agenttesla | d8f43b35cd944e3a4852ae3241afccae491317a11853385b86e6859fc07abc29

General

Target

130578500.doc
Size

394KB
MD5

b7f5cd0f71b6d7d065a71b15da48e3c4
SHA1

86d4ca02380ee9e7f92eeb88c620f033ece6ad7a
SHA256

d8f43b35cd944e3a4852ae3241afccae491317a11853385b86e6859fc07abc29
SHA512

b3d95c9fb14c941c68f6ee5f4e97326b82b182605926552342459216854d3f33859824d9488e6ce255ef5291054da49783a3f828ff59cce67e80c683b658a087

Score

10^/10

agenttesla keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
janryone.xyz
Port:
587
Username:
ammond@janryone.xyz
Password:
xv*ZM6fqfw&7

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1780-76-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1780-77-0x000000000043763E-mapping.dmp	family_agenttesla
behavioral1/memory/1780-80-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Blocklisted process makes network request 2 IoCs

Processes:

EQNEDT32.EXE

flow pid process

7 1772 EQNEDT32.EXE
9 1772 EQNEDT32.EXE
Downloads MZ/PE file
Executes dropped EXE 2 IoCs

Processes:

69577.exe69577.exe

pid process

1256 69577.exe
1780 69577.exe
Loads dropped DLL 2 IoCs

Processes:

EQNEDT32.EXE69577.exe

pid process

1772 EQNEDT32.EXE
1256 69577.exe

flow	pid	process
7	1772	EQNEDT32.EXE
9	1772	EQNEDT32.EXE

pid	process
1256	69577.exe
1780	69577.exe

pid	process
1772	EQNEDT32.EXE
1256	69577.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

69577.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\notpad = "\"C:\\Users\\Admin\\AppData\\Local\\notpad.exe\""	69577.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

69577.exe

description pid process target process

PID 1256 set thread context of 1780 1256 69577.exe 69577.exe
Drops file in Windows directory 1 IoCs

Processes:

WINWORD.EXE

description ioc process

File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE
Office loads VBA resources, possible macro or embedded object present
Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
exploit

Exploitation for Client Execution
T1203

Processes:

EQNEDT32.EXE

pid process

1772 EQNEDT32.EXE

description	pid	process	target process
PID 1256 set thread context of 1780	1256	69577.exe	69577.exe

description	ioc	process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE

pid	process
1772	EQNEDT32.EXE

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

Processes:

WINWORD.EXE

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

1688 WINWORD.EXE
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

69577.exe69577.exe

pid process

1256 69577.exe
1256 69577.exe
1780 69577.exe
1780 69577.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

69577.exe69577.exe

description pid process

Token: SeDebugPrivilege 1256 69577.exe
Token: SeDebugPrivilege 1780 69577.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

WINWORD.EXE

pid process

1688 WINWORD.EXE
1688 WINWORD.EXE

pid	process
1688	WINWORD.EXE

pid	process
1256	69577.exe
1256	69577.exe
1780	69577.exe
1780	69577.exe

description	pid	process
Token: SeDebugPrivilege	1256	69577.exe
Token: SeDebugPrivilege	1780	69577.exe

pid	process
1688	WINWORD.EXE
1688	WINWORD.EXE

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

WINWORD.EXEEQNEDT32.EXE69577.exe

description	pid	process	target process
PID 1688 wrote to memory of 1164	1688	WINWORD.EXE	splwow64.exe
PID 1688 wrote to memory of 1164	1688	WINWORD.EXE	splwow64.exe
PID 1688 wrote to memory of 1164	1688	WINWORD.EXE	splwow64.exe
PID 1688 wrote to memory of 1164	1688	WINWORD.EXE	splwow64.exe
PID 1772 wrote to memory of 1256	1772	EQNEDT32.EXE	69577.exe
PID 1772 wrote to memory of 1256	1772	EQNEDT32.EXE	69577.exe
PID 1772 wrote to memory of 1256	1772	EQNEDT32.EXE	69577.exe
PID 1772 wrote to memory of 1256	1772	EQNEDT32.EXE	69577.exe
PID 1256 wrote to memory of 1780	1256	69577.exe	69577.exe
PID 1256 wrote to memory of 1780	1256	69577.exe	69577.exe
PID 1256 wrote to memory of 1780	1256	69577.exe	69577.exe
PID 1256 wrote to memory of 1780	1256	69577.exe	69577.exe
PID 1256 wrote to memory of 1780	1256	69577.exe	69577.exe
PID 1256 wrote to memory of 1780	1256	69577.exe	69577.exe
PID 1256 wrote to memory of 1780	1256	69577.exe	69577.exe
PID 1256 wrote to memory of 1780	1256	69577.exe	69577.exe
PID 1256 wrote to memory of 1780	1256	69577.exe	69577.exe

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\130578500.doc"
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1688

C:\Windows\splwow64.exe
C:\Windows\splwow64.exe 12288
2⤵
PID:1164

C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
PID:1772

C:\Users\Public\69577.exe
"C:\Users\Public\69577.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1256

C:\Users\Admin\AppData\Local\Temp\69577.exe
C:\Users\Admin\AppData\Local\Temp\69577.exe
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1780

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Exploitation for Client Execution

1

T1203

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\69577.exe
MD5
75ab568fe148e4d229533c5a6cd6b572

SHA1
27f2df18153729839b1ae3b0e579c1df0db59df0

SHA256
fb91f67073fef8d391ccb08c31183ff2ff00e8a8ca0f71fb5bfce17fb0ddbd26

SHA512
3ea21ae941fe9ba09e8f951c406e90b43bd64e50106a57893cd832ccc6954a77935982129079bbe402e616876597d0f71ab384cbccab2d323002bb8ada73ed51

Download Submit
C:\Users\Admin\AppData\Local\Temp\69577.exe
MD5
75ab568fe148e4d229533c5a6cd6b572

SHA1
27f2df18153729839b1ae3b0e579c1df0db59df0

SHA256
fb91f67073fef8d391ccb08c31183ff2ff00e8a8ca0f71fb5bfce17fb0ddbd26

SHA512
3ea21ae941fe9ba09e8f951c406e90b43bd64e50106a57893cd832ccc6954a77935982129079bbe402e616876597d0f71ab384cbccab2d323002bb8ada73ed51

Download Submit
C:\Users\Public\69577.exe
MD5
75ab568fe148e4d229533c5a6cd6b572

SHA1
27f2df18153729839b1ae3b0e579c1df0db59df0

SHA256
fb91f67073fef8d391ccb08c31183ff2ff00e8a8ca0f71fb5bfce17fb0ddbd26

SHA512
3ea21ae941fe9ba09e8f951c406e90b43bd64e50106a57893cd832ccc6954a77935982129079bbe402e616876597d0f71ab384cbccab2d323002bb8ada73ed51

Download Submit
C:\Users\Public\69577.exe
MD5
75ab568fe148e4d229533c5a6cd6b572

SHA1
27f2df18153729839b1ae3b0e579c1df0db59df0

SHA256
fb91f67073fef8d391ccb08c31183ff2ff00e8a8ca0f71fb5bfce17fb0ddbd26

SHA512
3ea21ae941fe9ba09e8f951c406e90b43bd64e50106a57893cd832ccc6954a77935982129079bbe402e616876597d0f71ab384cbccab2d323002bb8ada73ed51

Download Submit
\Users\Admin\AppData\Local\Temp\69577.exe
MD5
75ab568fe148e4d229533c5a6cd6b572

SHA1
27f2df18153729839b1ae3b0e579c1df0db59df0

SHA256
fb91f67073fef8d391ccb08c31183ff2ff00e8a8ca0f71fb5bfce17fb0ddbd26

SHA512
3ea21ae941fe9ba09e8f951c406e90b43bd64e50106a57893cd832ccc6954a77935982129079bbe402e616876597d0f71ab384cbccab2d323002bb8ada73ed51

Download Submit
\Users\Public\69577.exe
MD5
75ab568fe148e4d229533c5a6cd6b572

SHA1
27f2df18153729839b1ae3b0e579c1df0db59df0

SHA256
fb91f67073fef8d391ccb08c31183ff2ff00e8a8ca0f71fb5bfce17fb0ddbd26

SHA512
3ea21ae941fe9ba09e8f951c406e90b43bd64e50106a57893cd832ccc6954a77935982129079bbe402e616876597d0f71ab384cbccab2d323002bb8ada73ed51

Download Submit
memory/1164-64-0x000007FEFBB51000-0x000007FEFBB53000-memory.dmp

Filesize
8KB

Download
memory/1164-63-0x0000000000000000-mapping.dmp

Download
memory/1256-67-0x0000000000000000-mapping.dmp

Download
memory/1256-70-0x0000000000810000-0x0000000000811000-memory.dmp

Filesize
4KB

Download
memory/1256-72-0x0000000004920000-0x0000000004921000-memory.dmp

Filesize
4KB

Download
memory/1256-73-0x0000000000330000-0x0000000000332000-memory.dmp

Filesize
8KB

Download
memory/1256-74-0x0000000000790000-0x00000000007D1000-memory.dmp

Filesize
260KB

Download
memory/1688-60-0x0000000072661000-0x0000000072664000-memory.dmp

Filesize
12KB

Download
memory/1688-62-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1688-83-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1688-61-0x00000000700E1000-0x00000000700E3000-memory.dmp

Filesize
8KB

Download
memory/1772-65-0x0000000075011000-0x0000000075013000-memory.dmp

Filesize
8KB

Download
memory/1780-77-0x000000000043763E-mapping.dmp

Download
memory/1780-80-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1780-82-0x0000000000650000-0x0000000000651000-memory.dmp

Filesize
4KB

Download
memory/1780-76-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads