Analysis
-
max time kernel
24s -
max time network
103s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
10-06-2024 01:56
Static task
static1
Behavioral task
behavioral1
Sample
Shipping documents.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
Shipping documents.exe
Resource
win10v2004-20240508-en
General
-
Target
Shipping documents.exe
-
Size
684KB
-
MD5
594c88f0815435836775f4af6fd465d4
-
SHA1
303d2f4a1b8ce101e9957c299ca57a4621d3a016
-
SHA256
8fbf89ff9f1c63329f5251feed90590b8f3bd725e469b5afd25be717f3cb2ca9
-
SHA512
b93bb4606ed5dcc87eeb06df6bb9acc6dee994e6c6456e33ca0671cc25f6026e19cf72532294dbacd04ab063113125a8748cde94b46ec9cf66eeaf6d4657c7be
-
SSDEEP
12288:weATclGRjKCKooZVEhPkzIOiRv+NBTp/U2pQ3pRCXDuIJqyJMq40Bbf25kR:nackROioZCGsJOc2pYkX6OJP
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.springandsummer.lk - Port:
587 - Username:
[email protected] - Password:
anu##323 - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Detect packed .NET executables. Mostly AgentTeslaV4. 1 IoCs
Processes:
resource yara_rule behavioral2/memory/1764-46-0x0000000000400000-0x0000000000442000-memory.dmp INDICATOR_EXE_Packed_GEN01 -
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 1 IoCs
Processes:
resource yara_rule behavioral2/memory/1764-46-0x0000000000400000-0x0000000000442000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers -
Detects executables referencing Windows vault credential objects. Observed in infostealers 1 IoCs
Processes:
resource yara_rule behavioral2/memory/1764-46-0x0000000000400000-0x0000000000442000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID -
Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers 1 IoCs
Processes:
resource yara_rule behavioral2/memory/1764-46-0x0000000000400000-0x0000000000442000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store -
Detects executables referencing many email and collaboration clients. Observed in information stealers 1 IoCs
Processes:
resource yara_rule behavioral2/memory/1764-46-0x0000000000400000-0x0000000000442000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients -
Detects executables referencing many file transfer clients. Observed in information stealers 1 IoCs
Processes:
resource yara_rule behavioral2/memory/1764-46-0x0000000000400000-0x0000000000442000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients -
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Processes:
powershell.exepowershell.exepid Process 4508 powershell.exe 3812 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Shipping documents.exedescription ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation Shipping documents.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
RegSvcs.exedescription ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\boqXv = "C:\\Users\\Admin\\AppData\\Roaming\\boqXv\\boqXv.exe" RegSvcs.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Shipping documents.exedescription pid Process procid_target PID 1984 set thread context of 1764 1984 Shipping documents.exe 95 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 15 IoCs
Processes:
Shipping documents.exepowershell.exepowershell.exeRegSvcs.exepid Process 1984 Shipping documents.exe 1984 Shipping documents.exe 1984 Shipping documents.exe 1984 Shipping documents.exe 1984 Shipping documents.exe 1984 Shipping documents.exe 3812 powershell.exe 4508 powershell.exe 1984 Shipping documents.exe 1984 Shipping documents.exe 1984 Shipping documents.exe 1764 RegSvcs.exe 1764 RegSvcs.exe 4508 powershell.exe 3812 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
Shipping documents.exepowershell.exepowershell.exeRegSvcs.exedescription pid Process Token: SeDebugPrivilege 1984 Shipping documents.exe Token: SeDebugPrivilege 3812 powershell.exe Token: SeDebugPrivilege 4508 powershell.exe Token: SeDebugPrivilege 1764 RegSvcs.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
Shipping documents.exedescription pid Process procid_target PID 1984 wrote to memory of 3812 1984 Shipping documents.exe 88 PID 1984 wrote to memory of 3812 1984 Shipping documents.exe 88 PID 1984 wrote to memory of 3812 1984 Shipping documents.exe 88 PID 1984 wrote to memory of 4508 1984 Shipping documents.exe 90 PID 1984 wrote to memory of 4508 1984 Shipping documents.exe 90 PID 1984 wrote to memory of 4508 1984 Shipping documents.exe 90 PID 1984 wrote to memory of 2288 1984 Shipping documents.exe 92 PID 1984 wrote to memory of 2288 1984 Shipping documents.exe 92 PID 1984 wrote to memory of 2288 1984 Shipping documents.exe 92 PID 1984 wrote to memory of 3620 1984 Shipping documents.exe 94 PID 1984 wrote to memory of 3620 1984 Shipping documents.exe 94 PID 1984 wrote to memory of 3620 1984 Shipping documents.exe 94 PID 1984 wrote to memory of 1764 1984 Shipping documents.exe 95 PID 1984 wrote to memory of 1764 1984 Shipping documents.exe 95 PID 1984 wrote to memory of 1764 1984 Shipping documents.exe 95 PID 1984 wrote to memory of 1764 1984 Shipping documents.exe 95 PID 1984 wrote to memory of 1764 1984 Shipping documents.exe 95 PID 1984 wrote to memory of 1764 1984 Shipping documents.exe 95 PID 1984 wrote to memory of 1764 1984 Shipping documents.exe 95 PID 1984 wrote to memory of 1764 1984 Shipping documents.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\Shipping documents.exe"C:\Users\Admin\AppData\Local\Temp\Shipping documents.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Shipping documents.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3812
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\gYctFdAIXtTSr.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4508
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gYctFdAIXtTSr" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8750.tmp"2⤵
- Creates scheduled task(s)
PID:2288
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵PID:3620
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1764
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
Filesize
18KB
MD50621c5d55cd9f3d9a1586cc25cac3872
SHA1a6441c2313d6d233fe1b14f1c4ecd15f97ef36a3
SHA256aeda54099b8c97c37fbbcdac2be9010154d6f6d34b55fc00c201a97dc0522950
SHA51269eab6a2a13f844cab18a7e1a9f8d244f08cbe680724958a59765ae3cb22212e428bacdbb6821b88f810e08bbe8a9a89b6dba25cc6e77349fcffde8ef62395e4
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
1KB
MD5f0a2080309a53a5048ab511f5ff9bf6d
SHA11656d22f1f61d8561ab7d92349f9dd9c53d10775
SHA2563d83b588f76fab2d8412c6649a3c1cde23b55718ab27f3ff2cfe78d1f72ab0c0
SHA5123539a11abd70375106077c2609e1eff27093c26fd940b369474aa233d811691b8ed70fbd09cb8f502ef96404dc3ed6388520c71cd725fdc1e089d5a6462dbeb1