Analysis

  • max time kernel
    149s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/03/2024, 12:31

General

  • Target

    Shipment Receipt.exe

  • Size

    526KB

  • MD5

    63431a90363414f88d575f70f27762ce

  • SHA1

    fd0268e6b54a60f2c04a577b1f0001a4176138c8

  • SHA256

    865306d0b13516f7f33fbd707d0d92c8706e4bfb1a99153c1361559f710bd45e

  • SHA512

    b51c3f6041c40a3a662d98cc2dc925629a86f927d08a71e76309c10694d45cec0ba498f4bb34fb6f48759618ec6edd9c365dcc2b091e15729d75f5b051667901

  • SSDEEP

    12288:oS2dnErpbwb05qldvfvcf7Ac4kj3WdmrJheUuuUjvQ9B:L2dE1b405qldncMc4kjWSJUuUjvy

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot6387496510:AAGzkvOV3EOvSZjPNfclsVSKq_tcdKpU-7o/

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 1 IoCs
  • Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 11 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Shipment Receipt.exe
    "C:\Users\Admin\AppData\Local\Temp\Shipment Receipt.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious use of WriteProcessMemory
    PID:2384
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -windowstyle hidden "$Amningsmrkerne=Get-Content 'C:\Users\Admin\AppData\Local\mafficks\Regretable\Prferencetolden\Alluder152\Brinie29.Ban';$Hieromachy=$Amningsmrkerne.SubString(58610,3);.$Hieromachy($Amningsmrkerne)"
      2⤵
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3560
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /c "set /A 1^^0"
        3⤵
          PID:1984
        • C:\Program Files (x86)\windows mail\wab.exe
          "C:\Program Files (x86)\windows mail\wab.exe"
          3⤵
          • Suspicious use of NtCreateThreadExHideFromDebugger
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:2200

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_d1uwoesc.54n.ps1

            Filesize

            60B

            MD5

            d17fe0a3f47be24a6453e9ef58c94641

            SHA1

            6ab83620379fc69f80c0242105ddffd7d98d5d9d

            SHA256

            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

            SHA512

            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

          • C:\Users\Admin\AppData\Local\mafficks\Afplinger\Hasinai\Pollinoid\Unglandular\Mayapple.Rel

            Filesize

            336KB

            MD5

            7887bc8c00f4047fac6240ae2b268401

            SHA1

            17f09ef15224297fa2a3f86b71f00860c3c6ae7d

            SHA256

            19e4e4dea076a8755f146fa6a539953e0c4ccb2af451759b370e9be88903d5c1

            SHA512

            36618f70d27054150e91f1ab2f0cf0de329722ebdddddf7bbb3f5d48a4d0a3f81716ca4c93e339e432267e67a9db729f87d426d34c47b1a480181ec01190575f

          • C:\Users\Admin\AppData\Local\mafficks\Regretable\Prferencetolden\Alluder152\Brinie29.Ban

            Filesize

            57KB

            MD5

            606f3c0d77738574d051cf2f7140aafd

            SHA1

            becf7fe1fe0af569c52c94abadc970cca66ec0a6

            SHA256

            5bb0a1909d79ecf1060382416cd6df278b2be9af709e3b072ca983d62f9b4861

            SHA512

            8bcd585c03b3e8a145a17da6c00e3423d6f0e00f8ca3c34959c49867f651371dd993478ef81e098a1cd8c8d9890c7d1c62ae0488f095b39d4f96278664b340e8

          • memory/2200-61-0x0000000021650000-0x00000000216E2000-memory.dmp

            Filesize

            584KB

          • memory/2200-54-0x0000000000A00000-0x0000000000A44000-memory.dmp

            Filesize

            272KB

          • memory/2200-59-0x00000000215B0000-0x000000002164C000-memory.dmp

            Filesize

            624KB

          • memory/2200-58-0x00000000214C0000-0x0000000021510000-memory.dmp

            Filesize

            320KB

          • memory/2200-57-0x0000000020810000-0x0000000020820000-memory.dmp

            Filesize

            64KB

          • memory/2200-64-0x0000000073480000-0x0000000073C30000-memory.dmp

            Filesize

            7.7MB

          • memory/2200-56-0x0000000073480000-0x0000000073C30000-memory.dmp

            Filesize

            7.7MB

          • memory/2200-62-0x0000000021800000-0x000000002180A000-memory.dmp

            Filesize

            40KB

          • memory/2200-51-0x0000000000A00000-0x0000000001C54000-memory.dmp

            Filesize

            18.3MB

          • memory/2200-50-0x0000000001C60000-0x0000000002D1B000-memory.dmp

            Filesize

            16.7MB

          • memory/2200-46-0x0000000076ED1000-0x0000000076FF1000-memory.dmp

            Filesize

            1.1MB

          • memory/2200-45-0x0000000076F58000-0x0000000076F59000-memory.dmp

            Filesize

            4KB

          • memory/2200-44-0x0000000001C60000-0x0000000002D1B000-memory.dmp

            Filesize

            16.7MB

          • memory/2200-65-0x0000000020810000-0x0000000020820000-memory.dmp

            Filesize

            64KB

          • memory/3560-23-0x00000000065B0000-0x00000000065FC000-memory.dmp

            Filesize

            304KB

          • memory/3560-25-0x00000000074E0000-0x0000000007576000-memory.dmp

            Filesize

            600KB

          • memory/3560-32-0x0000000002B70000-0x0000000002B80000-memory.dmp

            Filesize

            64KB

          • memory/3560-28-0x0000000007B30000-0x00000000080D4000-memory.dmp

            Filesize

            5.6MB

          • memory/3560-34-0x0000000007A20000-0x0000000007A24000-memory.dmp

            Filesize

            16KB

          • memory/3560-35-0x0000000008DE0000-0x0000000009E9B000-memory.dmp

            Filesize

            16.7MB

          • memory/3560-36-0x0000000008DE0000-0x0000000009E9B000-memory.dmp

            Filesize

            16.7MB

          • memory/3560-38-0x0000000073480000-0x0000000073C30000-memory.dmp

            Filesize

            7.7MB

          • memory/3560-39-0x0000000002B70000-0x0000000002B80000-memory.dmp

            Filesize

            64KB

          • memory/3560-40-0x0000000002B70000-0x0000000002B80000-memory.dmp

            Filesize

            64KB

          • memory/3560-41-0x0000000002B70000-0x0000000002B80000-memory.dmp

            Filesize

            64KB

          • memory/3560-42-0x0000000076ED1000-0x0000000076FF1000-memory.dmp

            Filesize

            1.1MB

          • memory/3560-43-0x0000000008DE0000-0x0000000009E9B000-memory.dmp

            Filesize

            16.7MB

          • memory/3560-27-0x0000000006A80000-0x0000000006AA2000-memory.dmp

            Filesize

            136KB

          • memory/3560-26-0x0000000006A30000-0x0000000006A4A000-memory.dmp

            Filesize

            104KB

          • memory/3560-30-0x0000000008760000-0x0000000008DDA000-memory.dmp

            Filesize

            6.5MB

          • memory/3560-24-0x0000000002B70000-0x0000000002B80000-memory.dmp

            Filesize

            64KB

          • memory/3560-4-0x0000000004F30000-0x0000000004F66000-memory.dmp

            Filesize

            216KB

          • memory/3560-53-0x0000000073480000-0x0000000073C30000-memory.dmp

            Filesize

            7.7MB

          • memory/3560-22-0x0000000006520000-0x000000000653E000-memory.dmp

            Filesize

            120KB

          • memory/3560-55-0x0000000008DE0000-0x0000000009E9B000-memory.dmp

            Filesize

            16.7MB

          • memory/3560-17-0x0000000005F20000-0x0000000006274000-memory.dmp

            Filesize

            3.3MB

          • memory/3560-11-0x0000000005EB0000-0x0000000005F16000-memory.dmp

            Filesize

            408KB

          • memory/3560-10-0x0000000005D40000-0x0000000005DA6000-memory.dmp

            Filesize

            408KB

          • memory/3560-9-0x0000000005540000-0x0000000005562000-memory.dmp

            Filesize

            136KB

          • memory/3560-8-0x00000000055A0000-0x0000000005BC8000-memory.dmp

            Filesize

            6.2MB

          • memory/3560-7-0x0000000002B70000-0x0000000002B80000-memory.dmp

            Filesize

            64KB

          • memory/3560-6-0x0000000002B70000-0x0000000002B80000-memory.dmp

            Filesize

            64KB

          • memory/3560-5-0x0000000073480000-0x0000000073C30000-memory.dmp

            Filesize

            7.7MB