agenttesla | 147ff22bdcef3aa73f1f3231fd85310f55b02535f2921db4e39dc84954f4faae

General

Target

EPRD-ES210001A URGENT RFQ.doc
Size

3KB
MD5

385d9d7dce288d12688ad65b0c262f0b
SHA1

abb40f1e00da3e6613d81c54d8f995e57b5f27ea
SHA256

147ff22bdcef3aa73f1f3231fd85310f55b02535f2921db4e39dc84954f4faae
SHA512

ae14956a5bf0b32150f8efc24c144be1bac63eba62096c8a323e055683c325416583e9374ff4375f564a5803a1417f389815f25c0bc0fd5494021a91fd543807

Score

10^/10

agenttesla keylogger spyware stealer suricata trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.privateemail.com
Port:
587
Username:
chamara.kuruppu@organigram-ca.icu
Password:
HELPMEGOD@1321

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
suricata: ET MALWARE Possible Malicious Macro DL EXE Feb 2016
suricata

AgentTesla Payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1996-80-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1996-81-0x000000000043748E-mapping.dmp	family_agenttesla
behavioral1/memory/1996-83-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

CustAttr .NET packer 1 IoCs

Detects CustAttr .NET packer in memory.

Processes:

resource	yara_rule
behavioral1/memory/528-72-0x00000000002C0000-0x00000000002CB000-memory.dmp	CustAttr

Blocklisted process makes network request 1 IoCs

Processes:

EQNEDT32.EXE

flow pid process

7 1328 EQNEDT32.EXE
Downloads MZ/PE file
Executes dropped EXE 3 IoCs

Processes:

poiuytrewasdfghnbvcxserty.exepoiuytrewasdfghnbvcxserty.exepoiuytrewasdfghnbvcxserty.exe

pid process

528 poiuytrewasdfghnbvcxserty.exe
672 poiuytrewasdfghnbvcxserty.exe
1996 poiuytrewasdfghnbvcxserty.exe
Loads dropped DLL 1 IoCs

Processes:

EQNEDT32.EXE

pid process

1328 EQNEDT32.EXE
Suspicious use of SetThreadContext 1 IoCs

Processes:

poiuytrewasdfghnbvcxserty.exe

description pid process target process

PID 528 set thread context of 1996 528 poiuytrewasdfghnbvcxserty.exe poiuytrewasdfghnbvcxserty.exe
Drops file in Windows directory 1 IoCs

Processes:

WINWORD.EXE

description ioc process

File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Office loads VBA resources, possible macro or embedded object present
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1628 schtasks.exe
Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
exploit

Exploitation for Client Execution
T1203

Processes:

EQNEDT32.EXE

pid process

1328 EQNEDT32.EXE

flow	pid	process
7	1328	EQNEDT32.EXE

pid	process
1328	EQNEDT32.EXE

description	pid	process	target process
PID 528 set thread context of 1996	528	poiuytrewasdfghnbvcxserty.exe	poiuytrewasdfghnbvcxserty.exe

description	ioc	process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE

pid	process
1628	schtasks.exe

pid	process
1328	EQNEDT32.EXE

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

Processes:

WINWORD.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

1304 WINWORD.EXE

pid	process
1304	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

poiuytrewasdfghnbvcxserty.exepoiuytrewasdfghnbvcxserty.exe

pid	process
528	poiuytrewasdfghnbvcxserty.exe
528	poiuytrewasdfghnbvcxserty.exe
528	poiuytrewasdfghnbvcxserty.exe
1996	poiuytrewasdfghnbvcxserty.exe
1996	poiuytrewasdfghnbvcxserty.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

poiuytrewasdfghnbvcxserty.exepoiuytrewasdfghnbvcxserty.exe

description pid process

Token: SeDebugPrivilege 528 poiuytrewasdfghnbvcxserty.exe
Token: SeDebugPrivilege 1996 poiuytrewasdfghnbvcxserty.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

WINWORD.EXE

pid process

1304 WINWORD.EXE
1304 WINWORD.EXE

description	pid	process
Token: SeDebugPrivilege	528	poiuytrewasdfghnbvcxserty.exe
Token: SeDebugPrivilege	1996	poiuytrewasdfghnbvcxserty.exe

pid	process
1304	WINWORD.EXE
1304	WINWORD.EXE

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

EQNEDT32.EXEWINWORD.EXEpoiuytrewasdfghnbvcxserty.exe

description	pid	process	target process
PID 1328 wrote to memory of 528	1328	EQNEDT32.EXE	poiuytrewasdfghnbvcxserty.exe
PID 1328 wrote to memory of 528	1328	EQNEDT32.EXE	poiuytrewasdfghnbvcxserty.exe
PID 1328 wrote to memory of 528	1328	EQNEDT32.EXE	poiuytrewasdfghnbvcxserty.exe
PID 1328 wrote to memory of 528	1328	EQNEDT32.EXE	poiuytrewasdfghnbvcxserty.exe
PID 1304 wrote to memory of 1620	1304	WINWORD.EXE	splwow64.exe
PID 1304 wrote to memory of 1620	1304	WINWORD.EXE	splwow64.exe
PID 1304 wrote to memory of 1620	1304	WINWORD.EXE	splwow64.exe
PID 1304 wrote to memory of 1620	1304	WINWORD.EXE	splwow64.exe
PID 528 wrote to memory of 1628	528	poiuytrewasdfghnbvcxserty.exe	schtasks.exe
PID 528 wrote to memory of 1628	528	poiuytrewasdfghnbvcxserty.exe	schtasks.exe
PID 528 wrote to memory of 1628	528	poiuytrewasdfghnbvcxserty.exe	schtasks.exe
PID 528 wrote to memory of 1628	528	poiuytrewasdfghnbvcxserty.exe	schtasks.exe
PID 528 wrote to memory of 672	528	poiuytrewasdfghnbvcxserty.exe	poiuytrewasdfghnbvcxserty.exe
PID 528 wrote to memory of 672	528	poiuytrewasdfghnbvcxserty.exe	poiuytrewasdfghnbvcxserty.exe
PID 528 wrote to memory of 672	528	poiuytrewasdfghnbvcxserty.exe	poiuytrewasdfghnbvcxserty.exe
PID 528 wrote to memory of 672	528	poiuytrewasdfghnbvcxserty.exe	poiuytrewasdfghnbvcxserty.exe
PID 528 wrote to memory of 1996	528	poiuytrewasdfghnbvcxserty.exe	poiuytrewasdfghnbvcxserty.exe
PID 528 wrote to memory of 1996	528	poiuytrewasdfghnbvcxserty.exe	poiuytrewasdfghnbvcxserty.exe
PID 528 wrote to memory of 1996	528	poiuytrewasdfghnbvcxserty.exe	poiuytrewasdfghnbvcxserty.exe
PID 528 wrote to memory of 1996	528	poiuytrewasdfghnbvcxserty.exe	poiuytrewasdfghnbvcxserty.exe
PID 528 wrote to memory of 1996	528	poiuytrewasdfghnbvcxserty.exe	poiuytrewasdfghnbvcxserty.exe
PID 528 wrote to memory of 1996	528	poiuytrewasdfghnbvcxserty.exe	poiuytrewasdfghnbvcxserty.exe
PID 528 wrote to memory of 1996	528	poiuytrewasdfghnbvcxserty.exe	poiuytrewasdfghnbvcxserty.exe
PID 528 wrote to memory of 1996	528	poiuytrewasdfghnbvcxserty.exe	poiuytrewasdfghnbvcxserty.exe
PID 528 wrote to memory of 1996	528	poiuytrewasdfghnbvcxserty.exe	poiuytrewasdfghnbvcxserty.exe

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\EPRD-ES210001A URGENT RFQ.doc"
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1304

C:\Windows\splwow64.exe
C:\Windows\splwow64.exe 12288
2⤵
PID:1620

C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
PID:1328

C:\Users\Admin\AppData\Roaming\poiuytrewasdfghnbvcxserty.exe
"C:\Users\Admin\AppData\Roaming\poiuytrewasdfghnbvcxserty.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:528

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\wfjFhTUFwiTLXg" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1F72.tmp"
3⤵
- Creates scheduled task(s)
PID:1628

C:\Users\Admin\AppData\Roaming\poiuytrewasdfghnbvcxserty.exe
"C:\Users\Admin\AppData\Roaming\poiuytrewasdfghnbvcxserty.exe"
3⤵
- Executes dropped EXE
PID:672

C:\Users\Admin\AppData\Roaming\poiuytrewasdfghnbvcxserty.exe
"C:\Users\Admin\AppData\Roaming\poiuytrewasdfghnbvcxserty.exe"
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1996

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Exploitation for Client Execution

1

T1203

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp1F72.tmp
MD5
19aa1e3104ff8473168f857ecb54313f

SHA1
7338c0acb7bb33bc8c20a541ae7ccc7575842eaa

SHA256
a6fd5d201b5f490f6100a70f5fcee1788d2afa372951734ad2832b2af9bf7e33

SHA512
31e02ad3714e6f309416d0f51a263901d35d312bc0fe7f4b89bbb635ef7cfa20a769e4a91e844b8b65de7c82111a10c374b385c5c5b205a4bf273b80f5b637be

Download Submit
C:\Users\Admin\AppData\Roaming\poiuytrewasdfghnbvcxserty.exe
MD5
8a56d6baa1eac6ca6208e74591221cbc

SHA1
9f057b5a90fdcee33dc2fa4f8f3424a3345186dd

SHA256
61ee3545921c4ddf2a41826b2425dc43b4902353a01798f5516e9afdf4a10d63

SHA512
7b06328817a158c5131f98211d9db8d24044f84e2bade735343539e57f0aaeeafc8da0fd8402a94e55cd0c31e6ab052c2dc55c274710ec3f26880ad172654597

Download Submit
C:\Users\Admin\AppData\Roaming\poiuytrewasdfghnbvcxserty.exe
MD5
8a56d6baa1eac6ca6208e74591221cbc

SHA1
9f057b5a90fdcee33dc2fa4f8f3424a3345186dd

SHA256
61ee3545921c4ddf2a41826b2425dc43b4902353a01798f5516e9afdf4a10d63

SHA512
7b06328817a158c5131f98211d9db8d24044f84e2bade735343539e57f0aaeeafc8da0fd8402a94e55cd0c31e6ab052c2dc55c274710ec3f26880ad172654597

Download Submit
C:\Users\Admin\AppData\Roaming\poiuytrewasdfghnbvcxserty.exe
MD5
8a56d6baa1eac6ca6208e74591221cbc

SHA1
9f057b5a90fdcee33dc2fa4f8f3424a3345186dd

SHA256
61ee3545921c4ddf2a41826b2425dc43b4902353a01798f5516e9afdf4a10d63

SHA512
7b06328817a158c5131f98211d9db8d24044f84e2bade735343539e57f0aaeeafc8da0fd8402a94e55cd0c31e6ab052c2dc55c274710ec3f26880ad172654597

Download Submit
C:\Users\Admin\AppData\Roaming\poiuytrewasdfghnbvcxserty.exe
MD5
8a56d6baa1eac6ca6208e74591221cbc

SHA1
9f057b5a90fdcee33dc2fa4f8f3424a3345186dd

SHA256
61ee3545921c4ddf2a41826b2425dc43b4902353a01798f5516e9afdf4a10d63

SHA512
7b06328817a158c5131f98211d9db8d24044f84e2bade735343539e57f0aaeeafc8da0fd8402a94e55cd0c31e6ab052c2dc55c274710ec3f26880ad172654597

Download Submit
\Users\Admin\AppData\Roaming\poiuytrewasdfghnbvcxserty.exe
MD5
8a56d6baa1eac6ca6208e74591221cbc

SHA1
9f057b5a90fdcee33dc2fa4f8f3424a3345186dd

SHA256
61ee3545921c4ddf2a41826b2425dc43b4902353a01798f5516e9afdf4a10d63

SHA512
7b06328817a158c5131f98211d9db8d24044f84e2bade735343539e57f0aaeeafc8da0fd8402a94e55cd0c31e6ab052c2dc55c274710ec3f26880ad172654597

Download Submit
memory/528-72-0x00000000002C0000-0x00000000002CB000-memory.dmp

Filesize
44KB

Download
memory/528-69-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/528-71-0x0000000002210000-0x0000000002211000-memory.dmp

Filesize
4KB

Download
memory/528-66-0x0000000000000000-mapping.dmp

Download
memory/528-75-0x0000000005B60000-0x0000000005BE2000-memory.dmp

Filesize
520KB

Download
memory/528-76-0x00000000006E0000-0x000000000071D000-memory.dmp

Filesize
244KB

Download
memory/1304-63-0x0000000075551000-0x0000000075553000-memory.dmp

Filesize
8KB

Download
memory/1304-60-0x0000000072A11000-0x0000000072A14000-memory.dmp

Filesize
12KB

Download
memory/1304-61-0x0000000070491000-0x0000000070493000-memory.dmp

Filesize
8KB

Download
memory/1304-62-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1620-73-0x0000000000000000-mapping.dmp

Download
memory/1620-74-0x000007FEFBF11000-0x000007FEFBF13000-memory.dmp

Filesize
8KB

Download
memory/1628-77-0x0000000000000000-mapping.dmp

Download
memory/1996-80-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1996-81-0x000000000043748E-mapping.dmp

Download
memory/1996-83-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1996-85-0x00000000049D0000-0x00000000049D1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads