agenttesla | d897f9f36f09b0e3618b0ed8387a4e7e45a0c154959f4d5cb9b8d8cb136892a5

General

Target

DAIMON SWIFT 25-02-2021 -.doc
Size

740KB
MD5

f556e94a8fe233d397c37c1bd65eca78
SHA1

784969f871b49ae0ff3ad76dc331950bdbbd39bc
SHA256

d897f9f36f09b0e3618b0ed8387a4e7e45a0c154959f4d5cb9b8d8cb136892a5
SHA512

761c019df1f1e1f038018eb1538e1e21c2daca7c283e6a4e13c0103903bf3533202c66a2b61647a559fdaa6bfd6eaec7e7ac640d41e35c61d77252fda93867f5

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.microhydrotechnic.co.in
Port:
587
Username:
[email protected]
Password:
saibaba@1974

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1444-21-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1444-22-0x00000000004374BE-mapping.dmp	family_agenttesla
behavioral1/memory/1444-25-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Blocklisted process makes network request 3 IoCs

Processes:

EQNEDT32.EXE

flow pid process

6 1808 EQNEDT32.EXE
8 1808 EQNEDT32.EXE
10 1808 EQNEDT32.EXE
Executes dropped EXE 2 IoCs

Processes:

69577.exe69577.exe

pid process

916 69577.exe
1444 69577.exe
Loads dropped DLL 1 IoCs

Processes:

EQNEDT32.EXE

pid process

1808 EQNEDT32.EXE
Suspicious use of SetThreadContext 1 IoCs

Processes:

69577.exe

description pid process target process

PID 916 set thread context of 1444 916 69577.exe 69577.exe
Drops file in Windows directory 1 IoCs

Processes:

WINWORD.EXE

description ioc process

File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Office loads VBA resources, possible macro or embedded object present
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1196 schtasks.exe
Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
exploit

Exploitation for Client Execution
T1203

Processes:

EQNEDT32.EXE

pid process

1808 EQNEDT32.EXE

flow	pid	process
6	1808	EQNEDT32.EXE
8	1808	EQNEDT32.EXE
10	1808	EQNEDT32.EXE

pid	process
916	69577.exe
1444	69577.exe

pid	process
1808	EQNEDT32.EXE

description	pid	process	target process
PID 916 set thread context of 1444	916	69577.exe	69577.exe

description	ioc	process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE

pid	process
1196	schtasks.exe

pid	process
1808	EQNEDT32.EXE

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

Processes:

WINWORD.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

1944 WINWORD.EXE
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

69577.exe

pid process

1444 69577.exe
1444 69577.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

69577.exe69577.exe

description pid process

Token: SeDebugPrivilege 916 69577.exe
Token: SeDebugPrivilege 1444 69577.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

WINWORD.EXE

pid process

1944 WINWORD.EXE
1944 WINWORD.EXE

pid	process
1944	WINWORD.EXE

pid	process
1444	69577.exe
1444	69577.exe

description	pid	process
Token: SeDebugPrivilege	916	69577.exe
Token: SeDebugPrivilege	1444	69577.exe

pid	process
1944	WINWORD.EXE
1944	WINWORD.EXE

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

WINWORD.EXEEQNEDT32.EXE69577.exe

description	pid	process	target process
PID 1944 wrote to memory of 2004	1944	WINWORD.EXE	splwow64.exe
PID 1944 wrote to memory of 2004	1944	WINWORD.EXE	splwow64.exe
PID 1944 wrote to memory of 2004	1944	WINWORD.EXE	splwow64.exe
PID 1944 wrote to memory of 2004	1944	WINWORD.EXE	splwow64.exe
PID 1808 wrote to memory of 916	1808	EQNEDT32.EXE	69577.exe
PID 1808 wrote to memory of 916	1808	EQNEDT32.EXE	69577.exe
PID 1808 wrote to memory of 916	1808	EQNEDT32.EXE	69577.exe
PID 1808 wrote to memory of 916	1808	EQNEDT32.EXE	69577.exe
PID 916 wrote to memory of 1196	916	69577.exe	schtasks.exe
PID 916 wrote to memory of 1196	916	69577.exe	schtasks.exe
PID 916 wrote to memory of 1196	916	69577.exe	schtasks.exe
PID 916 wrote to memory of 1196	916	69577.exe	schtasks.exe
PID 916 wrote to memory of 1444	916	69577.exe	69577.exe
PID 916 wrote to memory of 1444	916	69577.exe	69577.exe
PID 916 wrote to memory of 1444	916	69577.exe	69577.exe
PID 916 wrote to memory of 1444	916	69577.exe	69577.exe
PID 916 wrote to memory of 1444	916	69577.exe	69577.exe
PID 916 wrote to memory of 1444	916	69577.exe	69577.exe
PID 916 wrote to memory of 1444	916	69577.exe	69577.exe
PID 916 wrote to memory of 1444	916	69577.exe	69577.exe
PID 916 wrote to memory of 1444	916	69577.exe	69577.exe

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\DAIMON SWIFT 25-02-2021 -.doc"
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1944

C:\Windows\splwow64.exe
C:\Windows\splwow64.exe 12288
2⤵
PID:2004

C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
PID:1808

C:\Users\Public\69577.exe
"C:\Users\Public\69577.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:916

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ATnEOHuleKEd" /XML "C:\Users\Admin\AppData\Local\Temp\tmpEC52.tmp"
3⤵
- Creates scheduled task(s)
PID:1196

C:\Users\Public\69577.exe
"{path}"
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1444

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Exploitation for Client Execution

Scheduled Task

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpEC52.tmp
MD5
c7d114f416d3da9b8596c53f5c9ea4af

SHA1
f597d7adffa27c45e253bc199177406b3a1b3314

SHA256
68cfc241437ba6eeb97beb3c5ab11cd8713097e6f8e87f16b51177d5dc9ccedb

SHA512
33e448ff3472257fdbd02fd6516c8aa800b37502df0b464f7796138d6cfdfef6d934816c319f0353854bdd5268623647ae07511397c5ba44ea947df83d23e7c1

Download Submit
C:\Users\Public\69577.exe
MD5
e87fd305545cf2e642fee18b57bb5252

SHA1
56fb770cfd829873cd4e45941969335ff98ad0ef

SHA256
655f621c3d3f6a7da99b1c332ab6dc1d4d9aae9cdef583360c480de982884513

SHA512
fb12f831515aefe3c39c60a8ec9f96febbef5a31c2013e36337ec31191bcebd92e62410d8618ce62860ebfbfd986120624340c5e00d01041afb103a44ef274a2

Download Submit
C:\Users\Public\69577.exe
MD5
e87fd305545cf2e642fee18b57bb5252

SHA1
56fb770cfd829873cd4e45941969335ff98ad0ef

SHA256
655f621c3d3f6a7da99b1c332ab6dc1d4d9aae9cdef583360c480de982884513

SHA512
fb12f831515aefe3c39c60a8ec9f96febbef5a31c2013e36337ec31191bcebd92e62410d8618ce62860ebfbfd986120624340c5e00d01041afb103a44ef274a2

Download Submit
C:\Users\Public\69577.exe
MD5
e87fd305545cf2e642fee18b57bb5252

SHA1
56fb770cfd829873cd4e45941969335ff98ad0ef

SHA256
655f621c3d3f6a7da99b1c332ab6dc1d4d9aae9cdef583360c480de982884513

SHA512
fb12f831515aefe3c39c60a8ec9f96febbef5a31c2013e36337ec31191bcebd92e62410d8618ce62860ebfbfd986120624340c5e00d01041afb103a44ef274a2

Download Submit
\Users\Public\69577.exe
MD5
e87fd305545cf2e642fee18b57bb5252

SHA1
56fb770cfd829873cd4e45941969335ff98ad0ef

SHA256
655f621c3d3f6a7da99b1c332ab6dc1d4d9aae9cdef583360c480de982884513

SHA512
fb12f831515aefe3c39c60a8ec9f96febbef5a31c2013e36337ec31191bcebd92e62410d8618ce62860ebfbfd986120624340c5e00d01041afb103a44ef274a2

Download Submit
memory/544-8-0x000007FEF79D0000-0x000007FEF7C4A000-memory.dmp

Filesize
2.5MB

Download
memory/916-14-0x0000000001210000-0x0000000001211000-memory.dmp

Filesize
4KB

Download
memory/916-18-0x0000000005120000-0x00000000051A6000-memory.dmp

Filesize
536KB

Download
memory/916-17-0x00000000004B0000-0x00000000004BB000-memory.dmp

Filesize
44KB

Download
memory/916-16-0x0000000000F40000-0x0000000000F41000-memory.dmp

Filesize
4KB

Download
memory/916-10-0x0000000000000000-mapping.dmp

Download
memory/916-13-0x000000006B4D0000-0x000000006BBBE000-memory.dmp

Filesize
6.9MB

Download
memory/1196-19-0x0000000000000000-mapping.dmp

Download
memory/1444-21-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1444-22-0x00000000004374BE-mapping.dmp

Download
memory/1444-24-0x000000006B4D0000-0x000000006BBBE000-memory.dmp

Filesize
6.9MB

Download
memory/1444-25-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1444-27-0x0000000004760000-0x0000000004761000-memory.dmp

Filesize
4KB

Download
memory/1808-7-0x0000000075AE1000-0x0000000075AE3000-memory.dmp

Filesize
8KB

Download
memory/1944-2-0x0000000072B21000-0x0000000072B24000-memory.dmp

Filesize
12KB

Download
memory/1944-4-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1944-3-0x00000000705A1000-0x00000000705A3000-memory.dmp

Filesize
8KB

Download
memory/2004-5-0x0000000000000000-mapping.dmp

Download
memory/2004-6-0x000007FEFC021000-0x000007FEFC023000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads