Analysis
- max time kernel
121s - max time network
127s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
- submitted
07/06/2024, 05:49
General
- Target DHL Shipping Document.exe
- Size 602KB
- Sample240607-gh559abf23
- SHA256 97efd9bf4be94126bd366cab770f1db598ed0755ea362f6fa3e8c85fa4216766
Malware Config
Extracted
-
agenttesla
-
Protocol
smtp
-
Host
smtp.trisquarespl.com
-
Port
587
-
Username
-
Password
LWPnuRu8
-
Email to
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\DHL Shipping Document.exe"C:\Users\Admin\AppData\Local\Temp\DHL Shipping Document.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2256 -s 6562⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2256-3-0x000000001AC20000-0x000000001ACB4000-memory.dmp
memory/2256-17-0x000007FEF5690000-0x000007FEF607C000-memory.dmp
memory/2256-16-0x000007FEF5693000-0x000007FEF5694000-memory.dmp
memory/2256-0-0x000007FEF5693000-0x000007FEF5694000-memory.dmp
memory/2256-1-0x00000000010C0000-0x00000000010CC000-memory.dmp
memory/2256-2-0x000007FEF5690000-0x000007FEF607C000-memory.dmp
memory/2476-9-0x0000000000400000-0x0000000000440000-memory.dmp
memory/2476-5-0x0000000000400000-0x0000000000440000-memory.dmp
memory/2476-7-0x0000000000400000-0x0000000000440000-memory.dmp
memory/2476-4-0x0000000000400000-0x0000000000440000-memory.dmp
memory/2476-6-0x0000000000400000-0x0000000000440000-memory.dmp
memory/2476-8-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
memory/2476-15-0x0000000074230000-0x000000007491E000-memory.dmp
memory/2476-11-0x0000000000400000-0x0000000000440000-memory.dmp
memory/2476-13-0x0000000000400000-0x0000000000440000-memory.dmp
memory/2476-14-0x000000007423E000-0x000000007423F000-memory.dmp
memory/2476-18-0x000000007423E000-0x000000007423F000-memory.dmp
memory/2476-19-0x0000000074230000-0x000000007491E000-memory.dmp