Analysis

  • max time kernel
    95s
  • max time network
    19s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    17-09-2024 09:35

General

  • Target

    DHL 08102020 0013456 09876.exe

  • Size

    770KB

  • MD5

    7ba4cbfd2c65ee56f79122c087a5cb3d

  • SHA1

    b0952fe773b43850742bf8ca0e7e69b87e4042de

  • SHA256

    1eb80076d32a7919086f64f0fd8bbb87f2116992719c9d67e679f3c76a2e9392

  • SHA512

    d6695512546c6e77d40e4a25b76dd79f50323ee5dc3cda24f149b74d07ca2fd1f4dc1795e738d6b137ae311104a6fbb79811676db13d7f902b6a7c9de680067d

  • SSDEEP

    12288:1jR4XZUNvv1y6kU2KMn9226/Zz0zIdKBxq9grpiAeve/ckjQc:X4pXU0n426ByIdKyCQAev5kjB

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    smtp.wtgriderline.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    wyiKluF9

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • AgentTesla payload 5 IoCs
  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\DHL 08102020 0013456 09876.exe
    "C:\Users\Admin\AppData\Local\Temp\DHL 08102020 0013456 09876.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1688
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "{path}"
      2⤵
      • Accesses Microsoft Outlook profiles
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • outlook_office_path
      • outlook_win_path
      PID:2844

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1688-0-0x00000000740DE000-0x00000000740DF000-memory.dmp

    Filesize

    4KB

  • memory/1688-1-0x0000000000A50000-0x0000000000B16000-memory.dmp

    Filesize

    792KB

  • memory/1688-2-0x00000000740D0000-0x00000000747BE000-memory.dmp

    Filesize

    6.9MB

  • memory/1688-3-0x0000000000360000-0x0000000000370000-memory.dmp

    Filesize

    64KB

  • memory/1688-4-0x00000000740DE000-0x00000000740DF000-memory.dmp

    Filesize

    4KB

  • memory/1688-5-0x00000000740D0000-0x00000000747BE000-memory.dmp

    Filesize

    6.9MB

  • memory/1688-6-0x0000000002150000-0x00000000021C2000-memory.dmp

    Filesize

    456KB

  • memory/1688-7-0x00000000020B0000-0x0000000002108000-memory.dmp

    Filesize

    352KB

  • memory/1688-23-0x00000000740D0000-0x00000000747BE000-memory.dmp

    Filesize

    6.9MB

  • memory/2844-21-0x0000000000400000-0x0000000000458000-memory.dmp

    Filesize

    352KB

  • memory/2844-17-0x0000000000400000-0x0000000000458000-memory.dmp

    Filesize

    352KB

  • memory/2844-22-0x00000000740D0000-0x00000000747BE000-memory.dmp

    Filesize

    6.9MB

  • memory/2844-9-0x0000000000400000-0x0000000000458000-memory.dmp

    Filesize

    352KB

  • memory/2844-19-0x0000000000400000-0x0000000000458000-memory.dmp

    Filesize

    352KB

  • memory/2844-16-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

    Filesize

    4KB

  • memory/2844-14-0x0000000000400000-0x0000000000458000-memory.dmp

    Filesize

    352KB

  • memory/2844-10-0x0000000000400000-0x0000000000458000-memory.dmp

    Filesize

    352KB

  • memory/2844-12-0x0000000000400000-0x0000000000458000-memory.dmp

    Filesize

    352KB

  • memory/2844-24-0x00000000740D0000-0x00000000747BE000-memory.dmp

    Filesize

    6.9MB

  • memory/2844-25-0x00000000740D0000-0x00000000747BE000-memory.dmp

    Filesize

    6.9MB