Analysis
-
max time kernel
131s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
16-09-2024 07:16
Static task
static1
Behavioral task
behavioral1
Sample
Shipment Details.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Shipment Details.exe
Resource
win10v2004-20240802-en
General
-
Target
Shipment Details.exe
-
Size
652KB
-
MD5
848f32374aff34d10233e89796e1b799
-
SHA1
999f1cb4fac32f3f8e97e21b1c44186540c14d2d
-
SHA256
3c359f5677b780cc968723ceca8310ed20ae4bf691bd9900c7d334303b101776
-
SHA512
8db7b8ec33834c6b122596558889e501565413cbc3638884cb68e9b437aa1b9fd872ffededace9ee1acb1b52ac412c2f4b5b3792cfb0191d347e61e4e0edf5ea
-
SSDEEP
12288:JCGDah87AwmYuxpXGAIO5P0wtuknzuYtgwM++ro:WqAwqRIS9t7ptgwMRro
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.swedish-hospital.com - Port:
587 - Username:
[email protected] - Password:
Swe2017? - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload 5 IoCs
resource yara_rule behavioral1/memory/2816-16-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla behavioral1/memory/2816-20-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla behavioral1/memory/2816-18-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla behavioral1/memory/2816-13-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla behavioral1/memory/2816-12-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla -
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Oracle\VirtualBox Guest Additions Shipment Details.exe -
Looks for VMWare Tools registry key 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools Shipment Details.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Shipment Details.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Shipment Details.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Shipment Details.exe Key opened \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Shipment Details.exe Key opened \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Shipment Details.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 api.ipify.org 5 api.ipify.org -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum Shipment Details.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 Shipment Details.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2280 set thread context of 2816 2280 Shipment Details.exe 34 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Shipment Details.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Shipment Details.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2828 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2280 Shipment Details.exe 2280 Shipment Details.exe 2280 Shipment Details.exe 2280 Shipment Details.exe 2816 Shipment Details.exe 2816 Shipment Details.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2280 Shipment Details.exe Token: SeDebugPrivilege 2816 Shipment Details.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 2280 wrote to memory of 2828 2280 Shipment Details.exe 32 PID 2280 wrote to memory of 2828 2280 Shipment Details.exe 32 PID 2280 wrote to memory of 2828 2280 Shipment Details.exe 32 PID 2280 wrote to memory of 2828 2280 Shipment Details.exe 32 PID 2280 wrote to memory of 2816 2280 Shipment Details.exe 34 PID 2280 wrote to memory of 2816 2280 Shipment Details.exe 34 PID 2280 wrote to memory of 2816 2280 Shipment Details.exe 34 PID 2280 wrote to memory of 2816 2280 Shipment Details.exe 34 PID 2280 wrote to memory of 2816 2280 Shipment Details.exe 34 PID 2280 wrote to memory of 2816 2280 Shipment Details.exe 34 PID 2280 wrote to memory of 2816 2280 Shipment Details.exe 34 PID 2280 wrote to memory of 2816 2280 Shipment Details.exe 34 PID 2280 wrote to memory of 2816 2280 Shipment Details.exe 34 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Shipment Details.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Shipment Details.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Shipment Details.exe"C:\Users\Admin\AppData\Local\Temp\Shipment Details.exe"1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\YRfVhbRPnaCtBO" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8601.tmp"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2828
-
-
C:\Users\Admin\AppData\Local\Temp\Shipment Details.exe"{path}"2⤵
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:2816
-
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
5Credentials In Files
4Credentials in Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5501f8bebe1e56aeb355225d947d597fc
SHA1f4fb8f149e1045185c8ab86056ac9356b4b0ef38
SHA256ce63e37356888db92c45b94c1ef9ceed4d7e83a47749a3cf4de382d768cc95b7
SHA5124d5301008c58832ad8cca06bfee85167f7994f2ff4b3ea7a32bb12ccb1d3ca0505c322ec496815b44418c99d8e29df58e1bd35c353e310896198e66be49aaa7a