Analysis
-
max time kernel
142s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20231127-en -
resource tags
arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system -
submitted
06-12-2023 16:32
Static task
static1
Behavioral task
behavioral1
Sample
SHIPPINGDOCUMENTS202993.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
SHIPPINGDOCUMENTS202993.exe
Resource
win10v2004-20231127-en
General
-
Target
SHIPPINGDOCUMENTS202993.exe
-
Size
683KB
-
MD5
6adb7b71640a2f11f8144693e2b15d41
-
SHA1
38c3551a6b02c88e793f37b29a522071100bced6
-
SHA256
b5cd63c5fec95f16d9c11ca726e0bad76d52eb122a6458b3940d5dd94d3a7dfb
-
SHA512
d5a6bca0366b1aed4c03f70defc319e70932c18d9ca89183f08479aa8d306532a50f3e06a08fe4182ae0e86e2980b5971940dca75a5a397f48da5e26d4664c30
-
SSDEEP
12288:C4ueH5qfhisCn/zzGAfjmT0HHy5Jvjgbsfc1DhpYChjAVejJI:PqZxwG4jmT0H6Vjgbcc1Dhpbac
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.amtechcards.com - Port:
587 - Username:
[email protected] - Password:
puuAt8;(Y$NU - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 47 api.ipify.org 48 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
SHIPPINGDOCUMENTS202993.exedescription pid process target process PID 5112 set thread context of 4336 5112 SHIPPINGDOCUMENTS202993.exe RegSvcs.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2740 4336 WerFault.exe RegSvcs.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
SHIPPINGDOCUMENTS202993.exeRegSvcs.exepid process 5112 SHIPPINGDOCUMENTS202993.exe 5112 SHIPPINGDOCUMENTS202993.exe 4336 RegSvcs.exe 4336 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
SHIPPINGDOCUMENTS202993.exeRegSvcs.exedescription pid process Token: SeDebugPrivilege 5112 SHIPPINGDOCUMENTS202993.exe Token: SeDebugPrivilege 4336 RegSvcs.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
SHIPPINGDOCUMENTS202993.exedescription pid process target process PID 5112 wrote to memory of 4336 5112 SHIPPINGDOCUMENTS202993.exe RegSvcs.exe PID 5112 wrote to memory of 4336 5112 SHIPPINGDOCUMENTS202993.exe RegSvcs.exe PID 5112 wrote to memory of 4336 5112 SHIPPINGDOCUMENTS202993.exe RegSvcs.exe PID 5112 wrote to memory of 4336 5112 SHIPPINGDOCUMENTS202993.exe RegSvcs.exe PID 5112 wrote to memory of 4336 5112 SHIPPINGDOCUMENTS202993.exe RegSvcs.exe PID 5112 wrote to memory of 4336 5112 SHIPPINGDOCUMENTS202993.exe RegSvcs.exe PID 5112 wrote to memory of 4336 5112 SHIPPINGDOCUMENTS202993.exe RegSvcs.exe PID 5112 wrote to memory of 4336 5112 SHIPPINGDOCUMENTS202993.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SHIPPINGDOCUMENTS202993.exe"C:\Users\Admin\AppData\Local\Temp\SHIPPINGDOCUMENTS202993.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4336 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4336 -s 19803⤵
- Program crash
PID:2740
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 4336 -ip 43361⤵PID:4716