agenttesla | 28425375bde8a9d13ac9b57ccc32f046b2c7bebdf592b5af2d85146d565e9a9e

General

Target

Purchase Order.doc
Size

4KB
MD5

9ef6eb1c4c2bc4c409fc59e4bbf36854
SHA1

e4e956b1f7e500073bab3ccef88e6c4bf784c663
SHA256

9aec6bdb253c4e34d6f4629baadc8a01d4674ac5bd084b791820160ed27d2b2b
SHA512

45764eb0feb82a7da251461fcf02e56e7b6468a4f45c89f8b3a9826cc81444d50126ad0595d7c19e3e551530763ee8fe94a37423316dd102e990a71fb829d1ca

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.privateemail.com
Port:
587
Username:
prodip@precisionenergy.me
Password:
@Mexico1.,

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1004-77-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1004-78-0x00000000004375CE-mapping.dmp	family_agenttesla
behavioral1/memory/1004-80-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Blocklisted process makes network request 1 IoCs

Processes:

EQNEDT32.EXE

flow pid process

7 1580 EQNEDT32.EXE
Downloads MZ/PE file
Executes dropped EXE 2 IoCs

Processes:

biggest.exebiggest.exe

pid process

1000 biggest.exe
1004 biggest.exe
Loads dropped DLL 1 IoCs

Processes:

EQNEDT32.EXE

pid process

1580 EQNEDT32.EXE
Suspicious use of SetThreadContext 1 IoCs

Processes:

biggest.exe

description pid process target process

PID 1000 set thread context of 1004 1000 biggest.exe biggest.exe
Drops file in Windows directory 1 IoCs

Processes:

WINWORD.EXE

description ioc process

File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Office loads VBA resources, possible macro or embedded object present
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

900 schtasks.exe
Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
exploit

Exploitation for Client Execution
T1203

Processes:

EQNEDT32.EXE

pid process

1580 EQNEDT32.EXE

flow	pid	process
7	1580	EQNEDT32.EXE

pid	process
1000	biggest.exe
1004	biggest.exe

pid	process
1580	EQNEDT32.EXE

description	pid	process	target process
PID 1000 set thread context of 1004	1000	biggest.exe	biggest.exe

description	ioc	process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE

pid	process
900	schtasks.exe

pid	process
1580	EQNEDT32.EXE

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

Processes:

WINWORD.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

1820 WINWORD.EXE
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

biggest.exebiggest.exe

pid process

1000 biggest.exe
1004 biggest.exe
1004 biggest.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

biggest.exebiggest.exe

description pid process

Token: SeDebugPrivilege 1000 biggest.exe
Token: SeDebugPrivilege 1004 biggest.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

WINWORD.EXE

pid process

1820 WINWORD.EXE
1820 WINWORD.EXE
1820 WINWORD.EXE

pid	process
1820	WINWORD.EXE

pid	process
1000	biggest.exe
1004	biggest.exe
1004	biggest.exe

description	pid	process
Token: SeDebugPrivilege	1000	biggest.exe
Token: SeDebugPrivilege	1004	biggest.exe

pid	process
1820	WINWORD.EXE
1820	WINWORD.EXE
1820	WINWORD.EXE

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

EQNEDT32.EXEWINWORD.EXEbiggest.exe

description	pid	process	target process
PID 1580 wrote to memory of 1000	1580	EQNEDT32.EXE	biggest.exe
PID 1580 wrote to memory of 1000	1580	EQNEDT32.EXE	biggest.exe
PID 1580 wrote to memory of 1000	1580	EQNEDT32.EXE	biggest.exe
PID 1580 wrote to memory of 1000	1580	EQNEDT32.EXE	biggest.exe
PID 1820 wrote to memory of 1696	1820	WINWORD.EXE	splwow64.exe
PID 1820 wrote to memory of 1696	1820	WINWORD.EXE	splwow64.exe
PID 1820 wrote to memory of 1696	1820	WINWORD.EXE	splwow64.exe
PID 1820 wrote to memory of 1696	1820	WINWORD.EXE	splwow64.exe
PID 1000 wrote to memory of 900	1000	biggest.exe	schtasks.exe
PID 1000 wrote to memory of 900	1000	biggest.exe	schtasks.exe
PID 1000 wrote to memory of 900	1000	biggest.exe	schtasks.exe
PID 1000 wrote to memory of 900	1000	biggest.exe	schtasks.exe
PID 1000 wrote to memory of 1004	1000	biggest.exe	biggest.exe
PID 1000 wrote to memory of 1004	1000	biggest.exe	biggest.exe
PID 1000 wrote to memory of 1004	1000	biggest.exe	biggest.exe
PID 1000 wrote to memory of 1004	1000	biggest.exe	biggest.exe
PID 1000 wrote to memory of 1004	1000	biggest.exe	biggest.exe
PID 1000 wrote to memory of 1004	1000	biggest.exe	biggest.exe
PID 1000 wrote to memory of 1004	1000	biggest.exe	biggest.exe
PID 1000 wrote to memory of 1004	1000	biggest.exe	biggest.exe
PID 1000 wrote to memory of 1004	1000	biggest.exe	biggest.exe

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Purchase Order.doc"
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1820

C:\Windows\splwow64.exe
C:\Windows\splwow64.exe 12288
2⤵
PID:1696

C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
PID:1580

C:\Users\Admin\AppData\Roaming\biggest.exe
"C:\Users\Admin\AppData\Roaming\biggest.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1000

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\iDGbuSl" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE3D9.tmp"
3⤵
- Creates scheduled task(s)
PID:900

C:\Users\Admin\AppData\Roaming\biggest.exe
"{path}"
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1004

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Exploitation for Client Execution

1

T1203

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpE3D9.tmp
MD5
837266c7e0bcaea7b14bf4729f03e789

SHA1
9ee8946cb3b4b7abb24f18709dd5b85abcb62a25

SHA256
36ebb612446f4ec480ad5d844d49bf2bcb2d33f7adc3f6394b092900b6cb6582

SHA512
ec0a229dadf0d0b9568c2dcdc262cf3861d77664b72e222bff1390de28b2d38f629a42feb59d61767ef2b611255adde772a9985e914985910586d05c9583987d

Download Submit
C:\Users\Admin\AppData\Roaming\biggest.exe
MD5
30bd38d2a90db3510019a3fe7dae45cd

SHA1
ac16719ecd9103689f42ee1719eb6f1b444dba4b

SHA256
5d2ecd7210251e5d86670bd25655976536c0ac15f65185ea7003467be2ee5b19

SHA512
a41ed21642beee783f844d7eac920d2edcab180def732afcbd5d021bf8a72c09a2fe33ab6da5980dabca3230c4a0e73af29ee883bfac2e94aac71cdbd595be84

Download Submit
C:\Users\Admin\AppData\Roaming\biggest.exe
MD5
30bd38d2a90db3510019a3fe7dae45cd

SHA1
ac16719ecd9103689f42ee1719eb6f1b444dba4b

SHA256
5d2ecd7210251e5d86670bd25655976536c0ac15f65185ea7003467be2ee5b19

SHA512
a41ed21642beee783f844d7eac920d2edcab180def732afcbd5d021bf8a72c09a2fe33ab6da5980dabca3230c4a0e73af29ee883bfac2e94aac71cdbd595be84

Download Submit
C:\Users\Admin\AppData\Roaming\biggest.exe
MD5
30bd38d2a90db3510019a3fe7dae45cd

SHA1
ac16719ecd9103689f42ee1719eb6f1b444dba4b

SHA256
5d2ecd7210251e5d86670bd25655976536c0ac15f65185ea7003467be2ee5b19

SHA512
a41ed21642beee783f844d7eac920d2edcab180def732afcbd5d021bf8a72c09a2fe33ab6da5980dabca3230c4a0e73af29ee883bfac2e94aac71cdbd595be84

Download Submit
\Users\Admin\AppData\Roaming\biggest.exe
MD5
30bd38d2a90db3510019a3fe7dae45cd

SHA1
ac16719ecd9103689f42ee1719eb6f1b444dba4b

SHA256
5d2ecd7210251e5d86670bd25655976536c0ac15f65185ea7003467be2ee5b19

SHA512
a41ed21642beee783f844d7eac920d2edcab180def732afcbd5d021bf8a72c09a2fe33ab6da5980dabca3230c4a0e73af29ee883bfac2e94aac71cdbd595be84

Download Submit
memory/900-75-0x0000000000000000-mapping.dmp

Download
memory/1000-64-0x0000000000000000-mapping.dmp

Download
memory/1000-67-0x0000000000DC0000-0x0000000000DC1000-memory.dmp

Filesize
4KB

Download
memory/1000-69-0x0000000007340000-0x0000000007341000-memory.dmp

Filesize
4KB

Download
memory/1000-72-0x00000000002D0000-0x00000000002D5000-memory.dmp

Filesize
20KB

Download
memory/1000-73-0x0000000008450000-0x00000000084FF000-memory.dmp

Filesize
700KB

Download
memory/1000-74-0x0000000002340000-0x00000000023A9000-memory.dmp

Filesize
420KB

Download
memory/1004-77-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1004-82-0x0000000004CC0000-0x0000000004CC1000-memory.dmp

Filesize
4KB

Download
memory/1004-80-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1004-78-0x00000000004375CE-mapping.dmp

Download
memory/1580-62-0x0000000076641000-0x0000000076643000-memory.dmp

Filesize
8KB

Download
memory/1696-71-0x000007FEFBED1000-0x000007FEFBED3000-memory.dmp

Filesize
8KB

Download
memory/1696-70-0x0000000000000000-mapping.dmp

Download
memory/1820-61-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1820-60-0x0000000070451000-0x0000000070453000-memory.dmp

Filesize
8KB

Download
memory/1820-59-0x00000000729D1000-0x00000000729D4000-memory.dmp

Filesize
12KB

Download
memory/1820-83-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads