Analysis

  • max time kernel
    131s
  • max time network
    132s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18-06-2024 06:45

General

  • Target

    shipping documents.exe

  • Size

    731KB

  • MD5

    487581e26f44dc342b13f83a424a7d0b

  • SHA1

    f63e3fdfa598322bd2ededb12a2c272182824990

  • SHA256

    553e372ef331a9891f8cada32625bd6491cbd427f1a2a6ad62cd1472ec3f23a0

  • SHA512

    9e903d9be418a8d024b566bf06d28a300bf15f3fa042a4a8ebe7b8e186a8cb50ad19e5a892e5137dccc05fac4b7eabf6236592b6efcea045d68ad1988c03a99a

  • SSDEEP

    12288:UPU2iNPyCK2xrOo2BakSVelkYawUlrc/6t2SLck6en6Oj0KlhKAgLEwkR:L15yC5ESVkRallVGzgfkAX

Malware Config

Extracted

Family

agenttesla

Credentials

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 21 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\shipping documents.exe
    "C:\Users\Admin\AppData\Local\Temp\shipping documents.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2248
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\shipping documents.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4304
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\qvgpVBR.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:588
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qvgpVBR" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3042.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:3264
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      2⤵
        PID:2672
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        2⤵
          PID:1720
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
          2⤵
          • Adds Run key to start application
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4708
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3804,i,6166776566165096562,4582328833313060853,262144 --variations-seed-version --mojo-platform-channel-handle=3960 /prefetch:8
        1⤵
          PID:1144

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

          Filesize

          2KB

          MD5

          968cb9309758126772781b83adb8a28f

          SHA1

          8da30e71accf186b2ba11da1797cf67f8f78b47c

          SHA256

          92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

          SHA512

          4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

          Filesize

          18KB

          MD5

          411e4f1be606b60cc65d659e992d8cab

          SHA1

          19d0816d3dbbbb9be2323226f2faa98adcbea12e

          SHA256

          dbc1050d90a4b553475c31d2f3febe681de9f137bc40f0fcbd404bae7bbc305b

          SHA512

          e8da1978ee2eb8477947571edcd7f9c67a184e5cd81e58aecf93711eeb57fdf1d39bea58785b7f5cecb9ddac6e18c9f7daa82ee3bd8f2f83d759b10eb5cf2d7d

        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_q3c5cpzf.dk5.ps1

          Filesize

          60B

          MD5

          d17fe0a3f47be24a6453e9ef58c94641

          SHA1

          6ab83620379fc69f80c0242105ddffd7d98d5d9d

          SHA256

          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

          SHA512

          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

        • C:\Users\Admin\AppData\Local\Temp\tmp3042.tmp

          Filesize

          1KB

          MD5

          96ccf6429b2cf14c44c597e82a9866a2

          SHA1

          dc078b28933db7448f98e26f85305dc2bc7f5213

          SHA256

          312243e828b35e5c3f5e80f8ede0767d2baef4e72fb29d72e1075630fde826db

          SHA512

          50b93c2ba6a94da668a0da6a214a109a002b285d33ef8f4f8f9c6d45fab60956e21dee2d1fc922935924fa5220575b18b2d50cca2ac609a9b96d7db260230caf

