Analysis
-
max time kernel
108s -
max time network
75s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
26-01-2021 06:39
Static task
static1
Behavioral task
behavioral1
Sample
Purchase Order10.doc
Resource
win7v20201028
Behavioral task
behavioral2
Sample
Purchase Order10.doc
Resource
win10v20201028
General
-
Target
Purchase Order10.doc
-
Size
1.9MB
-
MD5
f31d2d6a7d01e211141333c3ec6d4cf4
-
SHA1
29f4e3692eda9a58d505203b2aa55590890d7c51
-
SHA256
d3dcf866f41cf696930dad4c6d1362e81b3d4d395dbd66761b6c7d882510fbac
-
SHA512
000611a7e89ade1fe643c41b628d4c679b9d75c9da4cd2fd2c00c47fdd7b379438e69b6e103cc6297c10ff72698f670458ccd8c6a890a799196f3b7aa2b96e5c
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
frostdell.uk - Port:
587 - Username:
[email protected] - Password:
7213575aceACE@#$
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 7 IoCs
Processes:
resource yara_rule behavioral1/memory/692-16-0x0000000000A40000-0x0000000000A9B000-memory.dmp family_agenttesla behavioral1/memory/2016-18-0x000000000043764E-mapping.dmp family_agenttesla behavioral1/memory/2016-17-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla behavioral1/memory/1784-22-0x000000000043764E-mapping.dmp family_agenttesla behavioral1/memory/1784-29-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla behavioral1/memory/1592-33-0x000000000043764E-mapping.dmp family_agenttesla behavioral1/memory/1384-38-0x000000000043764E-mapping.dmp family_agenttesla -
Blocklisted process makes network request 1 IoCs
Processes:
EQNEDT32.EXEflow pid process 5 1984 EQNEDT32.EXE -
Executes dropped EXE 6 IoCs
Processes:
liamhugox26631.scrliamhugox26631.scrliamhugox26631.scrliamhugox26631.scrliamhugox26631.scrliamhugox26631.scrpid process 692 liamhugox26631.scr 2016 liamhugox26631.scr 1784 liamhugox26631.scr 368 liamhugox26631.scr 1592 liamhugox26631.scr 1384 liamhugox26631.scr -
Loads dropped DLL 5 IoCs
Processes:
EQNEDT32.EXEWerFault.exepid process 1984 EQNEDT32.EXE 1984 EQNEDT32.EXE 896 WerFault.exe 896 WerFault.exe 896 WerFault.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 5 IoCs
Processes:
liamhugox26631.scrdescription pid process target process PID 692 set thread context of 2016 692 liamhugox26631.scr liamhugox26631.scr PID 692 set thread context of 1784 692 liamhugox26631.scr liamhugox26631.scr PID 692 set thread context of 368 692 liamhugox26631.scr liamhugox26631.scr PID 692 set thread context of 1592 692 liamhugox26631.scr liamhugox26631.scr PID 692 set thread context of 1384 692 liamhugox26631.scr liamhugox26631.scr -
Drops file in Windows directory 1 IoCs
Processes:
WINWORD.EXEdescription ioc process File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 896 692 WerFault.exe liamhugox26631.scr -
Office loads VBA resources, possible macro or embedded object present
-
Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
-
Processes:
WINWORD.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
WINWORD.EXEpid process 1932 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
liamhugox26631.scrliamhugox26631.scrWerFault.exepid process 692 liamhugox26631.scr 692 liamhugox26631.scr 1384 liamhugox26631.scr 1384 liamhugox26631.scr 896 WerFault.exe 896 WerFault.exe 896 WerFault.exe 896 WerFault.exe 896 WerFault.exe 896 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
liamhugox26631.scrliamhugox26631.scrWerFault.exedescription pid process Token: SeDebugPrivilege 692 liamhugox26631.scr Token: SeDebugPrivilege 1384 liamhugox26631.scr Token: SeDebugPrivilege 896 WerFault.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
WINWORD.EXEliamhugox26631.scrpid process 1932 WINWORD.EXE 1932 WINWORD.EXE 1384 liamhugox26631.scr -
Suspicious use of WriteProcessMemory 49 IoCs
Processes:
EQNEDT32.EXEliamhugox26631.scrdescription pid process target process PID 1984 wrote to memory of 692 1984 EQNEDT32.EXE liamhugox26631.scr PID 1984 wrote to memory of 692 1984 EQNEDT32.EXE liamhugox26631.scr PID 1984 wrote to memory of 692 1984 EQNEDT32.EXE liamhugox26631.scr PID 1984 wrote to memory of 692 1984 EQNEDT32.EXE liamhugox26631.scr PID 692 wrote to memory of 2016 692 liamhugox26631.scr liamhugox26631.scr PID 692 wrote to memory of 2016 692 liamhugox26631.scr liamhugox26631.scr PID 692 wrote to memory of 2016 692 liamhugox26631.scr liamhugox26631.scr PID 692 wrote to memory of 2016 692 liamhugox26631.scr liamhugox26631.scr PID 692 wrote to memory of 2016 692 liamhugox26631.scr liamhugox26631.scr PID 692 wrote to memory of 2016 692 liamhugox26631.scr liamhugox26631.scr PID 692 wrote to memory of 2016 692 liamhugox26631.scr liamhugox26631.scr PID 692 wrote to memory of 2016 692 liamhugox26631.scr liamhugox26631.scr PID 692 wrote to memory of 2016 692 liamhugox26631.scr liamhugox26631.scr PID 692 wrote to memory of 1784 692 liamhugox26631.scr liamhugox26631.scr PID 692 wrote to memory of 1784 692 liamhugox26631.scr liamhugox26631.scr PID 692 wrote to memory of 1784 692 liamhugox26631.scr liamhugox26631.scr PID 692 wrote to memory of 1784 692 liamhugox26631.scr liamhugox26631.scr PID 692 wrote to memory of 1784 692 liamhugox26631.scr liamhugox26631.scr PID 692 wrote to memory of 1784 692 liamhugox26631.scr liamhugox26631.scr PID 692 wrote to memory of 1784 692 liamhugox26631.scr liamhugox26631.scr PID 692 wrote to memory of 1784 692 liamhugox26631.scr liamhugox26631.scr PID 692 wrote to memory of 1784 692 liamhugox26631.scr liamhugox26631.scr PID 692 wrote to memory of 368 692 liamhugox26631.scr liamhugox26631.scr PID 692 wrote to memory of 368 692 liamhugox26631.scr liamhugox26631.scr PID 692 wrote to memory of 368 692 liamhugox26631.scr liamhugox26631.scr PID 692 wrote to memory of 368 692 liamhugox26631.scr liamhugox26631.scr PID 692 wrote to memory of 368 692 liamhugox26631.scr liamhugox26631.scr PID 692 wrote to memory of 1592 692 liamhugox26631.scr liamhugox26631.scr PID 692 wrote to memory of 1592 692 liamhugox26631.scr liamhugox26631.scr PID 692 wrote to memory of 1592 692 liamhugox26631.scr liamhugox26631.scr PID 692 wrote to memory of 1592 692 liamhugox26631.scr liamhugox26631.scr PID 692 wrote to memory of 1592 692 liamhugox26631.scr liamhugox26631.scr PID 692 wrote to memory of 1592 692 liamhugox26631.scr liamhugox26631.scr PID 692 wrote to memory of 1592 692 liamhugox26631.scr liamhugox26631.scr PID 692 wrote to memory of 1592 692 liamhugox26631.scr liamhugox26631.scr PID 692 wrote to memory of 1592 692 liamhugox26631.scr liamhugox26631.scr PID 692 wrote to memory of 1384 692 liamhugox26631.scr liamhugox26631.scr PID 692 wrote to memory of 1384 692 liamhugox26631.scr liamhugox26631.scr PID 692 wrote to memory of 1384 692 liamhugox26631.scr liamhugox26631.scr PID 692 wrote to memory of 1384 692 liamhugox26631.scr liamhugox26631.scr PID 692 wrote to memory of 1384 692 liamhugox26631.scr liamhugox26631.scr PID 692 wrote to memory of 1384 692 liamhugox26631.scr liamhugox26631.scr PID 692 wrote to memory of 1384 692 liamhugox26631.scr liamhugox26631.scr PID 692 wrote to memory of 1384 692 liamhugox26631.scr liamhugox26631.scr PID 692 wrote to memory of 1384 692 liamhugox26631.scr liamhugox26631.scr PID 692 wrote to memory of 896 692 liamhugox26631.scr WerFault.exe PID 692 wrote to memory of 896 692 liamhugox26631.scr WerFault.exe PID 692 wrote to memory of 896 692 liamhugox26631.scr WerFault.exe PID 692 wrote to memory of 896 692 liamhugox26631.scr WerFault.exe
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Purchase Order10.doc"1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\liamhugox26631.scr"C:\Users\Admin\AppData\Roaming\liamhugox26631.scr"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\liamhugox26631.scr"C:\Users\Admin\AppData\Roaming\liamhugox26631.scr"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\liamhugox26631.scr"C:\Users\Admin\AppData\Roaming\liamhugox26631.scr"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\liamhugox26631.scr"C:\Users\Admin\AppData\Roaming\liamhugox26631.scr"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\liamhugox26631.scr"C:\Users\Admin\AppData\Roaming\liamhugox26631.scr"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\liamhugox26631.scr"C:\Users\Admin\AppData\Roaming\liamhugox26631.scr"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 692 -s 9843⤵
- Loads dropped DLL
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\liamhugox26631.scrMD5
bf36c3069116a3da50f1064adfdd155a
SHA1cbb6f81f80e270ca89059eb96aab393f7b513044
SHA2565d555eddfc23183dd821432fd2a4a04a543c8c1907b636440eb6e7d21829576c
SHA5128c557a6943de45b1405405dea568a726eaf6f7b4874b0b93efaba467f3454bf68f674bb52d2c5e69fafdf3b530bcdc57cfc53c3443f6f95b8b561508c84a81bc
-
C:\Users\Admin\AppData\Roaming\liamhugox26631.scrMD5
bf36c3069116a3da50f1064adfdd155a
SHA1cbb6f81f80e270ca89059eb96aab393f7b513044
SHA2565d555eddfc23183dd821432fd2a4a04a543c8c1907b636440eb6e7d21829576c
SHA5128c557a6943de45b1405405dea568a726eaf6f7b4874b0b93efaba467f3454bf68f674bb52d2c5e69fafdf3b530bcdc57cfc53c3443f6f95b8b561508c84a81bc
-
C:\Users\Admin\AppData\Roaming\liamhugox26631.scrMD5
bf36c3069116a3da50f1064adfdd155a
SHA1cbb6f81f80e270ca89059eb96aab393f7b513044
SHA2565d555eddfc23183dd821432fd2a4a04a543c8c1907b636440eb6e7d21829576c
SHA5128c557a6943de45b1405405dea568a726eaf6f7b4874b0b93efaba467f3454bf68f674bb52d2c5e69fafdf3b530bcdc57cfc53c3443f6f95b8b561508c84a81bc
-
C:\Users\Admin\AppData\Roaming\liamhugox26631.scrMD5
bf36c3069116a3da50f1064adfdd155a
SHA1cbb6f81f80e270ca89059eb96aab393f7b513044
SHA2565d555eddfc23183dd821432fd2a4a04a543c8c1907b636440eb6e7d21829576c
SHA5128c557a6943de45b1405405dea568a726eaf6f7b4874b0b93efaba467f3454bf68f674bb52d2c5e69fafdf3b530bcdc57cfc53c3443f6f95b8b561508c84a81bc
-
C:\Users\Admin\AppData\Roaming\liamhugox26631.scrMD5
bf36c3069116a3da50f1064adfdd155a
SHA1cbb6f81f80e270ca89059eb96aab393f7b513044
SHA2565d555eddfc23183dd821432fd2a4a04a543c8c1907b636440eb6e7d21829576c
SHA5128c557a6943de45b1405405dea568a726eaf6f7b4874b0b93efaba467f3454bf68f674bb52d2c5e69fafdf3b530bcdc57cfc53c3443f6f95b8b561508c84a81bc
-
C:\Users\Admin\AppData\Roaming\liamhugox26631.scrMD5
bf36c3069116a3da50f1064adfdd155a
SHA1cbb6f81f80e270ca89059eb96aab393f7b513044
SHA2565d555eddfc23183dd821432fd2a4a04a543c8c1907b636440eb6e7d21829576c
SHA5128c557a6943de45b1405405dea568a726eaf6f7b4874b0b93efaba467f3454bf68f674bb52d2c5e69fafdf3b530bcdc57cfc53c3443f6f95b8b561508c84a81bc
-
C:\Users\Admin\AppData\Roaming\liamhugox26631.scrMD5
bf36c3069116a3da50f1064adfdd155a
SHA1cbb6f81f80e270ca89059eb96aab393f7b513044
SHA2565d555eddfc23183dd821432fd2a4a04a543c8c1907b636440eb6e7d21829576c
SHA5128c557a6943de45b1405405dea568a726eaf6f7b4874b0b93efaba467f3454bf68f674bb52d2c5e69fafdf3b530bcdc57cfc53c3443f6f95b8b561508c84a81bc
-
\Users\Admin\AppData\Roaming\liamhugox26631.scrMD5
bf36c3069116a3da50f1064adfdd155a
SHA1cbb6f81f80e270ca89059eb96aab393f7b513044
SHA2565d555eddfc23183dd821432fd2a4a04a543c8c1907b636440eb6e7d21829576c
SHA5128c557a6943de45b1405405dea568a726eaf6f7b4874b0b93efaba467f3454bf68f674bb52d2c5e69fafdf3b530bcdc57cfc53c3443f6f95b8b561508c84a81bc
-
\Users\Admin\AppData\Roaming\liamhugox26631.scrMD5
bf36c3069116a3da50f1064adfdd155a
SHA1cbb6f81f80e270ca89059eb96aab393f7b513044
SHA2565d555eddfc23183dd821432fd2a4a04a543c8c1907b636440eb6e7d21829576c
SHA5128c557a6943de45b1405405dea568a726eaf6f7b4874b0b93efaba467f3454bf68f674bb52d2c5e69fafdf3b530bcdc57cfc53c3443f6f95b8b561508c84a81bc
-
\Users\Admin\AppData\Roaming\liamhugox26631.scrMD5
bf36c3069116a3da50f1064adfdd155a
SHA1cbb6f81f80e270ca89059eb96aab393f7b513044
SHA2565d555eddfc23183dd821432fd2a4a04a543c8c1907b636440eb6e7d21829576c
SHA5128c557a6943de45b1405405dea568a726eaf6f7b4874b0b93efaba467f3454bf68f674bb52d2c5e69fafdf3b530bcdc57cfc53c3443f6f95b8b561508c84a81bc
-
\Users\Admin\AppData\Roaming\liamhugox26631.scrMD5
bf36c3069116a3da50f1064adfdd155a
SHA1cbb6f81f80e270ca89059eb96aab393f7b513044
SHA2565d555eddfc23183dd821432fd2a4a04a543c8c1907b636440eb6e7d21829576c
SHA5128c557a6943de45b1405405dea568a726eaf6f7b4874b0b93efaba467f3454bf68f674bb52d2c5e69fafdf3b530bcdc57cfc53c3443f6f95b8b561508c84a81bc
-
\Users\Admin\AppData\Roaming\liamhugox26631.scrMD5
bf36c3069116a3da50f1064adfdd155a
SHA1cbb6f81f80e270ca89059eb96aab393f7b513044
SHA2565d555eddfc23183dd821432fd2a4a04a543c8c1907b636440eb6e7d21829576c
SHA5128c557a6943de45b1405405dea568a726eaf6f7b4874b0b93efaba467f3454bf68f674bb52d2c5e69fafdf3b530bcdc57cfc53c3443f6f95b8b561508c84a81bc
-
memory/368-25-0x000000000043764E-mapping.dmp
-
memory/692-12-0x000000006AB50000-0x000000006B23E000-memory.dmpFilesize
6.9MB
-
memory/692-16-0x0000000000A40000-0x0000000000A9B000-memory.dmpFilesize
364KB
-
memory/692-15-0x0000000000AA0000-0x0000000000AA1000-memory.dmpFilesize
4KB
-
memory/692-13-0x0000000001050000-0x0000000001051000-memory.dmpFilesize
4KB
-
memory/692-34-0x00000000009B0000-0x00000000009B1000-memory.dmpFilesize
4KB
-
memory/692-9-0x0000000000000000-mapping.dmp
-
memory/896-54-0x0000000000910000-0x0000000000911000-memory.dmpFilesize
4KB
-
memory/896-45-0x0000000000B70000-0x0000000000B81000-memory.dmpFilesize
68KB
-
memory/896-41-0x0000000000000000-mapping.dmp
-
memory/1384-40-0x000000006AB50000-0x000000006B23E000-memory.dmpFilesize
6.9MB
-
memory/1384-55-0x0000000000FD1000-0x0000000000FD2000-memory.dmpFilesize
4KB
-
memory/1384-38-0x000000000043764E-mapping.dmp
-
memory/1384-51-0x0000000000FD0000-0x0000000000FD1000-memory.dmpFilesize
4KB
-
memory/1592-33-0x000000000043764E-mapping.dmp
-
memory/1592-36-0x000000006AB50000-0x000000006B23E000-memory.dmpFilesize
6.9MB
-
memory/1592-50-0x0000000000C50000-0x0000000000C51000-memory.dmpFilesize
4KB
-
memory/1784-29-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1784-26-0x000000006AB50000-0x000000006B23E000-memory.dmpFilesize
6.9MB
-
memory/1784-49-0x0000000004930000-0x0000000004931000-memory.dmpFilesize
4KB
-
memory/1784-22-0x000000000043764E-mapping.dmp
-
memory/1788-6-0x000007FEF6E90000-0x000007FEF710A000-memory.dmpFilesize
2.5MB
-
memory/1932-2-0x0000000071EA1000-0x0000000071EA4000-memory.dmpFilesize
12KB
-
memory/1932-4-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1932-3-0x000000006F921000-0x000000006F923000-memory.dmpFilesize
8KB
-
memory/1984-5-0x00000000750C1000-0x00000000750C3000-memory.dmpFilesize
8KB
-
memory/2016-52-0x0000000000A10000-0x0000000000A11000-memory.dmpFilesize
4KB
-
memory/2016-18-0x000000000043764E-mapping.dmp
-
memory/2016-21-0x000000006AB50000-0x000000006B23E000-memory.dmpFilesize
6.9MB
-
memory/2016-17-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB