Analysis
-
max time kernel
117s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system -
submitted
06-12-2023 16:32
Static task
static1
Behavioral task
behavioral1
Sample
SHIPPINGDOCUMENTS202993.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
SHIPPINGDOCUMENTS202993.exe
Resource
win10v2004-20231127-en
General
-
Target
SHIPPINGDOCUMENTS202993.exe
-
Size
683KB
-
MD5
6adb7b71640a2f11f8144693e2b15d41
-
SHA1
38c3551a6b02c88e793f37b29a522071100bced6
-
SHA256
b5cd63c5fec95f16d9c11ca726e0bad76d52eb122a6458b3940d5dd94d3a7dfb
-
SHA512
d5a6bca0366b1aed4c03f70defc319e70932c18d9ca89183f08479aa8d306532a50f3e06a08fe4182ae0e86e2980b5971940dca75a5a397f48da5e26d4664c30
-
SSDEEP
12288:C4ueH5qfhisCn/zzGAfjmT0HHy5Jvjgbsfc1DhpYChjAVejJI:PqZxwG4jmT0H6Vjgbcc1Dhpbac
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.amtechcards.com - Port:
587 - Username:
[email protected] - Password:
puuAt8;(Y$NU - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 api.ipify.org 5 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
SHIPPINGDOCUMENTS202993.exedescription pid process target process PID 2560 set thread context of 2756 2560 SHIPPINGDOCUMENTS202993.exe RegSvcs.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
SHIPPINGDOCUMENTS202993.exeRegSvcs.exepid process 2560 SHIPPINGDOCUMENTS202993.exe 2560 SHIPPINGDOCUMENTS202993.exe 2756 RegSvcs.exe 2756 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
SHIPPINGDOCUMENTS202993.exeRegSvcs.exedescription pid process Token: SeDebugPrivilege 2560 SHIPPINGDOCUMENTS202993.exe Token: SeDebugPrivilege 2756 RegSvcs.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
RegSvcs.exepid process 2756 RegSvcs.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
SHIPPINGDOCUMENTS202993.exedescription pid process target process PID 2560 wrote to memory of 2756 2560 SHIPPINGDOCUMENTS202993.exe RegSvcs.exe PID 2560 wrote to memory of 2756 2560 SHIPPINGDOCUMENTS202993.exe RegSvcs.exe PID 2560 wrote to memory of 2756 2560 SHIPPINGDOCUMENTS202993.exe RegSvcs.exe PID 2560 wrote to memory of 2756 2560 SHIPPINGDOCUMENTS202993.exe RegSvcs.exe PID 2560 wrote to memory of 2756 2560 SHIPPINGDOCUMENTS202993.exe RegSvcs.exe PID 2560 wrote to memory of 2756 2560 SHIPPINGDOCUMENTS202993.exe RegSvcs.exe PID 2560 wrote to memory of 2756 2560 SHIPPINGDOCUMENTS202993.exe RegSvcs.exe PID 2560 wrote to memory of 2756 2560 SHIPPINGDOCUMENTS202993.exe RegSvcs.exe PID 2560 wrote to memory of 2756 2560 SHIPPINGDOCUMENTS202993.exe RegSvcs.exe PID 2560 wrote to memory of 2756 2560 SHIPPINGDOCUMENTS202993.exe RegSvcs.exe PID 2560 wrote to memory of 2756 2560 SHIPPINGDOCUMENTS202993.exe RegSvcs.exe PID 2560 wrote to memory of 2756 2560 SHIPPINGDOCUMENTS202993.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SHIPPINGDOCUMENTS202993.exe"C:\Users\Admin\AppData\Local\Temp\SHIPPINGDOCUMENTS202993.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2756