Analysis
-
max time kernel
131s -
max time network
119s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
20-01-2021 13:41
Static task
static1
Behavioral task
behavioral1
Sample
New Order Feb.,2021.doc
Resource
win7v20201028
Behavioral task
behavioral2
Sample
New Order Feb.,2021.doc
Resource
win10v20201028
General
-
Target
New Order Feb.,2021.doc
-
Size
1.8MB
-
MD5
f30d17390cd27063579259031b15aff2
-
SHA1
0ad2253fcc50922c81af9872eac8bd8fd73ddd1b
-
SHA256
438df5a980d0c5d2da217708f647eca7b16e6d9d9f474aca3d0c6d562bcaf06f
-
SHA512
f9158abb34bd7f18933c3de2c6e88646a0ea9d40fda6a03f7dbc3cd2341c3cbf8ce1dbf8f9eb2940ef4a30b13adb2ae9d4e9eff6bf61eee6108f9115b251e45a
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
polar.argondns.net - Port:
587 - Username:
bretandmix@temsad.com - Password:
]4&w8LUz9*LT
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 7 IoCs
Processes:
resource yara_rule behavioral1/memory/820-16-0x0000000005040000-0x000000000509B000-memory.dmp family_agenttesla behavioral1/memory/1660-17-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla behavioral1/memory/1660-18-0x000000000043734E-mapping.dmp family_agenttesla behavioral1/memory/1776-22-0x000000000043734E-mapping.dmp family_agenttesla behavioral1/memory/1660-26-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla behavioral1/memory/1964-27-0x000000000043734E-mapping.dmp family_agenttesla behavioral1/memory/1888-34-0x000000000043734E-mapping.dmp family_agenttesla -
Blocklisted process makes network request 1 IoCs
Processes:
EQNEDT32.EXEflow pid process 5 1180 EQNEDT32.EXE -
Executes dropped EXE 6 IoCs
Processes:
haitian87424.scrhaitian87424.scrhaitian87424.scrhaitian87424.scrhaitian87424.scrhaitian87424.scrpid process 820 haitian87424.scr 1660 haitian87424.scr 1776 haitian87424.scr 1964 haitian87424.scr 1888 haitian87424.scr 1476 haitian87424.scr -
Loads dropped DLL 2 IoCs
Processes:
EQNEDT32.EXEpid process 1180 EQNEDT32.EXE 1180 EQNEDT32.EXE -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 11 IoCs
Processes:
haitian87424.scrpid process 820 haitian87424.scr 820 haitian87424.scr 820 haitian87424.scr 820 haitian87424.scr 820 haitian87424.scr 820 haitian87424.scr 820 haitian87424.scr 820 haitian87424.scr 820 haitian87424.scr 820 haitian87424.scr 820 haitian87424.scr -
Suspicious use of SetThreadContext 5 IoCs
Processes:
haitian87424.scrdescription pid process target process PID 820 set thread context of 1660 820 haitian87424.scr haitian87424.scr PID 820 set thread context of 1776 820 haitian87424.scr haitian87424.scr PID 820 set thread context of 1964 820 haitian87424.scr haitian87424.scr PID 820 set thread context of 1888 820 haitian87424.scr haitian87424.scr PID 820 set thread context of 1476 820 haitian87424.scr haitian87424.scr -
Drops file in Windows directory 1 IoCs
Processes:
WINWORD.EXEdescription ioc process File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE -
Office loads VBA resources, possible macro or embedded object present
-
Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
-
Processes:
WINWORD.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
WINWORD.EXEpid process 1732 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
haitian87424.scrhaitian87424.scrpid process 820 haitian87424.scr 1964 haitian87424.scr 1964 haitian87424.scr -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
haitian87424.scrhaitian87424.scrdescription pid process Token: SeDebugPrivilege 820 haitian87424.scr Token: SeDebugPrivilege 1964 haitian87424.scr -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
WINWORD.EXEpid process 1732 WINWORD.EXE 1732 WINWORD.EXE -
Suspicious use of WriteProcessMemory 49 IoCs
Processes:
EQNEDT32.EXEhaitian87424.scrdescription pid process target process PID 1180 wrote to memory of 820 1180 EQNEDT32.EXE haitian87424.scr PID 1180 wrote to memory of 820 1180 EQNEDT32.EXE haitian87424.scr PID 1180 wrote to memory of 820 1180 EQNEDT32.EXE haitian87424.scr PID 1180 wrote to memory of 820 1180 EQNEDT32.EXE haitian87424.scr PID 820 wrote to memory of 1660 820 haitian87424.scr haitian87424.scr PID 820 wrote to memory of 1660 820 haitian87424.scr haitian87424.scr PID 820 wrote to memory of 1660 820 haitian87424.scr haitian87424.scr PID 820 wrote to memory of 1660 820 haitian87424.scr haitian87424.scr PID 820 wrote to memory of 1660 820 haitian87424.scr haitian87424.scr PID 820 wrote to memory of 1660 820 haitian87424.scr haitian87424.scr PID 820 wrote to memory of 1660 820 haitian87424.scr haitian87424.scr PID 820 wrote to memory of 1660 820 haitian87424.scr haitian87424.scr PID 820 wrote to memory of 1660 820 haitian87424.scr haitian87424.scr PID 820 wrote to memory of 1776 820 haitian87424.scr haitian87424.scr PID 820 wrote to memory of 1776 820 haitian87424.scr haitian87424.scr PID 820 wrote to memory of 1776 820 haitian87424.scr haitian87424.scr PID 820 wrote to memory of 1776 820 haitian87424.scr haitian87424.scr PID 820 wrote to memory of 1776 820 haitian87424.scr haitian87424.scr PID 820 wrote to memory of 1776 820 haitian87424.scr haitian87424.scr PID 820 wrote to memory of 1776 820 haitian87424.scr haitian87424.scr PID 820 wrote to memory of 1776 820 haitian87424.scr haitian87424.scr PID 820 wrote to memory of 1776 820 haitian87424.scr haitian87424.scr PID 820 wrote to memory of 1964 820 haitian87424.scr haitian87424.scr PID 820 wrote to memory of 1964 820 haitian87424.scr haitian87424.scr PID 820 wrote to memory of 1964 820 haitian87424.scr haitian87424.scr PID 820 wrote to memory of 1964 820 haitian87424.scr haitian87424.scr PID 820 wrote to memory of 1964 820 haitian87424.scr haitian87424.scr PID 820 wrote to memory of 1964 820 haitian87424.scr haitian87424.scr PID 820 wrote to memory of 1964 820 haitian87424.scr haitian87424.scr PID 820 wrote to memory of 1964 820 haitian87424.scr haitian87424.scr PID 820 wrote to memory of 1964 820 haitian87424.scr haitian87424.scr PID 820 wrote to memory of 1888 820 haitian87424.scr haitian87424.scr PID 820 wrote to memory of 1888 820 haitian87424.scr haitian87424.scr PID 820 wrote to memory of 1888 820 haitian87424.scr haitian87424.scr PID 820 wrote to memory of 1888 820 haitian87424.scr haitian87424.scr PID 820 wrote to memory of 1888 820 haitian87424.scr haitian87424.scr PID 820 wrote to memory of 1888 820 haitian87424.scr haitian87424.scr PID 820 wrote to memory of 1888 820 haitian87424.scr haitian87424.scr PID 820 wrote to memory of 1888 820 haitian87424.scr haitian87424.scr PID 820 wrote to memory of 1888 820 haitian87424.scr haitian87424.scr PID 820 wrote to memory of 1476 820 haitian87424.scr haitian87424.scr PID 820 wrote to memory of 1476 820 haitian87424.scr haitian87424.scr PID 820 wrote to memory of 1476 820 haitian87424.scr haitian87424.scr PID 820 wrote to memory of 1476 820 haitian87424.scr haitian87424.scr PID 820 wrote to memory of 1476 820 haitian87424.scr haitian87424.scr PID 820 wrote to memory of 1476 820 haitian87424.scr haitian87424.scr PID 820 wrote to memory of 1476 820 haitian87424.scr haitian87424.scr PID 820 wrote to memory of 1476 820 haitian87424.scr haitian87424.scr PID 820 wrote to memory of 1476 820 haitian87424.scr haitian87424.scr
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\New Order Feb.,2021.doc"1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\haitian87424.scr"C:\Users\Admin\AppData\Roaming\haitian87424.scr"2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\haitian87424.scr"C:\Users\Admin\AppData\Roaming\haitian87424.scr"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\haitian87424.scr"C:\Users\Admin\AppData\Roaming\haitian87424.scr"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\haitian87424.scr"C:\Users\Admin\AppData\Roaming\haitian87424.scr"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\haitian87424.scr"C:\Users\Admin\AppData\Roaming\haitian87424.scr"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\haitian87424.scr"C:\Users\Admin\AppData\Roaming\haitian87424.scr"3⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\haitian87424.scrMD5
2d41b253cc57abc79ed7c87ea2d67448
SHA1891ffd575f3a96948a01bbb2b90dbcd44bbf336f
SHA256bb1192a107d1e081776f6c0943f70eaed21d71f4b748df45891dad1a4d13008a
SHA5124108a2cb78fbdeccfd41a9250b32dbbdd9e76951bb18149f56b7b9dfeea4e1b11094490364c917ae52816d7f7d9b300f50e605ccf71c3fa62e01b27894ae5924
-
C:\Users\Admin\AppData\Roaming\haitian87424.scrMD5
2d41b253cc57abc79ed7c87ea2d67448
SHA1891ffd575f3a96948a01bbb2b90dbcd44bbf336f
SHA256bb1192a107d1e081776f6c0943f70eaed21d71f4b748df45891dad1a4d13008a
SHA5124108a2cb78fbdeccfd41a9250b32dbbdd9e76951bb18149f56b7b9dfeea4e1b11094490364c917ae52816d7f7d9b300f50e605ccf71c3fa62e01b27894ae5924
-
C:\Users\Admin\AppData\Roaming\haitian87424.scrMD5
2d41b253cc57abc79ed7c87ea2d67448
SHA1891ffd575f3a96948a01bbb2b90dbcd44bbf336f
SHA256bb1192a107d1e081776f6c0943f70eaed21d71f4b748df45891dad1a4d13008a
SHA5124108a2cb78fbdeccfd41a9250b32dbbdd9e76951bb18149f56b7b9dfeea4e1b11094490364c917ae52816d7f7d9b300f50e605ccf71c3fa62e01b27894ae5924
-
C:\Users\Admin\AppData\Roaming\haitian87424.scrMD5
2d41b253cc57abc79ed7c87ea2d67448
SHA1891ffd575f3a96948a01bbb2b90dbcd44bbf336f
SHA256bb1192a107d1e081776f6c0943f70eaed21d71f4b748df45891dad1a4d13008a
SHA5124108a2cb78fbdeccfd41a9250b32dbbdd9e76951bb18149f56b7b9dfeea4e1b11094490364c917ae52816d7f7d9b300f50e605ccf71c3fa62e01b27894ae5924
-
C:\Users\Admin\AppData\Roaming\haitian87424.scrMD5
2d41b253cc57abc79ed7c87ea2d67448
SHA1891ffd575f3a96948a01bbb2b90dbcd44bbf336f
SHA256bb1192a107d1e081776f6c0943f70eaed21d71f4b748df45891dad1a4d13008a
SHA5124108a2cb78fbdeccfd41a9250b32dbbdd9e76951bb18149f56b7b9dfeea4e1b11094490364c917ae52816d7f7d9b300f50e605ccf71c3fa62e01b27894ae5924
-
C:\Users\Admin\AppData\Roaming\haitian87424.scrMD5
2d41b253cc57abc79ed7c87ea2d67448
SHA1891ffd575f3a96948a01bbb2b90dbcd44bbf336f
SHA256bb1192a107d1e081776f6c0943f70eaed21d71f4b748df45891dad1a4d13008a
SHA5124108a2cb78fbdeccfd41a9250b32dbbdd9e76951bb18149f56b7b9dfeea4e1b11094490364c917ae52816d7f7d9b300f50e605ccf71c3fa62e01b27894ae5924
-
C:\Users\Admin\AppData\Roaming\haitian87424.scrMD5
2d41b253cc57abc79ed7c87ea2d67448
SHA1891ffd575f3a96948a01bbb2b90dbcd44bbf336f
SHA256bb1192a107d1e081776f6c0943f70eaed21d71f4b748df45891dad1a4d13008a
SHA5124108a2cb78fbdeccfd41a9250b32dbbdd9e76951bb18149f56b7b9dfeea4e1b11094490364c917ae52816d7f7d9b300f50e605ccf71c3fa62e01b27894ae5924
-
\Users\Admin\AppData\Roaming\haitian87424.scrMD5
2d41b253cc57abc79ed7c87ea2d67448
SHA1891ffd575f3a96948a01bbb2b90dbcd44bbf336f
SHA256bb1192a107d1e081776f6c0943f70eaed21d71f4b748df45891dad1a4d13008a
SHA5124108a2cb78fbdeccfd41a9250b32dbbdd9e76951bb18149f56b7b9dfeea4e1b11094490364c917ae52816d7f7d9b300f50e605ccf71c3fa62e01b27894ae5924
-
\Users\Admin\AppData\Roaming\haitian87424.scrMD5
2d41b253cc57abc79ed7c87ea2d67448
SHA1891ffd575f3a96948a01bbb2b90dbcd44bbf336f
SHA256bb1192a107d1e081776f6c0943f70eaed21d71f4b748df45891dad1a4d13008a
SHA5124108a2cb78fbdeccfd41a9250b32dbbdd9e76951bb18149f56b7b9dfeea4e1b11094490364c917ae52816d7f7d9b300f50e605ccf71c3fa62e01b27894ae5924
-
memory/820-9-0x0000000000000000-mapping.dmp
-
memory/820-13-0x0000000000C70000-0x0000000000C71000-memory.dmpFilesize
4KB
-
memory/820-15-0x0000000004710000-0x0000000004711000-memory.dmpFilesize
4KB
-
memory/820-16-0x0000000005040000-0x000000000509B000-memory.dmpFilesize
364KB
-
memory/820-12-0x000000006B480000-0x000000006BB6E000-memory.dmpFilesize
6.9MB
-
memory/820-33-0x0000000000430000-0x0000000000431000-memory.dmpFilesize
4KB
-
memory/1180-5-0x0000000075AE1000-0x0000000075AE3000-memory.dmpFilesize
8KB
-
memory/1476-43-0x000000006B480000-0x000000006BB6E000-memory.dmpFilesize
6.9MB
-
memory/1476-41-0x000000000043734E-mapping.dmp
-
memory/1660-17-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1660-26-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1660-45-0x0000000004A00000-0x0000000004A01000-memory.dmpFilesize
4KB
-
memory/1660-18-0x000000000043734E-mapping.dmp
-
memory/1660-21-0x000000006B480000-0x000000006BB6E000-memory.dmpFilesize
6.9MB
-
memory/1732-4-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1732-3-0x0000000070391000-0x0000000070393000-memory.dmpFilesize
8KB
-
memory/1732-2-0x0000000072911000-0x0000000072914000-memory.dmpFilesize
12KB
-
memory/1776-22-0x000000000043734E-mapping.dmp
-
memory/1776-25-0x000000006B480000-0x000000006BB6E000-memory.dmpFilesize
6.9MB
-
memory/1888-34-0x000000000043734E-mapping.dmp
-
memory/1888-38-0x000000006B480000-0x000000006BB6E000-memory.dmpFilesize
6.9MB
-
memory/1964-30-0x000000006B480000-0x000000006BB6E000-memory.dmpFilesize
6.9MB
-
memory/1964-27-0x000000000043734E-mapping.dmp
-
memory/1964-44-0x0000000004390000-0x0000000004391000-memory.dmpFilesize
4KB
-
memory/1964-46-0x0000000004391000-0x0000000004392000-memory.dmpFilesize
4KB
-
memory/2040-6-0x000007FEF6400000-0x000007FEF667A000-memory.dmpFilesize
2.5MB