Analysis
-
max time kernel
129s -
max time network
132s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
18-06-2024 07:56
Static task
static1
General
-
Target
DHL Package Documents clearance.exe
-
Size
690KB
-
MD5
06f29001ddc852a2880b8ece673ff24c
-
SHA1
f80a254ba85b9531da05c74a12a8235ef8a359a1
-
SHA256
87c68756481a2bbd821e8ac224087c5626ffdc1e05eaaeff506bb0b5148bba0b
-
SHA512
95020cd917b98919d3960090209bbd754739cc247ffd0497cbf0edd0142ab7c86d668f6617b9f47c8e375dc323508bb42d38fe2c44eca4b56524835e0b40527b
-
SSDEEP
12288:D2iNvFIsPAYDDNvkm7TuIQvQatxuJlV3D677qZAu+IPlatsXqdcW:D1DIK7DNvj7TuIQY3X3e7uZAuExdc
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.kxnlaos.com - Port:
587 - Username:
[email protected] - Password:
eDe~fz;Cy0{W - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
DHL Package Documents clearance.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation DHL Package Documents clearance.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
DHL Package Documents clearance.exedescription pid process target process PID 3824 set thread context of 3788 3824 DHL Package Documents clearance.exe MSBuild.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 18 IoCs
Processes:
DHL Package Documents clearance.exeMSBuild.exepowershell.exepid process 3824 DHL Package Documents clearance.exe 3824 DHL Package Documents clearance.exe 3824 DHL Package Documents clearance.exe 3824 DHL Package Documents clearance.exe 3824 DHL Package Documents clearance.exe 3824 DHL Package Documents clearance.exe 3824 DHL Package Documents clearance.exe 3824 DHL Package Documents clearance.exe 3824 DHL Package Documents clearance.exe 3824 DHL Package Documents clearance.exe 3824 DHL Package Documents clearance.exe 3824 DHL Package Documents clearance.exe 3824 DHL Package Documents clearance.exe 3824 DHL Package Documents clearance.exe 3788 MSBuild.exe 3788 MSBuild.exe 2016 powershell.exe 2016 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
DHL Package Documents clearance.exeMSBuild.exepowershell.exedescription pid process Token: SeDebugPrivilege 3824 DHL Package Documents clearance.exe Token: SeDebugPrivilege 3788 MSBuild.exe Token: SeDebugPrivilege 2016 powershell.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
DHL Package Documents clearance.exedescription pid process target process PID 3824 wrote to memory of 2016 3824 DHL Package Documents clearance.exe powershell.exe PID 3824 wrote to memory of 2016 3824 DHL Package Documents clearance.exe powershell.exe PID 3824 wrote to memory of 2016 3824 DHL Package Documents clearance.exe powershell.exe PID 3824 wrote to memory of 3788 3824 DHL Package Documents clearance.exe MSBuild.exe PID 3824 wrote to memory of 3788 3824 DHL Package Documents clearance.exe MSBuild.exe PID 3824 wrote to memory of 3788 3824 DHL Package Documents clearance.exe MSBuild.exe PID 3824 wrote to memory of 3788 3824 DHL Package Documents clearance.exe MSBuild.exe PID 3824 wrote to memory of 3788 3824 DHL Package Documents clearance.exe MSBuild.exe PID 3824 wrote to memory of 3788 3824 DHL Package Documents clearance.exe MSBuild.exe PID 3824 wrote to memory of 3788 3824 DHL Package Documents clearance.exe MSBuild.exe PID 3824 wrote to memory of 3788 3824 DHL Package Documents clearance.exe MSBuild.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\DHL Package Documents clearance.exe"C:\Users\Admin\AppData\Local\Temp\DHL Package Documents clearance.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3824 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\DHL Package Documents clearance.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2016 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3788
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82