Analysis

  • max time kernel
    118s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240419-en
  • resource tags

    arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
  • submitted
    22-05-2024 06:02

General

  • Target

    DHL Delivery Invoice AWB#7490327845.exe

  • Size

    818KB

  • MD5

    03706e52938770bd5497faddc41ae671

  • SHA1

    75d77e86a0c5eb7745d0efe60c90175deea29fea

  • SHA256

    ae424f87ddc0913714a888f32a9412df939107b863c28e407513cf1b55db07f2

  • SHA512

    00fe3572a8cb40ec347c9ce563ecc4e78bc0cd93f7c987f1cc3cd9f2de1b93fa33bc7c3e017c84897c494a905895c987de71459151f5fb03f3c458bf15918a56

  • SSDEEP

    12288:zzWWET/mr9K0A/B5bKmy+VDmVx5R380an/soBWKNmRobGGKraPHOLcIjqlEWDvo+:zzWWtDQKd+lFbNkALWfsE+

Malware Config

Extracted

Family

agenttesla

Credentials

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\DHL Delivery Invoice AWB#7490327845.exe
    "C:\Users\Admin\AppData\Local\Temp\DHL Delivery Invoice AWB#7490327845.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2188
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ChxJRlBJ.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2368
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ChxJRlBJ" /XML "C:\Users\Admin\AppData\Local\Temp\tmp32E3.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:2624
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:2604

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmp32E3.tmp

    Filesize

    1KB

    MD5

    519c0a319bd6330476c3c2026b226702

    SHA1

    56d0cb6089a5da4216eefdfc443f7330ee0bab35

    SHA256

    9b5bd6dd778f67415956cf90f613b711460617e7591cc57b16081d52f01e339c

    SHA512

    90e82c093fe059c89a10436f375631da7c8602e4cbbfc3a6a30107f597c5d937536be4791fd4b15d82a02e84d1bc30b6fd2060e6fca26e9fb585e1037c109ff8

  • memory/2188-26-0x0000000074940000-0x000000007502E000-memory.dmp

    Filesize

    6.9MB

  • memory/2188-1-0x0000000000910000-0x00000000009E2000-memory.dmp

    Filesize

    840KB

  • memory/2188-2-0x0000000074940000-0x000000007502E000-memory.dmp

    Filesize

    6.9MB

  • memory/2188-3-0x0000000002030000-0x0000000002052000-memory.dmp

    Filesize

    136KB

  • memory/2188-4-0x0000000000590000-0x000000000059C000-memory.dmp

    Filesize

    48KB

  • memory/2188-5-0x00000000005E0000-0x00000000005F0000-memory.dmp

    Filesize

    64KB

  • memory/2188-6-0x00000000049D0000-0x0000000004A52000-memory.dmp

    Filesize

    520KB

  • memory/2188-0-0x000000007494E000-0x000000007494F000-memory.dmp

    Filesize

    4KB

  • memory/2604-14-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

  • memory/2604-24-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

  • memory/2604-23-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

  • memory/2604-22-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2604-20-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

  • memory/2604-18-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

  • memory/2604-16-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

  • memory/2604-25-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB