Analysis
-
max time kernel
7s -
max time network
131s -
platform
windows7_x64 -
resource
win7-20240221-ja -
resource tags
arch:x64arch:x86image:win7-20240221-jalocale:ja-jpos:windows7-x64systemwindows -
submitted
10-06-2024 00:45
Static task
static1
Behavioral task
behavioral1
Sample
Shipping Documents PONBOM01577/Shipping Documents PONBOM01577.xlsx.exe
Resource
win7-20240221-ja
Behavioral task
behavioral2
Sample
Shipping Documents PONBOM01577/Shipping Documents PONBOM01577.xlsx.exe
Resource
win10v2004-20240226-ja
General
-
Target
Shipping Documents PONBOM01577/Shipping Documents PONBOM01577.xlsx.exe
-
Size
390KB
-
MD5
9ad1097ef6d23a86d4b9327e54fdc9bc
-
SHA1
517d09c1d755f08f3c5bf073d87185a801b68907
-
SHA256
df9e1f7fa8d1badaa7afd42cc3aac4ef5aad3a9973ee71059599325284566e67
-
SHA512
1ea9293a6931e191b1c63537fc5ea003e8ae98d53242a711769052bf9ba1976def2bb5f7894f85a0da087c0a4354a68474268da77d8438cfbb0a04299df7c955
-
SSDEEP
6144:nG8/Pl5W2KYbjOrq1NijSchoiEC8IjhJwJpNhCF5qGI3f2nwf0F4eQhrt/bcnAI:n2rgijP7EHEsvNhC7IfBbhrt4T
Malware Config
Extracted
agenttesla
Protocol: ftp- Host:
ftp://s4.serv00.com - Port:
21 - Username:
f2241_dol - Password:
Doll900#@
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 api.ipify.org 5 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Shipping Documents PONBOM01577.xlsx.exedescription pid Process procid_target PID 2660 set thread context of 460 2660 Shipping Documents PONBOM01577.xlsx.exe 29 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
Shipping Documents PONBOM01577.xlsx.exepid Process 460 Shipping Documents PONBOM01577.xlsx.exe 460 Shipping Documents PONBOM01577.xlsx.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Shipping Documents PONBOM01577.xlsx.exedescription pid Process Token: SeDebugPrivilege 460 Shipping Documents PONBOM01577.xlsx.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
Shipping Documents PONBOM01577.xlsx.exedescription pid Process procid_target PID 2660 wrote to memory of 460 2660 Shipping Documents PONBOM01577.xlsx.exe 29 PID 2660 wrote to memory of 460 2660 Shipping Documents PONBOM01577.xlsx.exe 29 PID 2660 wrote to memory of 460 2660 Shipping Documents PONBOM01577.xlsx.exe 29 PID 2660 wrote to memory of 460 2660 Shipping Documents PONBOM01577.xlsx.exe 29 PID 2660 wrote to memory of 460 2660 Shipping Documents PONBOM01577.xlsx.exe 29 PID 2660 wrote to memory of 460 2660 Shipping Documents PONBOM01577.xlsx.exe 29 PID 2660 wrote to memory of 460 2660 Shipping Documents PONBOM01577.xlsx.exe 29 PID 2660 wrote to memory of 460 2660 Shipping Documents PONBOM01577.xlsx.exe 29 PID 2660 wrote to memory of 460 2660 Shipping Documents PONBOM01577.xlsx.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\Shipping Documents PONBOM01577\Shipping Documents PONBOM01577.xlsx.exe"C:\Users\Admin\AppData\Local\Temp\Shipping Documents PONBOM01577\Shipping Documents PONBOM01577.xlsx.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\Shipping Documents PONBOM01577\Shipping Documents PONBOM01577.xlsx.exe"C:\Users\Admin\AppData\Local\Temp\Shipping Documents PONBOM01577\Shipping Documents PONBOM01577.xlsx.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:460
-