Analysis
-
max time kernel
118s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
18/05/2024, 18:33
Static task
static1
Behavioral task
behavioral1
Sample
DHL Delivery Invoice.exe
Resource
win7-20240221-en
General
-
Target
DHL Delivery Invoice.exe
-
Size
723KB
-
MD5
e9803ebe72e992dd17a5ecb2a65fb629
-
SHA1
24bd5f0b091a426434b5559fda8dddc31500f4c0
-
SHA256
2009ac39a5ed9bb927bb38b35db885425a7c40b95318efa020d4660c4c37ba26
-
SHA512
1bee01e5dd4795954cd40242e3d1ae8e71f17445a0e3a17445e45405459929c3881eef4ebea1ef850d7e9151cd18f8e329b305ecd3ef49191266f21473a868f6
-
SSDEEP
12288:4heN0pei36R88manNPrRrlrifK+yZfSGDgSgAIwBPF9P+QLiRZV6vzw6:4hvpp369JrR+MfSGsSgADF9P+miTV6vt
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.yandex.com - Port:
587 - Username:
[email protected] - Password:
ifeanyi@12 - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2680 powershell.exe 2672 powershell.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 api.ipify.org 5 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1308 set thread context of 2588 1308 DHL Delivery Invoice.exe 34 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2556 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1308 DHL Delivery Invoice.exe 1308 DHL Delivery Invoice.exe 2588 DHL Delivery Invoice.exe 2588 DHL Delivery Invoice.exe 2672 powershell.exe 2680 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 1308 DHL Delivery Invoice.exe Token: SeDebugPrivilege 2588 DHL Delivery Invoice.exe Token: SeDebugPrivilege 2672 powershell.exe Token: SeDebugPrivilege 2680 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2588 DHL Delivery Invoice.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 1308 wrote to memory of 2680 1308 DHL Delivery Invoice.exe 28 PID 1308 wrote to memory of 2680 1308 DHL Delivery Invoice.exe 28 PID 1308 wrote to memory of 2680 1308 DHL Delivery Invoice.exe 28 PID 1308 wrote to memory of 2680 1308 DHL Delivery Invoice.exe 28 PID 1308 wrote to memory of 2672 1308 DHL Delivery Invoice.exe 30 PID 1308 wrote to memory of 2672 1308 DHL Delivery Invoice.exe 30 PID 1308 wrote to memory of 2672 1308 DHL Delivery Invoice.exe 30 PID 1308 wrote to memory of 2672 1308 DHL Delivery Invoice.exe 30 PID 1308 wrote to memory of 2556 1308 DHL Delivery Invoice.exe 32 PID 1308 wrote to memory of 2556 1308 DHL Delivery Invoice.exe 32 PID 1308 wrote to memory of 2556 1308 DHL Delivery Invoice.exe 32 PID 1308 wrote to memory of 2556 1308 DHL Delivery Invoice.exe 32 PID 1308 wrote to memory of 2588 1308 DHL Delivery Invoice.exe 34 PID 1308 wrote to memory of 2588 1308 DHL Delivery Invoice.exe 34 PID 1308 wrote to memory of 2588 1308 DHL Delivery Invoice.exe 34 PID 1308 wrote to memory of 2588 1308 DHL Delivery Invoice.exe 34 PID 1308 wrote to memory of 2588 1308 DHL Delivery Invoice.exe 34 PID 1308 wrote to memory of 2588 1308 DHL Delivery Invoice.exe 34 PID 1308 wrote to memory of 2588 1308 DHL Delivery Invoice.exe 34 PID 1308 wrote to memory of 2588 1308 DHL Delivery Invoice.exe 34 PID 1308 wrote to memory of 2588 1308 DHL Delivery Invoice.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\DHL Delivery Invoice.exe"C:\Users\Admin\AppData\Local\Temp\DHL Delivery Invoice.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1308 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\DHL Delivery Invoice.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2680
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\QKCqSkoLhelqBu.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2672
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\QKCqSkoLhelqBu" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC091.tmp"2⤵
- Creates scheduled task(s)
PID:2556
-
-
C:\Users\Admin\AppData\Local\Temp\DHL Delivery Invoice.exe"C:\Users\Admin\AppData\Local\Temp\DHL Delivery Invoice.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2588
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD51d70ccf857a8019e70cacbce9d527e81
SHA11e4e72c620df0fff365d28787a8f81a46b5e1a95
SHA25667696373ae16e5dbf760dad52d02adb28e3f88f6184393176a9e98ff00f070a6
SHA51226bf26179779feee56afeacf55f274230bee5e87b4759a40e1ce4c131d8c1f5566acdb996eb8b8e48f4ac8c661b86998e266327494624ac25487def6e83c2570
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize7KB
MD5e021d55aff674701f32491876bd6bd8f
SHA12304bb0c2f89bc068b6e56ec8c605076b791f3c8
SHA256313cf62087379edc09fe581e700276c48dc1b5253066df515b118e9bce5ab6d9
SHA512d840aeb3c84e710dd0d03f8ab82b15be8b582c2109c07b51d15853519e921ccbee7b9b716ff5676d5103905e80417750bfaa3337e9237502da420daa40c7d279