Analysis
-
max time kernel
205s -
max time network
206s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
29-11-2022 20:18
Static task
static1
Behavioral task
behavioral1
Sample
shipping docs.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
shipping docs.exe
Resource
win10v2004-20221111-en
General
-
Target
shipping docs.exe
-
Size
592KB
-
MD5
6308ae755a893c15a989b1ccf2c56393
-
SHA1
00ada70aa14a5cf26a7f8cecbaaa437267d30a2a
-
SHA256
9dfdb5048599b1083fe534cf5fe5a0440d71eb74b5497e506f0a0a4c23821f40
-
SHA512
e03eac82bf4174912d63cb8eceed393320fe957f7a735ff0f720fbf558f9638e6fc051cb80607864caaa8366ca0edc2d44028367ef97d8020ad7b6f45eaddcd3
-
SSDEEP
12288:ks2kzrbETClbHskFgFwIyXCDl+s30ki9Pi00uSGD6DWzEH:1176ChskFgqIyXoi9Pi00uSTHH
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot5676971476:AAFdGsXW8kwzXNIluAGV-a4sJ2XBy68O9WI/
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
shipping docs.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation shipping docs.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
shipping docs.exedescription pid process target process PID 2908 set thread context of 4340 2908 shipping docs.exe shipping docs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
shipping docs.exepid process 2908 shipping docs.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
shipping docs.exeshipping docs.exedescription pid process Token: SeDebugPrivilege 2908 shipping docs.exe Token: SeDebugPrivilege 4340 shipping docs.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
shipping docs.exedescription pid process target process PID 2908 wrote to memory of 2672 2908 shipping docs.exe schtasks.exe PID 2908 wrote to memory of 2672 2908 shipping docs.exe schtasks.exe PID 2908 wrote to memory of 2672 2908 shipping docs.exe schtasks.exe PID 2908 wrote to memory of 4340 2908 shipping docs.exe shipping docs.exe PID 2908 wrote to memory of 4340 2908 shipping docs.exe shipping docs.exe PID 2908 wrote to memory of 4340 2908 shipping docs.exe shipping docs.exe PID 2908 wrote to memory of 4340 2908 shipping docs.exe shipping docs.exe PID 2908 wrote to memory of 4340 2908 shipping docs.exe shipping docs.exe PID 2908 wrote to memory of 4340 2908 shipping docs.exe shipping docs.exe PID 2908 wrote to memory of 4340 2908 shipping docs.exe shipping docs.exe PID 2908 wrote to memory of 4340 2908 shipping docs.exe shipping docs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\shipping docs.exe"C:\Users\Admin\AppData\Local\Temp\shipping docs.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\yVGAJfiVEvtg" /XML "C:\Users\Admin\AppData\Local\Temp\tmp70A2.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\shipping docs.exe"{path}"2⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\shipping docs.exe.logFilesize
1KB
MD584e77a587d94307c0ac1357eb4d3d46f
SHA183cc900f9401f43d181207d64c5adba7a85edc1e
SHA256e16024b092a026a9dc00df69d4b9bbcab7b2dc178dc5291fc308a1abc9304a99
SHA512aefb5c62200b3ed97718d20a89990954d4d8acdc0a6a73c5a420f1bba619cb79e70c2cd0a579b9f52dc6b09e1de2cea6cd6cac4376cfee92d94e2c01d310f691
-
C:\Users\Admin\AppData\Local\Temp\tmp70A2.tmpFilesize
1KB
MD50ea5ac4afb87bc54c0578e37547bfa28
SHA117cdd9ac52a5dba99a24be7af69fc34cffc57236
SHA2566ce2ec814887382073bca394e25ac2b29333f3f8cdd6538f8df72bf4b5863337
SHA51261011cdc4239b5d17b56464622b4fd13e13532d3b8621c05113425e530059c614a181f7f8c03f1fecae870c1761b7f0eb00572ae9725529b3e67d47d1623022d
-
memory/2672-137-0x0000000000000000-mapping.dmp
-
memory/2908-132-0x0000000000170000-0x000000000020A000-memory.dmpFilesize
616KB
-
memory/2908-133-0x00000000052F0000-0x0000000005894000-memory.dmpFilesize
5.6MB
-
memory/2908-134-0x0000000004BF0000-0x0000000004C82000-memory.dmpFilesize
584KB
-
memory/2908-135-0x0000000004C90000-0x0000000004D2C000-memory.dmpFilesize
624KB
-
memory/2908-136-0x0000000004E50000-0x0000000004E5A000-memory.dmpFilesize
40KB
-
memory/4340-139-0x0000000000000000-mapping.dmp
-
memory/4340-140-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB