Resubmissions

14-01-2021 12:22

210114-hbc6lhwk3s 10

13-01-2021 09:27

210113-ptv2z41tta 8

General

  • Target

    BankSwiftCopyUSD95000.ppt

  • Size

    99KB

  • Sample

    210114-hbc6lhwk3s

  • MD5

    7f0b415d0b7a76530b2f510a910811e5

  • SHA1

    480594ad26c91dd9d719c80334285375540dc83e

  • SHA256

    8d3e1d1a1775191a33980069f500e37f22bdcd0a1ad3544ab4a9d0a651fbd019

  • SHA512

    d9b3320b51f390a6f75e7e3102044557e6476103c94ec4451819b78b4503f8018fee7ce8f70657473b310b14b752935fac2b7e5caaeb318e09a9af317701d8f4

Malware Config

Extracted

Family

agenttesla

C2

http://64.188.18.218/webpanel-st/inc/6295ae82aa2db6.php

Targets

    • Target

      BankSwiftCopyUSD95000.ppt

    • Size

      99KB

    • MD5

      7f0b415d0b7a76530b2f510a910811e5

    • SHA1

      480594ad26c91dd9d719c80334285375540dc83e

    • SHA256

      8d3e1d1a1775191a33980069f500e37f22bdcd0a1ad3544ab4a9d0a651fbd019

    • SHA512

      d9b3320b51f390a6f75e7e3102044557e6476103c94ec4451819b78b4503f8018fee7ce8f70657473b310b14b752935fac2b7e5caaeb318e09a9af317701d8f4

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • AgentTesla Payload

    • Blocklisted process makes network request

    • Drops file in Drivers directory

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Registry Run Keys / Startup Folder

1
T1060

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

2
T1112

Discovery

System Information Discovery

3
T1082

Query Registry

2
T1012

Remote System Discovery

1
T1018

Tasks