Analysis
-
max time kernel
141s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231127-en -
resource tags
arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system -
submitted
01-12-2023 19:29
Static task
static1
Behavioral task
behavioral1
Sample
Shipping Documents.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
Shipping Documents.exe
Resource
win10v2004-20231127-en
General
-
Target
Shipping Documents.exe
-
Size
647KB
-
MD5
c4a1c630b0f8185f81caeee3fb378744
-
SHA1
c57c38a18d2a349d621ab059c28f04ce68302d8c
-
SHA256
0b445847b8750637180e5c10be73bbb758082939394c3fd1ee2a2ea08d61e83d
-
SHA512
5470a96ebbb28efcb1959c0ff9a4a30f95f4e825de1fbe63797219465801eff6a2227baf476371c27ad8a52151cbf0060fc943a47626221959e26f01e870c34b
-
SSDEEP
12288:pHoZzsJ5QWsnm8O1OkfZFZllfvih/IpZAEbRCk9TN0IetKjWo7lb2SGopox:KJsdsPC9ZHfvihA//bRp9xFeAjWrXe
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.iaa-airferight.com - Port:
587 - Username:
[email protected] - Password:
29ftOO+6H-ivsG5A - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Shipping Documents.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3455265224-196869244-2056873367-1000\Control Panel\International\Geo\Nation Shipping Documents.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Shipping Documents.exedescription pid process target process PID 1528 set thread context of 1288 1528 Shipping Documents.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3908 1288 WerFault.exe RegSvcs.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
Shipping Documents.exepowershell.exepowershell.exeRegSvcs.exepid process 1528 Shipping Documents.exe 1528 Shipping Documents.exe 1528 Shipping Documents.exe 2996 powershell.exe 3252 powershell.exe 1528 Shipping Documents.exe 1288 RegSvcs.exe 1288 RegSvcs.exe 3252 powershell.exe 2996 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
Shipping Documents.exepowershell.exepowershell.exeRegSvcs.exedescription pid process Token: SeDebugPrivilege 1528 Shipping Documents.exe Token: SeDebugPrivilege 2996 powershell.exe Token: SeDebugPrivilege 3252 powershell.exe Token: SeDebugPrivilege 1288 RegSvcs.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
Shipping Documents.exedescription pid process target process PID 1528 wrote to memory of 2996 1528 Shipping Documents.exe powershell.exe PID 1528 wrote to memory of 2996 1528 Shipping Documents.exe powershell.exe PID 1528 wrote to memory of 2996 1528 Shipping Documents.exe powershell.exe PID 1528 wrote to memory of 3252 1528 Shipping Documents.exe powershell.exe PID 1528 wrote to memory of 3252 1528 Shipping Documents.exe powershell.exe PID 1528 wrote to memory of 3252 1528 Shipping Documents.exe powershell.exe PID 1528 wrote to memory of 4536 1528 Shipping Documents.exe schtasks.exe PID 1528 wrote to memory of 4536 1528 Shipping Documents.exe schtasks.exe PID 1528 wrote to memory of 4536 1528 Shipping Documents.exe schtasks.exe PID 1528 wrote to memory of 1288 1528 Shipping Documents.exe RegSvcs.exe PID 1528 wrote to memory of 1288 1528 Shipping Documents.exe RegSvcs.exe PID 1528 wrote to memory of 1288 1528 Shipping Documents.exe RegSvcs.exe PID 1528 wrote to memory of 1288 1528 Shipping Documents.exe RegSvcs.exe PID 1528 wrote to memory of 1288 1528 Shipping Documents.exe RegSvcs.exe PID 1528 wrote to memory of 1288 1528 Shipping Documents.exe RegSvcs.exe PID 1528 wrote to memory of 1288 1528 Shipping Documents.exe RegSvcs.exe PID 1528 wrote to memory of 1288 1528 Shipping Documents.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Shipping Documents.exe"C:\Users\Admin\AppData\Local\Temp\Shipping Documents.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Shipping Documents.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2996 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\EvmuRutsny.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3252 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\EvmuRutsny" /XML "C:\Users\Admin\AppData\Local\Temp\tmp172.tmp"2⤵
- Creates scheduled task(s)
PID:4536 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1288 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1288 -s 14003⤵
- Program crash
PID:3908
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1288 -ip 12881⤵PID:2388
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
Filesize
18KB
MD5fb767924820e36fc940182c240d7b6f3
SHA1f4dbb89010a515e3b52f015d0efbc125d664c98e
SHA256de650b01cab0aae6126eb958b105c8a56d5b2a1342661803d8e13462a49f9e6f
SHA512eb663dd0ebf5dc35a67caaa5faab899b8bc50799916c9cf6ac600e156a8b1443ee122e75536ced1d5b8cff368512f1c4cdf3a2b2b8bbf88176a850404d0d0bb8
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
1KB
MD51e7dfb2bc558c84f311bd198264ffe91
SHA1979fd25671a1fe7ecff6fbf6c9b939bc7140aee5
SHA25698c5810f6d9a585e04da09e3f661a239a4e7ab7f6806ac266afadca338d45deb
SHA5120fc2e44422d3b2c4de3e08ce5d324b17102237de6761ccc146ea7afbe82a3f5edfa0c50c18410a9bd6a74bdd94436a5e8bda6a36f0195b85474eb3edc753ae43