        • memory/588-76-0x0000000007820000-0x0000000007E9A000-memory.dmp

          Filesize

          6.5MB

        • memory/588-36-0x00000000743C0000-0x0000000074B70000-memory.dmp

          Filesize

          7.7MB

        • memory/588-92-0x00000000743C0000-0x0000000074B70000-memory.dmp

          Filesize

          7.7MB

        • memory/588-83-0x0000000007420000-0x0000000007434000-memory.dmp

          Filesize

          80KB

        • memory/588-80-0x00000000073E0000-0x00000000073F1000-memory.dmp

          Filesize

          68KB

        • memory/588-79-0x0000000007460000-0x00000000074F6000-memory.dmp

          Filesize

          600KB

        • memory/588-78-0x0000000007250000-0x000000000725A000-memory.dmp

          Filesize

          40KB

        • memory/588-77-0x00000000071E0000-0x00000000071FA000-memory.dmp

          Filesize

          104KB

        • memory/588-64-0x000000006F1E0000-0x000000006F22C000-memory.dmp

          Filesize

          304KB

        • memory/588-35-0x00000000743C0000-0x0000000074B70000-memory.dmp

          Filesize

          7.7MB

        • memory/588-46-0x00000000743C0000-0x0000000074B70000-memory.dmp

          Filesize

          7.7MB

        • memory/2248-2-0x0000000005790000-0x0000000005D34000-memory.dmp

          Filesize

          5.6MB

        • memory/2248-14-0x00000000743CE000-0x00000000743CF000-memory.dmp

          Filesize

          4KB

        • memory/2248-1-0x00000000006A0000-0x000000000075A000-memory.dmp

          Filesize

          744KB

        • memory/2248-49-0x00000000743C0000-0x0000000074B70000-memory.dmp

          Filesize

          7.7MB

        • memory/2248-4-0x0000000005120000-0x000000000512A000-memory.dmp

          Filesize

          40KB

        • memory/2248-33-0x00000000743C0000-0x0000000074B70000-memory.dmp

          Filesize

          7.7MB

        • memory/2248-6-0x0000000005410000-0x00000000054AC000-memory.dmp

          Filesize

          624KB

        • memory/2248-3-0x00000000051E0000-0x0000000005272000-memory.dmp

          Filesize

          584KB

        • memory/2248-8-0x00000000051C0000-0x00000000051D0000-memory.dmp

          Filesize

          64KB

        • memory/2248-9-0x0000000006840000-0x00000000068C4000-memory.dmp

          Filesize

          528KB

        • memory/2248-0-0x00000000743CE000-0x00000000743CF000-memory.dmp

          Filesize

          4KB

        • memory/2248-7-0x00000000053E0000-0x00000000053FA000-memory.dmp

          Filesize

          104KB

        • memory/2248-5-0x00000000743C0000-0x0000000074B70000-memory.dmp

          Filesize

          7.7MB

        • memory/4304-52-0x0000000006420000-0x0000000006452000-memory.dmp

          Filesize

          200KB

        • memory/4304-85-0x00000000074B0000-0x00000000074B8000-memory.dmp

          Filesize

          32KB

        • memory/4304-53-0x000000006F1E0000-0x000000006F22C000-memory.dmp

          Filesize

          304KB

        • memory/4304-63-0x0000000006E30000-0x0000000006E4E000-memory.dmp

          Filesize

          120KB

        • memory/4304-20-0x0000000005790000-0x00000000057F6000-memory.dmp

          Filesize

          408KB

        • memory/4304-72-0x0000000007060000-0x0000000007103000-memory.dmp

          Filesize

          652KB

        • memory/4304-16-0x00000000743C0000-0x0000000074B70000-memory.dmp

          Filesize

          7.7MB

        • memory/4304-17-0x00000000050F0000-0x0000000005718000-memory.dmp

          Filesize

          6.2MB

        • memory/4304-34-0x00000000743C0000-0x0000000074B70000-memory.dmp

          Filesize

          7.7MB

        • memory/4304-15-0x0000000002550000-0x0000000002586000-memory.dmp

          Filesize

          216KB

        • memory/4304-19-0x0000000005040000-0x00000000050A6000-memory.dmp

          Filesize

          408KB

        • memory/4304-18-0x0000000004FA0000-0x0000000004FC2000-memory.dmp

          Filesize

          136KB

        • memory/4304-31-0x0000000005850000-0x0000000005BA4000-memory.dmp

          Filesize

          3.3MB

        • memory/4304-82-0x00000000073C0000-0x00000000073CE000-memory.dmp

          Filesize

          56KB

        • memory/4304-21-0x00000000743C0000-0x0000000074B70000-memory.dmp

          Filesize

          7.7MB

        • memory/4304-84-0x00000000074D0000-0x00000000074EA000-memory.dmp

          Filesize

          104KB

        • memory/4304-51-0x0000000006240000-0x000000000628C000-memory.dmp

          Filesize

          304KB

        • memory/4304-50-0x0000000005E50000-0x0000000005E6E000-memory.dmp

          Filesize

          120KB

        • memory/4304-91-0x00000000743C0000-0x0000000074B70000-memory.dmp

          Filesize

          7.7MB

        • memory/4708-81-0x00000000062D0000-0x0000000006320000-memory.dmp

          Filesize

          320KB

        • memory/4708-47-0x0000000000400000-0x0000000000442000-memory.dmp

          Filesize

          264KB