Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
shipping docs.exe

Overview

General Information

Sample Name:shipping docs.exe
Analysis ID:756232
MD5:6308ae755a893c15a989b1ccf2c56393
SHA1:00ada70aa14a5cf26a7f8cecbaaa437267d30a2a
SHA256:9dfdb5048599b1083fe534cf5fe5a0440d71eb74b5497e506f0a0a4c23821f40
Tags:agentteslaexe
Infos:

Detection

AgentTesla
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
Malicious sample detected (through community Yara rule)
Yara detected Telegram RAT
Yara detected AgentTesla
Yara detected AntiVM3
Sigma detected: Scheduled temp file as task from temp location
Multi AV Scanner detection for dropped file
Snort IDS alert for network traffic
Tries to steal Mail credentials (via file / registry access)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses the Telegram API (likely for C&C communication)
Machine Learning detection for sample
Injects a PE file into a foreign processes
.NET source code contains very large array initializations
Machine Learning detection for dropped file
Hides that the sample has been downloaded from the Internet (zone.identifier)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Uses schtasks.exe or at.exe to add and modify task schedules
Tries to harvest and steal browser information (history, passwords, etc)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Yara signature match
Antivirus or Machine Learning detection for unpacked file
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Detected potential crypto function
Sample execution stops while process was sleeping (likely an evasion)
Yara detected Credential Stealer
JA3 SSL client fingerprint seen in connection with other malware
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Contains long sleeps (>= 3 min)
Enables debug privileges
Creates a DirectInput object (often for capturing keystrokes)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Sample file is different than original file name gathered from version info
Drops PE files
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Creates a process in suspended mode (likely to inject code)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

  • System is w10x64
  • shipping docs.exe (PID: 2400 cmdline: C:\Users\user\Desktop\shipping docs.exe MD5: 6308AE755A893C15A989B1CCF2C56393)
    • schtasks.exe (PID: 5248 cmdline: C:\Windows\System32\schtasks.exe" /Create /TN "Updates\yVGAJfiVEvtg" /XML "C:\Users\user\AppData\Local\Temp\tmp7934.tmp MD5: 15FF7D8324231381BAD48A052F85DF04)
      • conhost.exe (PID: 5220 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
  • yVGAJfiVEvtg.exe (PID: 4552 cmdline: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe MD5: 6308AE755A893C15A989B1CCF2C56393)
    • schtasks.exe (PID: 4792 cmdline: C:\Windows\System32\schtasks.exe" /Create /TN "Updates\yVGAJfiVEvtg" /XML "C:\Users\user\AppData\Local\Temp\tmpF5B7.tmp MD5: 15FF7D8324231381BAD48A052F85DF04)
      • conhost.exe (PID: 4536 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • yVGAJfiVEvtg.exe (PID: 3680 cmdline: {path} MD5: 6308AE755A893C15A989B1CCF2C56393)
  • VMqTMMD.exe (PID: 1280 cmdline: "C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe" MD5: 6308AE755A893C15A989B1CCF2C56393)
  • VMqTMMD.exe (PID: 3124 cmdline: "C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe" MD5: 6308AE755A893C15A989B1CCF2C56393)
    • schtasks.exe (PID: 4184 cmdline: C:\Windows\System32\schtasks.exe" /Create /TN "Updates\yVGAJfiVEvtg" /XML "C:\Users\user\AppData\Local\Temp\tmp3418.tmp MD5: 15FF7D8324231381BAD48A052F85DF04)
      • conhost.exe (PID: 4404 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • VMqTMMD.exe (PID: 5228 cmdline: {path} MD5: 6308AE755A893C15A989B1CCF2C56393)
  • cleanup
{"C2 url": "https://api.telegram.org/bot5676971476:AAFdGsXW8kwzXNIluAGV-a4sJ2XBy68O9WI/sendMessage"}
{"Exfil Mode": "Telegram", "Telegram Url": "https://api.telegram.org/bot5676971476:AAFdGsXW8kwzXNIluAGV-a4sJ2XBy68O9WI/sendMessage?chat_id=1644584536"}
SourceRuleDescriptionAuthorStrings
0000000E.00000002.343723068.0000000002D38000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_AntiVM_3Yara detected AntiVM_3Joe Security
    00000000.00000002.270616747.00000000034A9000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
      00000000.00000002.270616747.00000000034A9000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_AgentTesla_2Yara detected AgentTeslaJoe Security
        00000000.00000002.270616747.00000000034A9000.00000004.00000800.00020000.00000000.sdmpWindows_Trojan_AgentTesla_d3ac2b2funknownunknown
        • 0x15b63d:$a13: get_DnsResolver
        • 0x191c5d:$a13: get_DnsResolver
        • 0x159d4a:$a20: get_LastAccessed
        • 0x19036a:$a20: get_LastAccessed
        • 0x15c06b:$a27: set_InternalServerPort
        • 0x19268b:$a27: set_InternalServerPort
        • 0x15c3a0:$a30: set_GuidMasterKey
        • 0x1929c0:$a30: set_GuidMasterKey
        • 0x159e5c:$a33: get_Clipboard
        • 0x19047c:$a33: get_Clipboard
        • 0x159e6a:$a34: get_Keyboard
        • 0x19048a:$a34: get_Keyboard
        • 0x15b237:$a35: get_ShiftKeyDown
        • 0x191857:$a35: get_ShiftKeyDown
        • 0x15b248:$a36: get_AltKeyDown
        • 0x191868:$a36: get_AltKeyDown
        • 0x159e77:$a37: get_Password
        • 0x190497:$a37: get_Password
        • 0x15a992:$a38: get_PasswordHash
        • 0x190fb2:$a38: get_PasswordHash
        • 0x15ba9f:$a39: get_DefaultCredentials
        00000012.00000002.520653491.00000000030C1000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
          Click to see the 28 entries
          SourceRuleDescriptionAuthorStrings
          3.0.shipping docs.exe.400000.0.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
            3.0.shipping docs.exe.400000.0.unpackJoeSecurity_AgentTesla_2Yara detected AgentTeslaJoe Security
              3.0.shipping docs.exe.400000.0.unpackMALWARE_Win_AgentTeslaV3AgentTeslaV3 infostealer payloadditekSHen
              • 0x34a4b:$s10: logins
              • 0x344c5:$s11: credential
              • 0x3072c:$g1: get_Clipboard
              • 0x3073a:$g2: get_Keyboard
              • 0x30747:$g3: get_Password
              • 0x31af7:$g4: get_CtrlKeyDown
              • 0x31b07:$g5: get_ShiftKeyDown
              • 0x31b18:$g6: get_AltKeyDown
              3.0.shipping docs.exe.400000.0.unpackWindows_Trojan_AgentTesla_d3ac2b2funknownunknown
              • 0x31f0d:$a13: get_DnsResolver
              • 0x3061a:$a20: get_LastAccessed
              • 0x3293b:$a27: set_InternalServerPort
              • 0x32c70:$a30: set_GuidMasterKey
              • 0x3072c:$a33: get_Clipboard
              • 0x3073a:$a34: get_Keyboard
              • 0x31b07:$a35: get_ShiftKeyDown
              • 0x31b18:$a36: get_AltKeyDown
              • 0x30747:$a37: get_Password
              • 0x31262:$a38: get_PasswordHash
              • 0x3236f:$a39: get_DefaultCredentials
              0.2.shipping docs.exe.35d2730.0.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
                Click to see the 7 entries

                Persistence and Installation Behavior

                bar