General

  • Target

    P-list - PO SO-203 1st Container.doc

  • Size

    309KB

  • Sample

    210127-te6pc8benx

  • MD5

    7c072f448b120f1535e8a5a893cd3fd9

  • SHA1

    ce9ff47e8638d97b1aff8813ef5e98e2fcf3c8e0

  • SHA256

    6736025e2259223612a583d30d083c61c9acb1d16ca02c9c75d67e3a8c5f2727

  • SHA512

    42fb14a7b598bae4572d28a65e22500b7e66f1e4b5e9e727bb1f229e3e923438c0250ea9087dc270fea692ea759f7345cd0ce4626c67852701b67dc220441c22

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    smtp.ionos.it
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    Blessings_2021

Targets

    • Target

      P-list - PO SO-203 1st Container.doc

    • Size

      309KB

    • MD5

      7c072f448b120f1535e8a5a893cd3fd9

    • SHA1

      ce9ff47e8638d97b1aff8813ef5e98e2fcf3c8e0

    • SHA256

      6736025e2259223612a583d30d083c61c9acb1d16ca02c9c75d67e3a8c5f2727

    • SHA512

      42fb14a7b598bae4572d28a65e22500b7e66f1e4b5e9e727bb1f229e3e923438c0250ea9087dc270fea692ea759f7345cd0ce4626c67852701b67dc220441c22

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • AgentTesla Payload

    • Blocklisted process makes network request

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Execution

Exploitation for Client Execution

1
T1203

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

3
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Collection

Data from Local System

3
T1005

Tasks