Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows11-21h2_x64 -
resource
win11-20240319-en -
resource tags
arch:x64arch:x86image:win11-20240319-enlocale:en-usos:windows11-21h2-x64system -
submitted
28-03-2024 09:06
Static task
static1
Behavioral task
behavioral1
Sample
Shipping document.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral2
Sample
Shipping document.exe
Resource
win11-20240319-en
General
-
Target
Shipping document.exe
-
Size
811KB
-
MD5
3e250c8f6da5865c870cf22248ba3ec1
-
SHA1
368a5d934287bfd7a17bcff191a5cc613dc4d2a6
-
SHA256
88f00d7856da4bc4cdeb97ac096da86e28a9340e494e669a634bce5e79f2b240
-
SHA512
44a78a4d623212cbd8e8e4dae311f62c9191caf07c8cfba2003e75f2344737afa24a98e0b7e29b2c0e1b57a8154a9391f6177e4113b5c8a8e714aee7c702f003
-
SSDEEP
12288:JHH3IApRsBvcuDAxYOw65SLgpltAzg1VxSr5gLsPEOdIMSI89qvEpOvV:JnDpRsxR6FliMx854qXNSI85
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.satsllc.ae - Port:
587 - Username:
ahsan@satsllc.ae - Password:
Ahsan@12345 - Email To:
benj50454@gmail.com
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 1 api.ipify.org 2 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Shipping document.exedescription pid process target process PID 2744 set thread context of 4240 2744 Shipping document.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
RegSvcs.exepowershell.exepid process 4240 RegSvcs.exe 4240 RegSvcs.exe 572 powershell.exe 572 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
powershell.exeRegSvcs.exedescription pid process Token: SeDebugPrivilege 572 powershell.exe Token: SeDebugPrivilege 4240 RegSvcs.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
Shipping document.exedescription pid process target process PID 2744 wrote to memory of 572 2744 Shipping document.exe powershell.exe PID 2744 wrote to memory of 572 2744 Shipping document.exe powershell.exe PID 2744 wrote to memory of 572 2744 Shipping document.exe powershell.exe PID 2744 wrote to memory of 1508 2744 Shipping document.exe schtasks.exe PID 2744 wrote to memory of 1508 2744 Shipping document.exe schtasks.exe PID 2744 wrote to memory of 1508 2744 Shipping document.exe schtasks.exe PID 2744 wrote to memory of 4240 2744 Shipping document.exe RegSvcs.exe PID 2744 wrote to memory of 4240 2744 Shipping document.exe RegSvcs.exe PID 2744 wrote to memory of 4240 2744 Shipping document.exe RegSvcs.exe PID 2744 wrote to memory of 4240 2744 Shipping document.exe RegSvcs.exe PID 2744 wrote to memory of 4240 2744 Shipping document.exe RegSvcs.exe PID 2744 wrote to memory of 4240 2744 Shipping document.exe RegSvcs.exe PID 2744 wrote to memory of 4240 2744 Shipping document.exe RegSvcs.exe PID 2744 wrote to memory of 4240 2744 Shipping document.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Shipping document.exe"C:\Users\Admin\AppData\Local\Temp\Shipping document.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ArvdCTzowFbTNQ.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ArvdCTzowFbTNQ" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB074.tmp"2⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rzbixaac.upz.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\tmpB074.tmpFilesize
1KB
MD5ddb2dc931a54f18ddfa771f450756b98
SHA12aa231110f782ed57597fa6c8022bd0f05000288
SHA2561ad9d3a526a238a1841a92812355f9e78fbe15f3b1751a37e2f0e4f93f108eb7
SHA512ad13a59fc97629348b781de93cb13df5adea3ca25fbd70b94afc72d23b39f33ddd425ad6d83149a035726980af4b3e46a63bda24923e5c49073dacddff860fb2
-
memory/572-27-0x0000000004F10000-0x0000000004F76000-memory.dmpFilesize
408KB
-
memory/572-53-0x0000000006FF0000-0x000000000700A000-memory.dmpFilesize
104KB
-
memory/572-64-0x0000000074300000-0x0000000074AB1000-memory.dmpFilesize
7.7MB
-
memory/572-61-0x0000000007370000-0x0000000007378000-memory.dmpFilesize
32KB
-
memory/572-60-0x0000000007340000-0x000000000735A000-memory.dmpFilesize
104KB
-
memory/572-59-0x0000000007240000-0x0000000007255000-memory.dmpFilesize
84KB
-
memory/572-58-0x0000000007230000-0x000000000723E000-memory.dmpFilesize
56KB
-
memory/572-57-0x0000000007200000-0x0000000007211000-memory.dmpFilesize
68KB
-
memory/572-14-0x00000000024B0000-0x00000000024E6000-memory.dmpFilesize
216KB
-
memory/572-15-0x0000000074300000-0x0000000074AB1000-memory.dmpFilesize
7.7MB
-
memory/572-16-0x0000000002490000-0x00000000024A0000-memory.dmpFilesize
64KB
-
memory/572-18-0x0000000002490000-0x00000000024A0000-memory.dmpFilesize
64KB
-
memory/572-55-0x0000000007280000-0x0000000007316000-memory.dmpFilesize
600KB
-
memory/572-19-0x0000000005000000-0x000000000562A000-memory.dmpFilesize
6.2MB
-
memory/572-54-0x0000000007070000-0x000000000707A000-memory.dmpFilesize
40KB
-
memory/572-36-0x00000000058B0000-0x0000000005C07000-memory.dmpFilesize
3.3MB
-
memory/572-52-0x0000000007630000-0x0000000007CAA000-memory.dmpFilesize
6.5MB
-
memory/572-51-0x0000000006EB0000-0x0000000006F54000-memory.dmpFilesize
656KB
-
memory/572-50-0x0000000006290000-0x00000000062AE000-memory.dmpFilesize
120KB
-
memory/572-26-0x0000000004DF0000-0x0000000004E12000-memory.dmpFilesize
136KB
-
memory/572-41-0x0000000070340000-0x000000007038C000-memory.dmpFilesize
304KB
-
memory/572-40-0x0000000006E70000-0x0000000006EA4000-memory.dmpFilesize
208KB
-
memory/572-39-0x0000000002490000-0x00000000024A0000-memory.dmpFilesize
64KB
-
memory/572-37-0x0000000005CB0000-0x0000000005CCE000-memory.dmpFilesize
120KB
-
memory/572-38-0x0000000005CE0000-0x0000000005D2C000-memory.dmpFilesize
304KB
-
memory/2744-8-0x0000000008AA0000-0x0000000008B22000-memory.dmpFilesize
520KB
-
memory/2744-2-0x00000000061D0000-0x0000000006776000-memory.dmpFilesize
5.6MB
-
memory/2744-0-0x0000000074300000-0x0000000074AB1000-memory.dmpFilesize
7.7MB
-
memory/2744-4-0x0000000005BA0000-0x0000000005BB0000-memory.dmpFilesize
64KB
-
memory/2744-22-0x0000000074300000-0x0000000074AB1000-memory.dmpFilesize
7.7MB
-
memory/2744-1-0x0000000000FF0000-0x00000000010C0000-memory.dmpFilesize
832KB
-
memory/2744-3-0x0000000005C20000-0x0000000005CB2000-memory.dmpFilesize
584KB
-
memory/2744-5-0x0000000005B50000-0x0000000005B5A000-memory.dmpFilesize
40KB
-
memory/2744-6-0x0000000006150000-0x000000000616A000-memory.dmpFilesize
104KB
-
memory/2744-9-0x0000000009E90000-0x0000000009F2C000-memory.dmpFilesize
624KB
-
memory/2744-7-0x0000000005E30000-0x0000000005E3C000-memory.dmpFilesize
48KB
-
memory/4240-24-0x00000000058F0000-0x0000000005900000-memory.dmpFilesize
64KB
-
memory/4240-56-0x0000000006E10000-0x0000000006E60000-memory.dmpFilesize
320KB
-
memory/4240-66-0x00000000058F0000-0x0000000005900000-memory.dmpFilesize
64KB
-
memory/4240-23-0x0000000074300000-0x0000000074AB1000-memory.dmpFilesize
7.7MB
-
memory/4240-25-0x0000000005A00000-0x0000000005A66000-memory.dmpFilesize
408KB
-
memory/4240-65-0x0000000074300000-0x0000000074AB1000-memory.dmpFilesize
7.7MB
-
memory/4240-20-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB