agenttesla | 0826832dd2b6d96d111d92f8917d86f7acd41abcfed19d9cea448b04b6b0dbeb

General

Target

OKTAL PHARMACEUTICAL ORDER.doc
Size

4KB
MD5

518568b5c3bfcaa67474cd0b448c1dde
SHA1

a72ca8d71e7a4424e6c54567bf74765ea92dbf4a
SHA256

0826832dd2b6d96d111d92f8917d86f7acd41abcfed19d9cea448b04b6b0dbeb
SHA512

972bd97c8b9c844dab8a41c5024d15850ef5cfe8efcc24300b2edea7109d889b2253d8d305a4403c4e41cb9eb1623354883f3e37b1b68075d2c61d28a2f4508d

Score

10^/10

agenttesla keylogger spyware stealer suricata trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.privateemail.com
Port:
587
Username:
ddelande@quadrel-com.icu
Password:
snookiep@123

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata

AgentTesla Payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/432-78-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/432-79-0x000000000043749E-mapping.dmp	family_agenttesla
behavioral1/memory/432-81-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

CustAttr .NET packer 1 IoCs

Detects CustAttr .NET packer in memory.

Processes:

resource	yara_rule
behavioral1/memory/1076-71-0x00000000001D0000-0x00000000001DB000-memory.dmp	CustAttr

Blocklisted process makes network request 1 IoCs

Processes:

EQNEDT32.EXE

flow pid process

7 1752 EQNEDT32.EXE
Downloads MZ/PE file
Executes dropped EXE 2 IoCs

Processes:

sdfdvcefrefrterfredw.exesdfdvcefrefrterfredw.exe

pid process

1076 sdfdvcefrefrterfredw.exe
432 sdfdvcefrefrterfredw.exe
Loads dropped DLL 1 IoCs

Processes:

EQNEDT32.EXE

pid process

1752 EQNEDT32.EXE
Suspicious use of SetThreadContext 1 IoCs

Processes:

sdfdvcefrefrterfredw.exe

description pid process target process

PID 1076 set thread context of 432 1076 sdfdvcefrefrterfredw.exe sdfdvcefrefrterfredw.exe
Drops file in Windows directory 1 IoCs

Processes:

WINWORD.EXE

description ioc process

File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Office loads VBA resources, possible macro or embedded object present
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

968 schtasks.exe
Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
exploit

Exploitation for Client Execution
T1203

Processes:

EQNEDT32.EXE

pid process

1752 EQNEDT32.EXE

flow	pid	process
7	1752	EQNEDT32.EXE

pid	process
1076	sdfdvcefrefrterfredw.exe
432	sdfdvcefrefrterfredw.exe

pid	process
1752	EQNEDT32.EXE

description	pid	process	target process
PID 1076 set thread context of 432	1076	sdfdvcefrefrterfredw.exe	sdfdvcefrefrterfredw.exe

description	ioc	process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE

pid	process
968	schtasks.exe

pid	process
1752	EQNEDT32.EXE

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

Processes:

WINWORD.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

1668 WINWORD.EXE
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

sdfdvcefrefrterfredw.exesdfdvcefrefrterfredw.exe

pid process

1076 sdfdvcefrefrterfredw.exe
432 sdfdvcefrefrterfredw.exe
432 sdfdvcefrefrterfredw.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

sdfdvcefrefrterfredw.exesdfdvcefrefrterfredw.exe

description pid process

Token: SeDebugPrivilege 1076 sdfdvcefrefrterfredw.exe
Token: SeDebugPrivilege 432 sdfdvcefrefrterfredw.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

WINWORD.EXE

pid process

1668 WINWORD.EXE
1668 WINWORD.EXE

pid	process
1668	WINWORD.EXE

pid	process
1076	sdfdvcefrefrterfredw.exe
432	sdfdvcefrefrterfredw.exe
432	sdfdvcefrefrterfredw.exe

description	pid	process
Token: SeDebugPrivilege	1076	sdfdvcefrefrterfredw.exe
Token: SeDebugPrivilege	432	sdfdvcefrefrterfredw.exe

pid	process
1668	WINWORD.EXE
1668	WINWORD.EXE

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

EQNEDT32.EXEWINWORD.EXEsdfdvcefrefrterfredw.exe

description	pid	process	target process
PID 1752 wrote to memory of 1076	1752	EQNEDT32.EXE	sdfdvcefrefrterfredw.exe
PID 1752 wrote to memory of 1076	1752	EQNEDT32.EXE	sdfdvcefrefrterfredw.exe
PID 1752 wrote to memory of 1076	1752	EQNEDT32.EXE	sdfdvcefrefrterfredw.exe
PID 1752 wrote to memory of 1076	1752	EQNEDT32.EXE	sdfdvcefrefrterfredw.exe
PID 1668 wrote to memory of 972	1668	WINWORD.EXE	splwow64.exe
PID 1668 wrote to memory of 972	1668	WINWORD.EXE	splwow64.exe
PID 1668 wrote to memory of 972	1668	WINWORD.EXE	splwow64.exe
PID 1668 wrote to memory of 972	1668	WINWORD.EXE	splwow64.exe
PID 1076 wrote to memory of 968	1076	sdfdvcefrefrterfredw.exe	schtasks.exe
PID 1076 wrote to memory of 968	1076	sdfdvcefrefrterfredw.exe	schtasks.exe
PID 1076 wrote to memory of 968	1076	sdfdvcefrefrterfredw.exe	schtasks.exe
PID 1076 wrote to memory of 968	1076	sdfdvcefrefrterfredw.exe	schtasks.exe
PID 1076 wrote to memory of 432	1076	sdfdvcefrefrterfredw.exe	sdfdvcefrefrterfredw.exe
PID 1076 wrote to memory of 432	1076	sdfdvcefrefrterfredw.exe	sdfdvcefrefrterfredw.exe
PID 1076 wrote to memory of 432	1076	sdfdvcefrefrterfredw.exe	sdfdvcefrefrterfredw.exe
PID 1076 wrote to memory of 432	1076	sdfdvcefrefrterfredw.exe	sdfdvcefrefrterfredw.exe
PID 1076 wrote to memory of 432	1076	sdfdvcefrefrterfredw.exe	sdfdvcefrefrterfredw.exe
PID 1076 wrote to memory of 432	1076	sdfdvcefrefrterfredw.exe	sdfdvcefrefrterfredw.exe
PID 1076 wrote to memory of 432	1076	sdfdvcefrefrterfredw.exe	sdfdvcefrefrterfredw.exe
PID 1076 wrote to memory of 432	1076	sdfdvcefrefrterfredw.exe	sdfdvcefrefrterfredw.exe
PID 1076 wrote to memory of 432	1076	sdfdvcefrefrterfredw.exe	sdfdvcefrefrterfredw.exe

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\OKTAL PHARMACEUTICAL ORDER.doc"
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1668

C:\Windows\splwow64.exe
C:\Windows\splwow64.exe 12288
2⤵
PID:972

C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
PID:1752

C:\Users\Admin\AppData\Roaming\sdfdvcefrefrterfredw.exe
"C:\Users\Admin\AppData\Roaming\sdfdvcefrefrterfredw.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1076

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\pcEyxzuZDY" /XML "C:\Users\Admin\AppData\Local\Temp\tmp281A.tmp"
3⤵
- Creates scheduled task(s)
PID:968

C:\Users\Admin\AppData\Roaming\sdfdvcefrefrterfredw.exe
"C:\Users\Admin\AppData\Roaming\sdfdvcefrefrterfredw.exe"
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:432

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Exploitation for Client Execution

1

T1203

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp281A.tmp
MD5
9b7da629dc9b6c105e9bc3a5fdf96760

SHA1
a7ad6aceec7ff144f31f7a58c6c85bd9c60ec0d9

SHA256
657056e47b28245a72360b6eecafb977aa130e75e202447a5b63929b9d020648

SHA512
22f3ee626c647d0aaf6d8b1c5ce02b5e8f02670544ecec40289ab3288d0c56e5163a3aec0dd3f72661cab828887e498de1bb054faf29c297b5fe94330fde4507

Download Submit
C:\Users\Admin\AppData\Roaming\sdfdvcefrefrterfredw.exe
MD5
e33ac82c14447959cb7aed86bd915960

SHA1
9ea25902ed4f55813ae2708ce237bbf3b89f924a

SHA256
3bcc082fdf8172ec9014d27d75cd67698ac1f27228a698849fad2a56fe94ca0f

SHA512
734cdfefd8e00be8e26f20d8e7fa0a522ddc25cd0fff2528ef283d54a749c5d7ccd415273117bc942cb0927ef2a4cebb42177a0c5f3000287c54f6d290a89091

Download Submit
C:\Users\Admin\AppData\Roaming\sdfdvcefrefrterfredw.exe
MD5
e33ac82c14447959cb7aed86bd915960

SHA1
9ea25902ed4f55813ae2708ce237bbf3b89f924a

SHA256
3bcc082fdf8172ec9014d27d75cd67698ac1f27228a698849fad2a56fe94ca0f

SHA512
734cdfefd8e00be8e26f20d8e7fa0a522ddc25cd0fff2528ef283d54a749c5d7ccd415273117bc942cb0927ef2a4cebb42177a0c5f3000287c54f6d290a89091

Download Submit
C:\Users\Admin\AppData\Roaming\sdfdvcefrefrterfredw.exe
MD5
e33ac82c14447959cb7aed86bd915960

SHA1
9ea25902ed4f55813ae2708ce237bbf3b89f924a

SHA256
3bcc082fdf8172ec9014d27d75cd67698ac1f27228a698849fad2a56fe94ca0f

SHA512
734cdfefd8e00be8e26f20d8e7fa0a522ddc25cd0fff2528ef283d54a749c5d7ccd415273117bc942cb0927ef2a4cebb42177a0c5f3000287c54f6d290a89091

Download Submit
\Users\Admin\AppData\Roaming\sdfdvcefrefrterfredw.exe
MD5
e33ac82c14447959cb7aed86bd915960

SHA1
9ea25902ed4f55813ae2708ce237bbf3b89f924a

SHA256
3bcc082fdf8172ec9014d27d75cd67698ac1f27228a698849fad2a56fe94ca0f

SHA512
734cdfefd8e00be8e26f20d8e7fa0a522ddc25cd0fff2528ef283d54a749c5d7ccd415273117bc942cb0927ef2a4cebb42177a0c5f3000287c54f6d290a89091

Download Submit
memory/432-83-0x0000000004D80000-0x0000000004D81000-memory.dmp

Filesize
4KB

Download
memory/432-81-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/432-79-0x000000000043749E-mapping.dmp

Download
memory/432-78-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/968-76-0x0000000000000000-mapping.dmp

Download
memory/972-73-0x000007FEFB6B1000-0x000007FEFB6B3000-memory.dmp

Filesize
8KB

Download
memory/972-72-0x0000000000000000-mapping.dmp

Download
memory/1076-65-0x0000000000000000-mapping.dmp

Download
memory/1076-74-0x00000000051D0000-0x0000000005251000-memory.dmp

Filesize
516KB

Download
memory/1076-75-0x0000000000420000-0x000000000045D000-memory.dmp

Filesize
244KB

Download
memory/1076-71-0x00000000001D0000-0x00000000001DB000-memory.dmp

Filesize
44KB

Download
memory/1076-70-0x0000000004E30000-0x0000000004E31000-memory.dmp

Filesize
4KB

Download
memory/1076-68-0x0000000000F50000-0x0000000000F51000-memory.dmp

Filesize
4KB

Download
memory/1668-59-0x00000000721B1000-0x00000000721B4000-memory.dmp

Filesize
12KB

Download
memory/1668-62-0x0000000075281000-0x0000000075283000-memory.dmp

Filesize
8KB

Download
memory/1668-61-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1668-60-0x000000006FC31000-0x000000006FC33000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads