Analysis

  • max time kernel
    94s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17-09-2024 09:35

General

  • Target

    DHL 08102020 0013456 09876.exe

  • Size

    770KB

  • MD5

    7ba4cbfd2c65ee56f79122c087a5cb3d

  • SHA1

    b0952fe773b43850742bf8ca0e7e69b87e4042de

  • SHA256

    1eb80076d32a7919086f64f0fd8bbb87f2116992719c9d67e679f3c76a2e9392

  • SHA512

    d6695512546c6e77d40e4a25b76dd79f50323ee5dc3cda24f149b74d07ca2fd1f4dc1795e738d6b137ae311104a6fbb79811676db13d7f902b6a7c9de680067d

  • SSDEEP

    12288:1jR4XZUNvv1y6kU2KMn9226/Zz0zIdKBxq9grpiAeve/ckjQc:X4pXU0n426ByIdKyCQAev5kjB

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    smtp.wtgriderline.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    wyiKluF9

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • AgentTesla payload 1 IoCs
  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\DHL 08102020 0013456 09876.exe
    "C:\Users\Admin\AppData\Local\Temp\DHL 08102020 0013456 09876.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3348
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "{path}"
      2⤵
      • Accesses Microsoft Outlook profiles
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • outlook_office_path
      • outlook_win_path
      PID:3760

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3348-10-0x0000000009230000-0x0000000009288000-memory.dmp

    Filesize

    352KB

  • memory/3348-14-0x00000000747E0000-0x0000000074F90000-memory.dmp

    Filesize

    7.7MB

  • memory/3348-2-0x0000000005580000-0x0000000005B24000-memory.dmp

    Filesize

    5.6MB

  • memory/3348-3-0x00000000051B0000-0x0000000005242000-memory.dmp

    Filesize

    584KB

  • memory/3348-4-0x00000000747E0000-0x0000000074F90000-memory.dmp

    Filesize

    7.7MB

  • memory/3348-5-0x0000000005180000-0x000000000518A000-memory.dmp

    Filesize

    40KB

  • memory/3348-6-0x00000000053D0000-0x00000000053E0000-memory.dmp

    Filesize

    64KB

  • memory/3348-0-0x00000000747EE000-0x00000000747EF000-memory.dmp

    Filesize

    4KB

  • memory/3348-8-0x00000000747E0000-0x0000000074F90000-memory.dmp

    Filesize

    7.7MB

  • memory/3348-1-0x0000000000320000-0x00000000003E6000-memory.dmp

    Filesize

    792KB

  • memory/3348-7-0x00000000747EE000-0x00000000747EF000-memory.dmp

    Filesize

    4KB

  • memory/3348-11-0x000000000C5B0000-0x000000000C64C000-memory.dmp

    Filesize

    624KB

  • memory/3348-9-0x0000000006BE0000-0x0000000006C52000-memory.dmp

    Filesize

    456KB

  • memory/3760-18-0x0000000005040000-0x0000000005058000-memory.dmp

    Filesize

    96KB

  • memory/3760-15-0x00000000747E0000-0x0000000074F90000-memory.dmp

    Filesize

    7.7MB

  • memory/3760-16-0x00000000747E0000-0x0000000074F90000-memory.dmp

    Filesize

    7.7MB

  • memory/3760-17-0x00000000747E0000-0x0000000074F90000-memory.dmp

    Filesize

    7.7MB

  • memory/3760-12-0x0000000000400000-0x0000000000458000-memory.dmp

    Filesize

    352KB

  • memory/3760-19-0x00000000055C0000-0x0000000005626000-memory.dmp

    Filesize

    408KB

  • memory/3760-20-0x00000000063F0000-0x0000000006440000-memory.dmp

    Filesize

    320KB