Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
28-03-2024 09:06
Static task
static1
Behavioral task
behavioral1
Sample
Shipping document.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral2
Sample
Shipping document.exe
Resource
win11-20240319-en
General
-
Target
Shipping document.exe
-
Size
811KB
-
MD5
3e250c8f6da5865c870cf22248ba3ec1
-
SHA1
368a5d934287bfd7a17bcff191a5cc613dc4d2a6
-
SHA256
88f00d7856da4bc4cdeb97ac096da86e28a9340e494e669a634bce5e79f2b240
-
SHA512
44a78a4d623212cbd8e8e4dae311f62c9191caf07c8cfba2003e75f2344737afa24a98e0b7e29b2c0e1b57a8154a9391f6177e4113b5c8a8e714aee7c702f003
-
SSDEEP
12288:JHH3IApRsBvcuDAxYOw65SLgpltAzg1VxSr5gLsPEOdIMSI89qvEpOvV:JnDpRsxR6FliMx854qXNSI85
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.satsllc.ae - Port:
587 - Username:
ahsan@satsllc.ae - Password:
Ahsan@12345 - Email To:
benj50454@gmail.com
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Shipping document.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation Shipping document.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 32 api.ipify.org 33 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Shipping document.exedescription pid process target process PID 2008 set thread context of 3616 2008 Shipping document.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
Shipping document.exeRegSvcs.exepowershell.exepid process 2008 Shipping document.exe 2008 Shipping document.exe 3616 RegSvcs.exe 3616 RegSvcs.exe 3112 powershell.exe 3112 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
Shipping document.exeRegSvcs.exepowershell.exedescription pid process Token: SeDebugPrivilege 2008 Shipping document.exe Token: SeDebugPrivilege 3616 RegSvcs.exe Token: SeDebugPrivilege 3112 powershell.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
Shipping document.exedescription pid process target process PID 2008 wrote to memory of 3112 2008 Shipping document.exe powershell.exe PID 2008 wrote to memory of 3112 2008 Shipping document.exe powershell.exe PID 2008 wrote to memory of 3112 2008 Shipping document.exe powershell.exe PID 2008 wrote to memory of 4476 2008 Shipping document.exe schtasks.exe PID 2008 wrote to memory of 4476 2008 Shipping document.exe schtasks.exe PID 2008 wrote to memory of 4476 2008 Shipping document.exe schtasks.exe PID 2008 wrote to memory of 2396 2008 Shipping document.exe RegSvcs.exe PID 2008 wrote to memory of 2396 2008 Shipping document.exe RegSvcs.exe PID 2008 wrote to memory of 2396 2008 Shipping document.exe RegSvcs.exe PID 2008 wrote to memory of 3616 2008 Shipping document.exe RegSvcs.exe PID 2008 wrote to memory of 3616 2008 Shipping document.exe RegSvcs.exe PID 2008 wrote to memory of 3616 2008 Shipping document.exe RegSvcs.exe PID 2008 wrote to memory of 3616 2008 Shipping document.exe RegSvcs.exe PID 2008 wrote to memory of 3616 2008 Shipping document.exe RegSvcs.exe PID 2008 wrote to memory of 3616 2008 Shipping document.exe RegSvcs.exe PID 2008 wrote to memory of 3616 2008 Shipping document.exe RegSvcs.exe PID 2008 wrote to memory of 3616 2008 Shipping document.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Shipping document.exe"C:\Users\Admin\AppData\Local\Temp\Shipping document.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ArvdCTzowFbTNQ.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ArvdCTzowFbTNQ" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA5D5.tmp"2⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4wuc2c0k.b22.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\tmpA5D5.tmpFilesize
1KB
MD54bf362b7e23467ae3bd63b7aabd30c48
SHA1b3df7f0af72aadd9681e6993098db89bb8e8bc88
SHA2560c3be4748a14a3313292d00c44d62ac332ae57cd2268e5a08fe75c0e656eec59
SHA5129eded3dbf02c7b99798bb2dedb71fcc1da66390a3c2fe8c2b6b69ef0174ed1b82945796177841bd0951d9c023c7c41b8618564f48fc048fe54bc18c339f99174
-
memory/2008-6-0x00000000056D0000-0x00000000056EA000-memory.dmpFilesize
104KB
-
memory/2008-3-0x0000000005150000-0x00000000051E2000-memory.dmpFilesize
584KB
-
memory/2008-4-0x00000000053C0000-0x00000000053D0000-memory.dmpFilesize
64KB
-
memory/2008-5-0x00000000050F0000-0x00000000050FA000-memory.dmpFilesize
40KB
-
memory/2008-2-0x0000000005700000-0x0000000005CA4000-memory.dmpFilesize
5.6MB
-
memory/2008-7-0x00000000056F0000-0x00000000056FC000-memory.dmpFilesize
48KB
-
memory/2008-8-0x0000000007C40000-0x0000000007CC2000-memory.dmpFilesize
520KB
-
memory/2008-9-0x000000000A4A0000-0x000000000A53C000-memory.dmpFilesize
624KB
-
memory/2008-0-0x0000000075100000-0x00000000758B0000-memory.dmpFilesize
7.7MB
-
memory/2008-1-0x0000000000680000-0x0000000000750000-memory.dmpFilesize
832KB
-
memory/2008-22-0x0000000075100000-0x00000000758B0000-memory.dmpFilesize
7.7MB
-
memory/3112-35-0x0000000006210000-0x0000000006276000-memory.dmpFilesize
408KB
-
memory/3112-41-0x0000000070D80000-0x0000000070DCC000-memory.dmpFilesize
304KB
-
memory/3112-19-0x00000000059B0000-0x0000000005FD8000-memory.dmpFilesize
6.2MB
-
memory/3112-16-0x0000000005370000-0x0000000005380000-memory.dmpFilesize
64KB
-
memory/3112-65-0x0000000075100000-0x00000000758B0000-memory.dmpFilesize
7.7MB
-
memory/3112-62-0x0000000007E40000-0x0000000007E48000-memory.dmpFilesize
32KB
-
memory/3112-61-0x0000000007E60000-0x0000000007E7A000-memory.dmpFilesize
104KB
-
memory/3112-15-0x0000000075100000-0x00000000758B0000-memory.dmpFilesize
7.7MB
-
memory/3112-30-0x0000000005910000-0x0000000005932000-memory.dmpFilesize
136KB
-
memory/3112-14-0x0000000002EE0000-0x0000000002F16000-memory.dmpFilesize
216KB
-
memory/3112-36-0x00000000063F0000-0x0000000006744000-memory.dmpFilesize
3.3MB
-
memory/3112-37-0x00000000067D0000-0x00000000067EE000-memory.dmpFilesize
120KB
-
memory/3112-38-0x0000000006870000-0x00000000068BC000-memory.dmpFilesize
304KB
-
memory/3112-39-0x0000000005370000-0x0000000005380000-memory.dmpFilesize
64KB
-
memory/3112-40-0x00000000077A0000-0x00000000077D2000-memory.dmpFilesize
200KB
-
memory/3112-60-0x0000000007D60000-0x0000000007D74000-memory.dmpFilesize
80KB
-
memory/3112-51-0x0000000006DB0000-0x0000000006DCE000-memory.dmpFilesize
120KB
-
memory/3112-52-0x00000000077E0000-0x0000000007883000-memory.dmpFilesize
652KB
-
memory/3112-53-0x0000000008140000-0x00000000087BA000-memory.dmpFilesize
6.5MB
-
memory/3112-54-0x0000000007B00000-0x0000000007B1A000-memory.dmpFilesize
104KB
-
memory/3112-55-0x0000000007B70000-0x0000000007B7A000-memory.dmpFilesize
40KB
-
memory/3112-56-0x0000000007D80000-0x0000000007E16000-memory.dmpFilesize
600KB
-
memory/3112-57-0x0000000007D00000-0x0000000007D11000-memory.dmpFilesize
68KB
-
memory/3112-59-0x0000000007D50000-0x0000000007D5E000-memory.dmpFilesize
56KB
-
memory/3616-58-0x0000000006D60000-0x0000000006DB0000-memory.dmpFilesize
320KB
-
memory/3616-18-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/3616-24-0x00000000057D0000-0x0000000005836000-memory.dmpFilesize
408KB
-
memory/3616-23-0x0000000005870000-0x0000000005880000-memory.dmpFilesize
64KB
-
memory/3616-21-0x0000000075100000-0x00000000758B0000-memory.dmpFilesize
7.7MB
-
memory/3616-66-0x0000000075100000-0x00000000758B0000-memory.dmpFilesize
7.7MB
-
memory/3616-67-0x0000000005870000-0x0000000005880000-memory.dmpFilesize
64KB