Analysis

  • max time kernel
    142s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/05/2024, 18:32

General

  • Target

    dhl_Ref_AWB#4547028900pdf.exe

  • Size

    695KB

  • MD5

    0db822fa626ab44ce58958e45d439a20

  • SHA1

    a674592f7f01a24fa85838d3d697fea11779e3a2

  • SHA256

    e3bfec7bab88ff2b0389ee7850b548413607b9074912eca507c09737d93d3a14

  • SHA512

    a61f02a8d5809ec453eb507857cf2975e3c7b78bb278cede64719084d4787fd2ae8acae9d35badf9dd617a19662df676fb87fe8450ab408a2a436f2eb9d4438d

  • SSDEEP

    12288:BdrLbDZaNRpbgoxpz+hKuhyoQ3UlC+adAhV92LhkAr2YUjsxL7glIhr3qA:bLDZMRpMCBezZ82N26Arh1xLXLqA

Malware Config

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    smtp.yandex.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    ifeanyi@12

Extracted

Family

agenttesla

Credentials

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 25 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 26 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\dhl_Ref_AWB#4547028900pdf.exe
    "C:\Users\Admin\AppData\Local\Temp\dhl_Ref_AWB#4547028900pdf.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4256
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\dhl_Ref_AWB#4547028900pdf.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4312
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\DmPRZWRRivRIb.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1560
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\DmPRZWRRivRIb" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8A88.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:60
    • C:\Users\Admin\AppData\Local\Temp\dhl_Ref_AWB#4547028900pdf.exe
      "C:\Users\Admin\AppData\Local\Temp\dhl_Ref_AWB#4547028900pdf.exe"
      2⤵
        PID:4476
      • C:\Users\Admin\AppData\Local\Temp\dhl_Ref_AWB#4547028900pdf.exe
        "C:\Users\Admin\AppData\Local\Temp\dhl_Ref_AWB#4547028900pdf.exe"
        2⤵
          PID:2164
        • C:\Users\Admin\AppData\Local\Temp\dhl_Ref_AWB#4547028900pdf.exe
          "C:\Users\Admin\AppData\Local\Temp\dhl_Ref_AWB#4547028900pdf.exe"
          2⤵
            PID:4940
          • C:\Users\Admin\AppData\Local\Temp\dhl_Ref_AWB#4547028900pdf.exe
            "C:\Users\Admin\AppData\Local\Temp\dhl_Ref_AWB#4547028900pdf.exe"
            2⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            PID:64
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3592 --field-trial-handle=2328,i,5873823382323802923,13134441441264702821,262144 --variations-seed-version /prefetch:8
          1⤵
            PID:2436

          Network

                MITRE ATT&CK Enterprise v15

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\dhl_Ref_AWB#4547028900pdf.exe.log

                  Filesize

                  1KB

                  MD5

                  8ec831f3e3a3f77e4a7b9cd32b48384c

                  SHA1

                  d83f09fd87c5bd86e045873c231c14836e76a05c

                  SHA256

                  7667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982

                  SHA512

                  26bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3

                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                  Filesize

                  2KB

                  MD5

                  968cb9309758126772781b83adb8a28f

                  SHA1

                  8da30e71accf186b2ba11da1797cf67f8f78b47c

                  SHA256

                  92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

                  SHA512

                  4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

                • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ubgkc354.m3l.ps1

                  Filesize

                  60B

                  MD5

                  d17fe0a3f47be24a6453e9ef58c94641

                  SHA1

                  6ab83620379fc69f80c0242105ddffd7d98d5d9d

                  SHA256

                  96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                  SHA512

                  5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                • C:\Users\Admin\AppData\Local\Temp\tmp8A88.tmp

                  Filesize

                  1KB

                  MD5

                  f28692bdba636e0bbe562f67313a5b64

                  SHA1

                  037211761cefd48a6f5c515817e5c1fd98eb0724

                  SHA256

                  ba9823ab4c5035d7f916cb122185adb5372fa50e9d97fcaa88ba807ddf5fb9bc

                  SHA512

                  278a71fccc2cc2b1708f3658ee7c5573aabe89015cf2b7e6523fb683195a5a00aa8b0a63a992bfef4160a5fe40fa6a0bd0be9444816d4f7fbf8eeadedc7e3e6f

                • memory/64-84-0x0000000006670000-0x00000000066C0000-memory.dmp

                  Filesize

                  320KB

                • memory/64-31-0x0000000005170000-0x00000000051D6000-memory.dmp

                  Filesize

                  408KB

                • memory/64-26-0x0000000000400000-0x0000000000442000-memory.dmp

                  Filesize

                  264KB

                • memory/1560-88-0x0000000074E00000-0x00000000755B0000-memory.dmp

                  Filesize

                  7.7MB

                • memory/1560-86-0x0000000007E60000-0x0000000007E6E000-memory.dmp

                  Filesize

                  56KB

                • memory/1560-80-0x0000000007B80000-0x0000000007B8A000-memory.dmp

                  Filesize

                  40KB

                • memory/1560-82-0x0000000007D70000-0x0000000007E06000-memory.dmp

                  Filesize

                  600KB

                • memory/1560-57-0x0000000070B00000-0x0000000070B4C000-memory.dmp

                  Filesize

                  304KB

                • memory/1560-83-0x0000000007D10000-0x0000000007D21000-memory.dmp

                  Filesize

                  68KB

                • memory/1560-98-0x0000000074E00000-0x00000000755B0000-memory.dmp

                  Filesize

                  7.7MB

                • memory/1560-29-0x0000000005830000-0x0000000005852000-memory.dmp

                  Filesize

                  136KB

                • memory/1560-52-0x0000000006800000-0x000000000681E000-memory.dmp

                  Filesize

                  120KB

                • memory/1560-92-0x0000000074E00000-0x00000000755B0000-memory.dmp

                  Filesize

                  7.7MB

                • memory/1560-90-0x0000000074E00000-0x00000000755B0000-memory.dmp

                  Filesize

                  7.7MB

                • memory/1560-22-0x0000000074E00000-0x00000000755B0000-memory.dmp

                  Filesize

                  7.7MB

                • memory/1560-23-0x0000000074E00000-0x00000000755B0000-memory.dmp

                  Filesize

                  7.7MB

                • memory/1560-24-0x0000000074E00000-0x00000000755B0000-memory.dmp

                  Filesize

                  7.7MB

                • memory/1560-87-0x0000000007E70000-0x0000000007E84000-memory.dmp

                  Filesize

                  80KB

                • memory/1560-77-0x0000000007A70000-0x0000000007B13000-memory.dmp

                  Filesize

                  652KB

                • memory/4256-7-0x0000000004DC0000-0x0000000004DE2000-memory.dmp

                  Filesize

                  136KB

                • memory/4256-4-0x0000000074E00000-0x00000000755B0000-memory.dmp

                  Filesize

                  7.7MB

                • memory/4256-30-0x0000000074E00000-0x00000000755B0000-memory.dmp

                  Filesize

                  7.7MB

                • memory/4256-3-0x0000000004CA0000-0x0000000004D32000-memory.dmp

                  Filesize

                  584KB

                • memory/4256-5-0x0000000004C70000-0x0000000004C7A000-memory.dmp

                  Filesize

                  40KB

                • memory/4256-2-0x00000000053A0000-0x0000000005944000-memory.dmp

                  Filesize

                  5.6MB

                • memory/4256-6-0x0000000004F60000-0x0000000004FFC000-memory.dmp

                  Filesize

                  624KB

                • memory/4256-8-0x0000000004F20000-0x0000000004F2C000-memory.dmp

                  Filesize

                  48KB

                • memory/4256-0-0x0000000074E0E000-0x0000000074E0F000-memory.dmp

                  Filesize

                  4KB

                • memory/4256-1-0x00000000001C0000-0x0000000000272000-memory.dmp

                  Filesize

                  712KB

                • memory/4256-12-0x0000000074E00000-0x00000000755B0000-memory.dmp

                  Filesize

                  7.7MB

                • memory/4256-11-0x0000000074E0E000-0x0000000074E0F000-memory.dmp

                  Filesize

                  4KB

                • memory/4256-10-0x00000000026F0000-0x0000000002772000-memory.dmp

                  Filesize

                  520KB

                • memory/4256-9-0x0000000004F30000-0x0000000004F40000-memory.dmp

                  Filesize

                  64KB

                • memory/4312-14-0x0000000004BB0000-0x0000000004BE6000-memory.dmp

                  Filesize

                  216KB

                • memory/4312-78-0x0000000007B30000-0x00000000081AA000-memory.dmp

                  Filesize

                  6.5MB

                • memory/4312-79-0x00000000074D0000-0x00000000074EA000-memory.dmp

                  Filesize

                  104KB

                • memory/4312-76-0x0000000006560000-0x000000000657E000-memory.dmp

                  Filesize

                  120KB

                • memory/4312-81-0x0000000074E00000-0x00000000755B0000-memory.dmp

                  Filesize

                  7.7MB

                • memory/4312-56-0x0000000070B00000-0x0000000070B4C000-memory.dmp

                  Filesize

                  304KB

                • memory/4312-55-0x0000000006760000-0x0000000006792000-memory.dmp

                  Filesize

                  200KB

                • memory/4312-54-0x0000000074E00000-0x00000000755B0000-memory.dmp

                  Filesize

                  7.7MB

                • memory/4312-85-0x0000000074E00000-0x00000000755B0000-memory.dmp

                  Filesize

                  7.7MB

                • memory/4312-53-0x0000000006240000-0x000000000628C000-memory.dmp

                  Filesize

                  304KB

                • memory/4312-51-0x0000000005D10000-0x0000000006064000-memory.dmp

                  Filesize

                  3.3MB

                • memory/4312-32-0x0000000005900000-0x0000000005966000-memory.dmp

                  Filesize

                  408KB

                • memory/4312-89-0x0000000007880000-0x000000000789A000-memory.dmp

                  Filesize

                  104KB

                • memory/4312-20-0x0000000005220000-0x0000000005848000-memory.dmp

                  Filesize

                  6.2MB

                • memory/4312-91-0x0000000007860000-0x0000000007868000-memory.dmp

                  Filesize

                  32KB

                • memory/4312-17-0x0000000074E00000-0x00000000755B0000-memory.dmp

                  Filesize

                  7.7MB

                • memory/4312-15-0x0000000074E00000-0x00000000755B0000-memory.dmp

                  Filesize

                  7.7MB

                • memory/4312-13-0x0000000074E00000-0x00000000755B0000-memory.dmp

                  Filesize

                  7.7MB

                • memory/4312-99-0x0000000074E00000-0x00000000755B0000-memory.dmp

                  Filesize

                  7.7MB