General

  • Target

    QuotationQO210421A87356_samples_products_sinoma_internationals.doc

  • Size

    2.3MB

  • Sample

    210422-waapgmhxfe

  • MD5

    185b488dfaba7dfe7d3198c997f7a00f

  • SHA1

    e91de54b194a2fad9b7f0978470072d8058c2021

  • SHA256

    e3b03d6c376e317401a5ddc5d99caf74017ac9597c50bca80b1f98e8b6654aaa

  • SHA512

    efc0e6fa9cc8261e371a2208938612af40e2406477cee776d577f7cad2be6d58572c00754c372dd70d663137a09691eb61c74763943a249fe5ae263db886beb9

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    smtp.privateemail.com
  • Port:
    587
  • Username:
    eammorris@askoblue.com
  • Password:
    zQHG#uz5

Targets

    • Target

      QuotationQO210421A87356_samples_products_sinoma_internationals.doc

    • Size

      2.3MB

    • MD5

      185b488dfaba7dfe7d3198c997f7a00f

    • SHA1

      e91de54b194a2fad9b7f0978470072d8058c2021

    • SHA256

      e3b03d6c376e317401a5ddc5d99caf74017ac9597c50bca80b1f98e8b6654aaa

    • SHA512

      efc0e6fa9cc8261e371a2208938612af40e2406477cee776d577f7cad2be6d58572c00754c372dd70d663137a09691eb61c74763943a249fe5ae263db886beb9

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • AgentTesla Payload

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Execution

Exploitation for Client Execution

1
T1203

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

3
T1081

Discovery

System Information Discovery

3
T1082

Query Registry

2
T1012

Collection

Data from Local System

3
T1005

Tasks