Analysis
-
max time kernel
117s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22-09-2024 05:25
Static task
static1
Behavioral task
behavioral1
Sample
DHL INVOICE pfd.bat.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
DHL INVOICE pfd.bat.exe
Resource
win10v2004-20240802-en
General
-
Target
DHL INVOICE pfd.bat.exe
-
Size
626KB
-
MD5
f344a454d4cb1d1e01da2e2c080dac29
-
SHA1
3936c488c511a6ca05b992fda487ce5e971e57a0
-
SHA256
fd4ca109bbafcc509f99cea673648c2baa6934e9eb9a903b0c24c2e7f84d56c4
-
SHA512
2c71626ff41eac134c6f071c8ce124de87f46ec27ba4075bc452a80d4992688bbd7e056af74b8ab43d623dbea05de8311d76562216a7cc3f20467cfe22677f8d
-
SSDEEP
12288:DHWZ0mNke8OvXWRA64zeEZgrJckmzDQVpOOn99zgL3qF0KsUvwiqk8:D2DV+EzepS/DQVpQMsUvwRH
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.horizongroup.com.bd - Port:
587 - Username:
[email protected] - Password:
horizon@%%%5 - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 860 powershell.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 api.ipify.org 5 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1972 set thread context of 2764 1972 DHL INVOICE pfd.bat.exe 35 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DHL INVOICE pfd.bat.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegSvcs.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2116 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1972 DHL INVOICE pfd.bat.exe 1972 DHL INVOICE pfd.bat.exe 1972 DHL INVOICE pfd.bat.exe 1972 DHL INVOICE pfd.bat.exe 1972 DHL INVOICE pfd.bat.exe 1972 DHL INVOICE pfd.bat.exe 1972 DHL INVOICE pfd.bat.exe 2764 RegSvcs.exe 2764 RegSvcs.exe 860 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1972 DHL INVOICE pfd.bat.exe Token: SeDebugPrivilege 2764 RegSvcs.exe Token: SeDebugPrivilege 860 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2764 RegSvcs.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 1972 wrote to memory of 860 1972 DHL INVOICE pfd.bat.exe 31 PID 1972 wrote to memory of 860 1972 DHL INVOICE pfd.bat.exe 31 PID 1972 wrote to memory of 860 1972 DHL INVOICE pfd.bat.exe 31 PID 1972 wrote to memory of 860 1972 DHL INVOICE pfd.bat.exe 31 PID 1972 wrote to memory of 2116 1972 DHL INVOICE pfd.bat.exe 33 PID 1972 wrote to memory of 2116 1972 DHL INVOICE pfd.bat.exe 33 PID 1972 wrote to memory of 2116 1972 DHL INVOICE pfd.bat.exe 33 PID 1972 wrote to memory of 2116 1972 DHL INVOICE pfd.bat.exe 33 PID 1972 wrote to memory of 2764 1972 DHL INVOICE pfd.bat.exe 35 PID 1972 wrote to memory of 2764 1972 DHL INVOICE pfd.bat.exe 35 PID 1972 wrote to memory of 2764 1972 DHL INVOICE pfd.bat.exe 35 PID 1972 wrote to memory of 2764 1972 DHL INVOICE pfd.bat.exe 35 PID 1972 wrote to memory of 2764 1972 DHL INVOICE pfd.bat.exe 35 PID 1972 wrote to memory of 2764 1972 DHL INVOICE pfd.bat.exe 35 PID 1972 wrote to memory of 2764 1972 DHL INVOICE pfd.bat.exe 35 PID 1972 wrote to memory of 2764 1972 DHL INVOICE pfd.bat.exe 35 PID 1972 wrote to memory of 2764 1972 DHL INVOICE pfd.bat.exe 35 PID 1972 wrote to memory of 2764 1972 DHL INVOICE pfd.bat.exe 35 PID 1972 wrote to memory of 2764 1972 DHL INVOICE pfd.bat.exe 35 PID 1972 wrote to memory of 2764 1972 DHL INVOICE pfd.bat.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\DHL INVOICE pfd.bat.exe"C:\Users\Admin\AppData\Local\Temp\DHL INVOICE pfd.bat.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\PCTbKNp.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:860
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\PCTbKNp" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1F4.tmp"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2116
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2764
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5ff9cac41124a421f7ae53905a24dba1b
SHA13084b19dbc4563c773fb8dbd908412df576aeee9
SHA256220e6b64ef1323df3d20b6c165ef4247ad06186395243fea39ed74d21124d90b
SHA51294c37272bc0288f55382ee1d892e24ffc9e66e8100478c26c1636e620b2620192674e6cdd010213ff38514189eb36be296327f578a78e94c63ea0c804634569d