Analysis
- max time kernel
119s - max time network
124s - platform
windows7_x64 - resource
win7-20231215-en - resource tags
- submitted
29/01/2024, 09:25
General
- Target DHL SHIPPING INVOICE.pdf.exe
- Size 610KB
- Sample240129-ldl9sseff2
- SHA256 6e4abc6a114b9b50936426d9eba916fe2a4fa59e9e226ce1c369ffb092d8087d
Malware Config
Extracted
-
agenttesla
-
Protocol
smtp
-
Host
mail.showpiece.trillennium.biz
-
Port
587
-
Username
-
Password
L+D+{64UN$~{
-
Email to
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\DHL SHIPPING INVOICE.pdf.exe"C:\Users\Admin\AppData\Local\Temp\DHL SHIPPING INVOICE.pdf.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\dVJKVcFR" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6539.tmp"2⤵
- Creates scheduled task(s)
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\dVJKVcFR.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\DHL SHIPPING INVOICE.pdf.exe"C:\Users\Admin\AppData\Local\Temp\DHL SHIPPING INVOICE.pdf.exe"2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
tmp6539.tmp
memory/2088-24-0x0000000000400000-0x0000000000440000-memory.dmp
memory/2088-22-0x0000000000400000-0x0000000000440000-memory.dmp
memory/2088-20-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
memory/2088-12-0x0000000000400000-0x0000000000440000-memory.dmp
memory/2088-18-0x0000000000400000-0x0000000000440000-memory.dmp
memory/2088-16-0x0000000000400000-0x0000000000440000-memory.dmp
memory/2088-14-0x0000000000400000-0x0000000000440000-memory.dmp
memory/2476-1-0x00000000745D0000-0x0000000074CBE000-memory.dmp
memory/2476-2-0x0000000004D80000-0x0000000004DC0000-memory.dmp
memory/2476-6-0x0000000005400000-0x000000000547A000-memory.dmp
memory/2476-5-0x0000000001E40000-0x0000000001E4C000-memory.dmp
memory/2476-0-0x0000000000980000-0x0000000000A1E000-memory.dmp
memory/2476-25-0x00000000745D0000-0x0000000074CBE000-memory.dmp
memory/2476-4-0x0000000001E30000-0x0000000001E38000-memory.dmp
memory/2476-3-0x00000000004C0000-0x00000000004D8000-memory.dmp
memory/2776-30-0x00000000746D0000-0x0000000074C7B000-memory.dmp
memory/2776-29-0x00000000746D0000-0x0000000074C7B000-memory.dmp
memory/2776-31-0x00000000746D0000-0x0000000074C7B000-memory.dmp