Analysis
-
max time kernel
90s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
29-11-2022 18:59
Static task
static1
Behavioral task
behavioral1
Sample
BL-SHIPPING DOCUMENTS.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
BL-SHIPPING DOCUMENTS.exe
Resource
win10v2004-20220901-en
General
-
Target
BL-SHIPPING DOCUMENTS.exe
-
Size
478KB
-
MD5
69fe54a9cafee09f25e0d3f7a51488c7
-
SHA1
747373a2640c7fca04258681c7ec313be3b0db24
-
SHA256
dc72c7525da8aa1afaadaf707499054dd9be20d0c78318d2f63af1fa37d58546
-
SHA512
4230111e1b90da8e5d628bcfd16f9381cb24e9c0e31d3772798ea5bf78c711bc2634bf0343f323d094f23f587b6be5fd41f7828323d09f8a3ce0506c65a50706
-
SSDEEP
12288:0ZYJmqS//u3ML7l++F7oNt6YkIwaD2YSHTK:0Sg43ML7cEs8VaYTK
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot5515611206:AAEcQSX8hXHOAxSYr8KUdLxGF5eqw4FRXoA/
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
BL-SHIPPING DOCUMENTS.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\TaskKill\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\Иисус.sys" BL-SHIPPING DOCUMENTS.exe -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
CasPol.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 CasPol.exe Key opened \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 CasPol.exe Key opened \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 CasPol.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
BL-SHIPPING DOCUMENTS.exedescription pid process target process PID 4752 set thread context of 1096 4752 BL-SHIPPING DOCUMENTS.exe CasPol.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
CasPol.exepid process 1096 CasPol.exe 1096 CasPol.exe 1096 CasPol.exe -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
BL-SHIPPING DOCUMENTS.exepid process 4752 BL-SHIPPING DOCUMENTS.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
BL-SHIPPING DOCUMENTS.exeCasPol.exedescription pid process Token: SeDebugPrivilege 4752 BL-SHIPPING DOCUMENTS.exe Token: SeLoadDriverPrivilege 4752 BL-SHIPPING DOCUMENTS.exe Token: SeDebugPrivilege 1096 CasPol.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
BL-SHIPPING DOCUMENTS.exedescription pid process target process PID 4752 wrote to memory of 1096 4752 BL-SHIPPING DOCUMENTS.exe CasPol.exe PID 4752 wrote to memory of 1096 4752 BL-SHIPPING DOCUMENTS.exe CasPol.exe PID 4752 wrote to memory of 1096 4752 BL-SHIPPING DOCUMENTS.exe CasPol.exe PID 4752 wrote to memory of 1096 4752 BL-SHIPPING DOCUMENTS.exe CasPol.exe PID 4752 wrote to memory of 1096 4752 BL-SHIPPING DOCUMENTS.exe CasPol.exe PID 4752 wrote to memory of 1096 4752 BL-SHIPPING DOCUMENTS.exe CasPol.exe PID 4752 wrote to memory of 1096 4752 BL-SHIPPING DOCUMENTS.exe CasPol.exe PID 4752 wrote to memory of 1096 4752 BL-SHIPPING DOCUMENTS.exe CasPol.exe -
outlook_office_path 1 IoCs
Processes:
CasPol.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 CasPol.exe -
outlook_win_path 1 IoCs
Processes:
CasPol.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 CasPol.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\BL-SHIPPING DOCUMENTS.exe"C:\Users\Admin\AppData\Local\Temp\BL-SHIPPING DOCUMENTS.exe"1⤵
- Sets service image path in registry
- Suspicious use of SetThreadContext
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1096-134-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1096-135-0x0000000000437AAE-mapping.dmp
-
memory/1096-137-0x0000000005E30000-0x00000000063D4000-memory.dmpFilesize
5.6MB
-
memory/1096-138-0x00000000059A0000-0x0000000005A3C000-memory.dmpFilesize
624KB
-
memory/1096-139-0x0000000006720000-0x0000000006786000-memory.dmpFilesize
408KB
-
memory/1096-140-0x0000000006AB0000-0x0000000006B00000-memory.dmpFilesize
320KB
-
memory/1096-141-0x0000000006C20000-0x0000000006CB2000-memory.dmpFilesize
584KB
-
memory/1096-142-0x0000000006F30000-0x0000000006F3A000-memory.dmpFilesize
40KB
-
memory/4752-132-0x000002CA08BE0000-0x000002CA08C5C000-memory.dmpFilesize
496KB
-
memory/4752-133-0x00007FFE943A0000-0x00007FFE94E61000-memory.dmpFilesize
10.8MB
-
memory/4752-136-0x00007FFE943A0000-0x00007FFE94E61000-memory.dmpFilesize
10.8MB