
145s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
28-06-2022 10:01
Static task
static1
Behavioral task
behavioral1
Sample
Shipping Document PL&BL Draft.js
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
Shipping Document PL&BL Draft.js
Resource
win10v2004-20220414-en
General
-
Target
Shipping Document PL&BL Draft.js
-
Size
426KB
-
MD5
fd67c425734de81bb9c3162c88c6b533
-
SHA1
f014e4ee129ca9dc958282af207f2554a383df25
-
SHA256
b700763d46a1c32e807707dc7402a10894af27a76db31ef118387a65e415a9d6
-
SHA512
d5e6fd504e128f5e31c788741413224529570fc5e4a1073fcaadb12299220e2f54ff3f7672c470c1a70064aba3facbf73c1ee7beb707871a4e0e825c8c30e271
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot1900836728:AAEDyoYbBJwtt1EA4hdgRlGTN1cq760KPNU/sendDocument
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 3 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\OBOMIKE4.exe family_agenttesla C:\Users\Admin\AppData\Local\Temp\OBOMIKE4.exe family_agenttesla behavioral2/memory/3228-135-0x00000000003A0000-0x00000000003DC000-memory.dmp family_agenttesla -
Blocklisted process makes network request 16 IoCs
Processes:
wscript.exeflow pid process 3 1356 wscript.exe 14 1356 wscript.exe 21 1356 wscript.exe 30 1356 wscript.exe 34 1356 wscript.exe 37 1356 wscript.exe 38 1356 wscript.exe 41 1356 wscript.exe 42 1356 wscript.exe 43 1356 wscript.exe 46 1356 wscript.exe 47 1356 wscript.exe 48 1356 wscript.exe 49 1356 wscript.exe 50 1356 wscript.exe 51 1356 wscript.exe -
Executes dropped EXE 1 IoCs
Processes:
OBOMIKE4.exepid process 3228 OBOMIKE4.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
wscript.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation wscript.exe -
Drops startup file 2 IoCs
Processes:
wscript.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bAMdEtWEre.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bAMdEtWEre.js wscript.exe -
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
OBOMIKE4.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 OBOMIKE4.exe Key opened \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 OBOMIKE4.exe Key opened \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 OBOMIKE4.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
wscript.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Windows\CurrentVersion\Run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\YVBPFHTJIQ = "\"C:\\Users\\Admin\\AppData\\Roaming\\bAMdEtWEre.js\"" wscript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
OBOMIKE4.exepid process 3228 OBOMIKE4.exe 3228 OBOMIKE4.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
OBOMIKE4.exedescription pid process Token: SeDebugPrivilege 3228 OBOMIKE4.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
wscript.exedescription pid process target process PID 1364 wrote to memory of 1356 1364 wscript.exe wscript.exe PID 1364 wrote to memory of 1356 1364 wscript.exe wscript.exe PID 1364 wrote to memory of 3228 1364 wscript.exe OBOMIKE4.exe PID 1364 wrote to memory of 3228 1364 wscript.exe OBOMIKE4.exe PID 1364 wrote to memory of 3228 1364 wscript.exe OBOMIKE4.exe -
outlook_office_path 1 IoCs
Processes:
OBOMIKE4.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 OBOMIKE4.exe -
outlook_win_path 1 IoCs
Processes:
OBOMIKE4.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 OBOMIKE4.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\Shipping Document PL&BL Draft.js"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\bAMdEtWEre.js"2⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
-
C:\Users\Admin\AppData\Local\Temp\OBOMIKE4.exe"C:\Users\Admin\AppData\Local\Temp\OBOMIKE4.exe"2⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\OBOMIKE4.exeFilesize
214KB
MD509ea679f5c2a7265f399dd573799f7ec
SHA100860df49548b17be8fc13966651f0d7e4c80541
SHA25608308a421943014b117236d146c4a6514116daa0a8ae0b8379ccfe84b4f0b09c
SHA5120869871b068e061da9e8839bfb96d9464d935beb7893bd8a78e671e9c402860fdf1be557df2191436591e1320cba944e7b58e790cf29f87ba95e0fe42aff0fb6
-
C:\Users\Admin\AppData\Local\Temp\OBOMIKE4.exeFilesize
214KB
MD509ea679f5c2a7265f399dd573799f7ec
SHA100860df49548b17be8fc13966651f0d7e4c80541
SHA25608308a421943014b117236d146c4a6514116daa0a8ae0b8379ccfe84b4f0b09c
SHA5120869871b068e061da9e8839bfb96d9464d935beb7893bd8a78e671e9c402860fdf1be557df2191436591e1320cba944e7b58e790cf29f87ba95e0fe42aff0fb6
-
C:\Users\Admin\AppData\Roaming\bAMdEtWEre.jsFilesize
17KB
MD51444b44e915d4c7a53cee3f4bfc8d5e9
SHA1a6a0434b56c1967aaa75e307fa7dda3d7906c34c
SHA2564a9b17d41ff25f9752a7c5255bc11a653f930d07339e20c8e11c97fa9db013c3
SHA51226d3ffc5b6b66ccd4ee3ea11a9a1f30e64e1bc4009413e85922249d7a8957a1a4836e04d21d4c3f039e869eb81b4122f2371cba2bf34671d91b3dc0a686313d2
-
memory/1356-130-0x0000000000000000-mapping.dmp
-
memory/3228-132-0x0000000000000000-mapping.dmp
-
memory/3228-135-0x00000000003A0000-0x00000000003DC000-memory.dmpFilesize
240KB
-
memory/3228-136-0x0000000005290000-0x0000000005834000-memory.dmpFilesize
5.6MB
-
memory/3228-137-0x0000000004D90000-0x0000000004E22000-memory.dmpFilesize
584KB
-
memory/3228-138-0x0000000005010000-0x00000000050AC000-memory.dmpFilesize
624KB
-
memory/3228-139-0x0000000005C80000-0x0000000005CE6000-memory.dmpFilesize
408KB
-
memory/3228-140-0x0000000000C60000-0x0000000000CB0000-memory.dmpFilesize
320KB
-
memory/3228-141-0x00000000007D0000-0x00000000007DA000-memory.dmpFilesize
40KB