Analysis
-
max time kernel
140s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
24-04-2024 04:48
Static task
static1
Behavioral task
behavioral1
Sample
Dhl Express Shipping Docs .pdf.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Dhl Express Shipping Docs .pdf.exe
Resource
win10v2004-20240412-en
General
-
Target
Dhl Express Shipping Docs .pdf.exe
-
Size
835KB
-
MD5
e7d52516ca8bcf4e8bcaf71a36a88300
-
SHA1
d5a7eaad95ab6d4e492b128db0cf550c34170c90
-
SHA256
8df5ecbc8ea978c98c9c3a0918fe9ee233f169ee9e3d38855b7da8fc96aad8dc
-
SHA512
0dc86396301012e035ed03086436411b5abdbe7c2dc84b03d5385739250bf1efa1bc6fab96471eb277b62d7a3b1ea663565809493a26750951c6316b131c0751
-
SSDEEP
12288:+iEx72xrdlMXGnWnpLCzRdoJ6K5/w6ovt51qZ0o1LFMdDP+FIk7N:sSrdrWn4z26UNol510LFMdDP8Ik
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
us2.smtp.mailhostbox.com - Port:
587 - Username:
[email protected] - Password:
u(!IUDW7 - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Dhl Express Shipping Docs .pdf.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation Dhl Express Shipping Docs .pdf.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 43 ip-api.com -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Dhl Express Shipping Docs .pdf.exedescription pid process target process PID 4532 set thread context of 800 4532 Dhl Express Shipping Docs .pdf.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
Dhl Express Shipping Docs .pdf.exepowershell.exepowershell.exeRegSvcs.exepid process 4532 Dhl Express Shipping Docs .pdf.exe 2316 powershell.exe 2316 powershell.exe 1528 powershell.exe 1528 powershell.exe 4532 Dhl Express Shipping Docs .pdf.exe 4532 Dhl Express Shipping Docs .pdf.exe 800 RegSvcs.exe 800 RegSvcs.exe 800 RegSvcs.exe 2316 powershell.exe 1528 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
Dhl Express Shipping Docs .pdf.exepowershell.exepowershell.exeRegSvcs.exedescription pid process Token: SeDebugPrivilege 4532 Dhl Express Shipping Docs .pdf.exe Token: SeDebugPrivilege 2316 powershell.exe Token: SeDebugPrivilege 1528 powershell.exe Token: SeDebugPrivilege 800 RegSvcs.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
Dhl Express Shipping Docs .pdf.exedescription pid process target process PID 4532 wrote to memory of 2316 4532 Dhl Express Shipping Docs .pdf.exe powershell.exe PID 4532 wrote to memory of 2316 4532 Dhl Express Shipping Docs .pdf.exe powershell.exe PID 4532 wrote to memory of 2316 4532 Dhl Express Shipping Docs .pdf.exe powershell.exe PID 4532 wrote to memory of 1528 4532 Dhl Express Shipping Docs .pdf.exe powershell.exe PID 4532 wrote to memory of 1528 4532 Dhl Express Shipping Docs .pdf.exe powershell.exe PID 4532 wrote to memory of 1528 4532 Dhl Express Shipping Docs .pdf.exe powershell.exe PID 4532 wrote to memory of 448 4532 Dhl Express Shipping Docs .pdf.exe schtasks.exe PID 4532 wrote to memory of 448 4532 Dhl Express Shipping Docs .pdf.exe schtasks.exe PID 4532 wrote to memory of 448 4532 Dhl Express Shipping Docs .pdf.exe schtasks.exe PID 4532 wrote to memory of 800 4532 Dhl Express Shipping Docs .pdf.exe RegSvcs.exe PID 4532 wrote to memory of 800 4532 Dhl Express Shipping Docs .pdf.exe RegSvcs.exe PID 4532 wrote to memory of 800 4532 Dhl Express Shipping Docs .pdf.exe RegSvcs.exe PID 4532 wrote to memory of 800 4532 Dhl Express Shipping Docs .pdf.exe RegSvcs.exe PID 4532 wrote to memory of 800 4532 Dhl Express Shipping Docs .pdf.exe RegSvcs.exe PID 4532 wrote to memory of 800 4532 Dhl Express Shipping Docs .pdf.exe RegSvcs.exe PID 4532 wrote to memory of 800 4532 Dhl Express Shipping Docs .pdf.exe RegSvcs.exe PID 4532 wrote to memory of 800 4532 Dhl Express Shipping Docs .pdf.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Dhl Express Shipping Docs .pdf.exe"C:\Users\Admin\AppData\Local\Temp\Dhl Express Shipping Docs .pdf.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Dhl Express Shipping Docs .pdf.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2316 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\emaGqYHYeYNHas.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1528 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\emaGqYHYeYNHas" /XML "C:\Users\Admin\AppData\Local\Temp\tmp59B9.tmp"2⤵
- Creates scheduled task(s)
PID:448 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:800
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD53d086a433708053f9bf9523e1d87a4e8
SHA1b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA2566f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
SHA512931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD504e4885d678c2584c40c9a83b06ea778
SHA1218d73cfa5707f4641db9f2935628da4e153edea
SHA2569b98e4fc4b076b771d29857c324a6d7223d30f3e14566228b95eeefd669cb2e8
SHA512a78956051a4a06ce5a2731658e9185c9372a178640e9f14e028b6a31b7a5ccbf2aa7be77c29a637db1237a8131105091f041dd7a22a8e5babdc80f96b21454ed
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2eiguic3.gxp.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\tmp59B9.tmpFilesize
1KB
MD5234f02806acf37985cbd0cd79d406c7f
SHA10b80b53f3524f9eea690ee629de391b9f29155bd
SHA2561d45b03e2aad4a35e6b5f0e8681aa87435f64a83ff7453680836c84d5dc49265
SHA512e5d936d68168139c0fc4c68e6c34e5e3c4cb92f87868da8c0687b1a7df948b736ada66e96acb7887b16fac7a485289bd75039900fffca9453333a3afa8cc3df5
-
memory/800-51-0x0000000005760000-0x0000000005770000-memory.dmpFilesize
64KB
-
memory/800-100-0x0000000074CC0000-0x0000000075470000-memory.dmpFilesize
7.7MB
-
memory/800-99-0x00000000069E0000-0x0000000006A30000-memory.dmpFilesize
320KB
-
memory/800-38-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/800-101-0x0000000005760000-0x0000000005770000-memory.dmpFilesize
64KB
-
memory/800-41-0x0000000074CC0000-0x0000000075470000-memory.dmpFilesize
7.7MB
-
memory/1528-57-0x0000000071390000-0x00000000713DC000-memory.dmpFilesize
304KB
-
memory/1528-56-0x0000000007530000-0x0000000007562000-memory.dmpFilesize
200KB
-
memory/1528-80-0x0000000002C40000-0x0000000002C50000-memory.dmpFilesize
64KB
-
memory/1528-81-0x0000000002C40000-0x0000000002C50000-memory.dmpFilesize
64KB
-
memory/1528-67-0x0000000007570000-0x000000000758E000-memory.dmpFilesize
120KB
-
memory/1528-97-0x0000000074CC0000-0x0000000075470000-memory.dmpFilesize
7.7MB
-
memory/1528-55-0x000000007FAC0000-0x000000007FAD0000-memory.dmpFilesize
64KB
-
memory/1528-83-0x0000000007F20000-0x000000000859A000-memory.dmpFilesize
6.5MB
-
memory/1528-27-0x0000000002C40000-0x0000000002C50000-memory.dmpFilesize
64KB
-
memory/1528-85-0x0000000007950000-0x000000000795A000-memory.dmpFilesize
40KB
-
memory/1528-25-0x0000000074CC0000-0x0000000075470000-memory.dmpFilesize
7.7MB
-
memory/1528-87-0x0000000007AD0000-0x0000000007AE1000-memory.dmpFilesize
68KB
-
memory/1528-33-0x0000000002C40000-0x0000000002C50000-memory.dmpFilesize
64KB
-
memory/1528-88-0x0000000007B00000-0x0000000007B0E000-memory.dmpFilesize
56KB
-
memory/1528-91-0x0000000007BF0000-0x0000000007BF8000-memory.dmpFilesize
32KB
-
memory/2316-39-0x00000000058F0000-0x0000000005C44000-memory.dmpFilesize
3.3MB
-
memory/2316-82-0x00000000049D0000-0x00000000049E0000-memory.dmpFilesize
64KB
-
memory/2316-98-0x0000000074CC0000-0x0000000075470000-memory.dmpFilesize
7.7MB
-
memory/2316-26-0x0000000005780000-0x00000000057E6000-memory.dmpFilesize
408KB
-
memory/2316-90-0x0000000007450000-0x000000000746A000-memory.dmpFilesize
104KB
-
memory/2316-89-0x0000000007350000-0x0000000007364000-memory.dmpFilesize
80KB
-
memory/2316-53-0x0000000005DE0000-0x0000000005DFE000-memory.dmpFilesize
120KB
-
memory/2316-54-0x0000000005E90000-0x0000000005EDC000-memory.dmpFilesize
304KB
-
memory/2316-21-0x0000000005670000-0x0000000005692000-memory.dmpFilesize
136KB
-
memory/2316-19-0x00000000049D0000-0x00000000049E0000-memory.dmpFilesize
64KB
-
memory/2316-20-0x0000000005010000-0x0000000005638000-memory.dmpFilesize
6.2MB
-
memory/2316-68-0x0000000071390000-0x00000000713DC000-memory.dmpFilesize
304KB
-
memory/2316-18-0x00000000049D0000-0x00000000049E0000-memory.dmpFilesize
64KB
-
memory/2316-79-0x0000000006FB0000-0x0000000007053000-memory.dmpFilesize
652KB
-
memory/2316-69-0x000000007F790000-0x000000007F7A0000-memory.dmpFilesize
64KB
-
memory/2316-16-0x00000000024D0000-0x0000000002506000-memory.dmpFilesize
216KB
-
memory/2316-17-0x0000000074CC0000-0x0000000075470000-memory.dmpFilesize
7.7MB
-
memory/2316-24-0x0000000005710000-0x0000000005776000-memory.dmpFilesize
408KB
-
memory/2316-84-0x0000000007110000-0x000000000712A000-memory.dmpFilesize
104KB
-
memory/2316-86-0x0000000007390000-0x0000000007426000-memory.dmpFilesize
600KB
-
memory/4532-7-0x00000000054E0000-0x00000000054EE000-memory.dmpFilesize
56KB
-
memory/4532-10-0x0000000004B60000-0x0000000004BE4000-memory.dmpFilesize
528KB
-
memory/4532-9-0x0000000008B30000-0x0000000008BBC000-memory.dmpFilesize
560KB
-
memory/4532-8-0x0000000005500000-0x0000000005514000-memory.dmpFilesize
80KB
-
memory/4532-52-0x0000000074CC0000-0x0000000075470000-memory.dmpFilesize
7.7MB
-
memory/4532-23-0x0000000074CC0000-0x0000000075470000-memory.dmpFilesize
7.7MB
-
memory/4532-11-0x000000000BCE0000-0x000000000BD7C000-memory.dmpFilesize
624KB
-
memory/4532-6-0x0000000005490000-0x00000000054A8000-memory.dmpFilesize
96KB
-
memory/4532-4-0x0000000005350000-0x0000000005360000-memory.dmpFilesize
64KB
-
memory/4532-1-0x0000000074CC0000-0x0000000075470000-memory.dmpFilesize
7.7MB
-
memory/4532-5-0x0000000005130000-0x000000000513A000-memory.dmpFilesize
40KB
-
memory/4532-3-0x00000000051A0000-0x0000000005232000-memory.dmpFilesize
584KB
-
memory/4532-2-0x0000000005750000-0x0000000005CF4000-memory.dmpFilesize
5.6MB
-
memory/4532-0-0x0000000000660000-0x0000000000738000-memory.dmpFilesize
864KB