agenttesla | c1a3563931fa2243d1ebb352779d3d94869ee26a38c87c257c2a02022845986a

General

Target

PRINT.doc
Size

3KB
MD5

66dd7813d08a65abe076c78f3b2e2699
SHA1

cd2a9026496865e395723ccb68a39fabeed06f2c
SHA256

c1a3563931fa2243d1ebb352779d3d94869ee26a38c87c257c2a02022845986a
SHA512

68cd37dab8b5c57ee6552671fda211f6f8f120024f6ad4a21462e1e9b5114091a4ef39cf1359eb0c76d69c58e2c02cba0055868a2b13b48267f392db750e96ac

Score

10^/10

agenttesla keylogger spyware stealer suricata trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.privateemail.com
Port:
587
Username:
chamara.kuruppu@organigram-ca.icu
Password:
HELPMEGOD@1321

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata

AgentTesla Payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/948-80-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/948-81-0x000000000043748E-mapping.dmp	family_agenttesla
behavioral1/memory/948-83-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

CustAttr .NET packer 1 IoCs

Detects CustAttr .NET packer in memory.

Processes:

resource	yara_rule
behavioral1/memory/1212-71-0x0000000000450000-0x000000000045B000-memory.dmp	CustAttr

Blocklisted process makes network request 1 IoCs

Processes:

EQNEDT32.EXE

flow pid process

7 1704 EQNEDT32.EXE
Downloads MZ/PE file
Executes dropped EXE 4 IoCs

Processes:

poiudriogdckvkscb.exepoiudriogdckvkscb.exepoiudriogdckvkscb.exepoiudriogdckvkscb.exe

pid process

1212 poiudriogdckvkscb.exe
524 poiudriogdckvkscb.exe
1704 poiudriogdckvkscb.exe
948 poiudriogdckvkscb.exe
Loads dropped DLL 1 IoCs

Processes:

EQNEDT32.EXE

pid process

1704 EQNEDT32.EXE
Suspicious use of SetThreadContext 1 IoCs

Processes:

poiudriogdckvkscb.exe

description pid process target process

PID 1212 set thread context of 948 1212 poiudriogdckvkscb.exe poiudriogdckvkscb.exe
Drops file in Windows directory 1 IoCs

Processes:

WINWORD.EXE

description ioc process

File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Office loads VBA resources, possible macro or embedded object present
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1324 schtasks.exe
Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
exploit

Exploitation for Client Execution
T1203

Processes:

EQNEDT32.EXE

pid process

1704 EQNEDT32.EXE

flow	pid	process
7	1704	EQNEDT32.EXE

pid	process
1704	EQNEDT32.EXE

description	pid	process	target process
PID 1212 set thread context of 948	1212	poiudriogdckvkscb.exe	poiudriogdckvkscb.exe

description	ioc	process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE

pid	process
1324	schtasks.exe

pid	process
1704	EQNEDT32.EXE

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

Processes:

WINWORD.EXE

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

1088 WINWORD.EXE

pid	process
1088	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

poiudriogdckvkscb.exepoiudriogdckvkscb.exe

pid	process
1212	poiudriogdckvkscb.exe
1212	poiudriogdckvkscb.exe
1212	poiudriogdckvkscb.exe
1212	poiudriogdckvkscb.exe
1212	poiudriogdckvkscb.exe
948	poiudriogdckvkscb.exe
948	poiudriogdckvkscb.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

poiudriogdckvkscb.exepoiudriogdckvkscb.exe

description pid process

Token: SeDebugPrivilege 1212 poiudriogdckvkscb.exe
Token: SeDebugPrivilege 948 poiudriogdckvkscb.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

WINWORD.EXE

pid process

1088 WINWORD.EXE
1088 WINWORD.EXE

description	pid	process
Token: SeDebugPrivilege	1212	poiudriogdckvkscb.exe
Token: SeDebugPrivilege	948	poiudriogdckvkscb.exe

pid	process
1088	WINWORD.EXE
1088	WINWORD.EXE

Suspicious use of WriteProcessMemory 29 IoCs

Processes:

EQNEDT32.EXEWINWORD.EXEpoiudriogdckvkscb.exe

description	pid	process	target process
PID 1704 wrote to memory of 1212	1704	EQNEDT32.EXE	poiudriogdckvkscb.exe
PID 1704 wrote to memory of 1212	1704	EQNEDT32.EXE	poiudriogdckvkscb.exe
PID 1704 wrote to memory of 1212	1704	EQNEDT32.EXE	poiudriogdckvkscb.exe
PID 1704 wrote to memory of 1212	1704	EQNEDT32.EXE	poiudriogdckvkscb.exe
PID 1088 wrote to memory of 996	1088	WINWORD.EXE	splwow64.exe
PID 1088 wrote to memory of 996	1088	WINWORD.EXE	splwow64.exe
PID 1088 wrote to memory of 996	1088	WINWORD.EXE	splwow64.exe
PID 1088 wrote to memory of 996	1088	WINWORD.EXE	splwow64.exe
PID 1212 wrote to memory of 1324	1212	poiudriogdckvkscb.exe	schtasks.exe
PID 1212 wrote to memory of 1324	1212	poiudriogdckvkscb.exe	schtasks.exe
PID 1212 wrote to memory of 1324	1212	poiudriogdckvkscb.exe	schtasks.exe
PID 1212 wrote to memory of 1324	1212	poiudriogdckvkscb.exe	schtasks.exe
PID 1212 wrote to memory of 524	1212	poiudriogdckvkscb.exe	poiudriogdckvkscb.exe
PID 1212 wrote to memory of 524	1212	poiudriogdckvkscb.exe	poiudriogdckvkscb.exe
PID 1212 wrote to memory of 524	1212	poiudriogdckvkscb.exe	poiudriogdckvkscb.exe
PID 1212 wrote to memory of 524	1212	poiudriogdckvkscb.exe	poiudriogdckvkscb.exe
PID 1212 wrote to memory of 1704	1212	poiudriogdckvkscb.exe	poiudriogdckvkscb.exe
PID 1212 wrote to memory of 1704	1212	poiudriogdckvkscb.exe	poiudriogdckvkscb.exe
PID 1212 wrote to memory of 1704	1212	poiudriogdckvkscb.exe	poiudriogdckvkscb.exe
PID 1212 wrote to memory of 1704	1212	poiudriogdckvkscb.exe	poiudriogdckvkscb.exe
PID 1212 wrote to memory of 948	1212	poiudriogdckvkscb.exe	poiudriogdckvkscb.exe
PID 1212 wrote to memory of 948	1212	poiudriogdckvkscb.exe	poiudriogdckvkscb.exe
PID 1212 wrote to memory of 948	1212	poiudriogdckvkscb.exe	poiudriogdckvkscb.exe
PID 1212 wrote to memory of 948	1212	poiudriogdckvkscb.exe	poiudriogdckvkscb.exe
PID 1212 wrote to memory of 948	1212	poiudriogdckvkscb.exe	poiudriogdckvkscb.exe
PID 1212 wrote to memory of 948	1212	poiudriogdckvkscb.exe	poiudriogdckvkscb.exe
PID 1212 wrote to memory of 948	1212	poiudriogdckvkscb.exe	poiudriogdckvkscb.exe
PID 1212 wrote to memory of 948	1212	poiudriogdckvkscb.exe	poiudriogdckvkscb.exe
PID 1212 wrote to memory of 948	1212	poiudriogdckvkscb.exe	poiudriogdckvkscb.exe

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\PRINT.doc"
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1088

C:\Windows\splwow64.exe
C:\Windows\splwow64.exe 12288
2⤵
PID:996

C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
PID:1704

C:\Users\Admin\AppData\Roaming\poiudriogdckvkscb.exe
"C:\Users\Admin\AppData\Roaming\poiudriogdckvkscb.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1212

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\CCwtuD" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5EA4.tmp"
3⤵
- Creates scheduled task(s)
PID:1324

C:\Users\Admin\AppData\Roaming\poiudriogdckvkscb.exe
"C:\Users\Admin\AppData\Roaming\poiudriogdckvkscb.exe"
3⤵
- Executes dropped EXE
PID:524

C:\Users\Admin\AppData\Roaming\poiudriogdckvkscb.exe
"C:\Users\Admin\AppData\Roaming\poiudriogdckvkscb.exe"
3⤵
- Executes dropped EXE
PID:1704

C:\Users\Admin\AppData\Roaming\poiudriogdckvkscb.exe
"C:\Users\Admin\AppData\Roaming\poiudriogdckvkscb.exe"
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:948

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Exploitation for Client Execution

1

T1203

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp5EA4.tmp
MD5
dfa9d64eb6efc1b53ca129c2943bfe04

SHA1
d0a52283ac51c2000614a256c6108a59b093dca5

SHA256
69c89a33d0ec800af21fc9e68727744d4422f4fc1862563894d5097f253abe48

SHA512
4f7d38eb383e1309e97182c4d0fe1a858eb0553cd95e685d3dc0b53e92cd5e033f69609ad5dab3491082fcb1a3d62e509f8c033b2e39b98367126b5af1a4ad87

Download Submit
C:\Users\Admin\AppData\Roaming\poiudriogdckvkscb.exe
MD5
560748a34effbbf951daf3b8ca24289f

SHA1
806be19d38b6260b2fc574a990bf146485e44ab9

SHA256
56d24e5d0336a8aefcaab14ba38932966d7f69c46ea874ab8d7565ea6de94a7d

SHA512
2cc73578715f8d107f48a5db6b82b295ff746feb56e1b42f3ec6ac79ca897f96bab1aa1577b72d3fbdb314e474d1316fc3b0dcd721669431bb4c508f05de364b

Download Submit
C:\Users\Admin\AppData\Roaming\poiudriogdckvkscb.exe
MD5
560748a34effbbf951daf3b8ca24289f

SHA1
806be19d38b6260b2fc574a990bf146485e44ab9

SHA256
56d24e5d0336a8aefcaab14ba38932966d7f69c46ea874ab8d7565ea6de94a7d

SHA512
2cc73578715f8d107f48a5db6b82b295ff746feb56e1b42f3ec6ac79ca897f96bab1aa1577b72d3fbdb314e474d1316fc3b0dcd721669431bb4c508f05de364b

Download Submit
C:\Users\Admin\AppData\Roaming\poiudriogdckvkscb.exe
MD5
560748a34effbbf951daf3b8ca24289f

SHA1
806be19d38b6260b2fc574a990bf146485e44ab9

SHA256
56d24e5d0336a8aefcaab14ba38932966d7f69c46ea874ab8d7565ea6de94a7d

SHA512
2cc73578715f8d107f48a5db6b82b295ff746feb56e1b42f3ec6ac79ca897f96bab1aa1577b72d3fbdb314e474d1316fc3b0dcd721669431bb4c508f05de364b

Download Submit
C:\Users\Admin\AppData\Roaming\poiudriogdckvkscb.exe
MD5
560748a34effbbf951daf3b8ca24289f

SHA1
806be19d38b6260b2fc574a990bf146485e44ab9

SHA256
56d24e5d0336a8aefcaab14ba38932966d7f69c46ea874ab8d7565ea6de94a7d

SHA512
2cc73578715f8d107f48a5db6b82b295ff746feb56e1b42f3ec6ac79ca897f96bab1aa1577b72d3fbdb314e474d1316fc3b0dcd721669431bb4c508f05de364b

Download Submit
C:\Users\Admin\AppData\Roaming\poiudriogdckvkscb.exe
MD5
560748a34effbbf951daf3b8ca24289f

SHA1
806be19d38b6260b2fc574a990bf146485e44ab9

SHA256
56d24e5d0336a8aefcaab14ba38932966d7f69c46ea874ab8d7565ea6de94a7d

SHA512
2cc73578715f8d107f48a5db6b82b295ff746feb56e1b42f3ec6ac79ca897f96bab1aa1577b72d3fbdb314e474d1316fc3b0dcd721669431bb4c508f05de364b

Download Submit
\Users\Admin\AppData\Roaming\poiudriogdckvkscb.exe
MD5
560748a34effbbf951daf3b8ca24289f

SHA1
806be19d38b6260b2fc574a990bf146485e44ab9

SHA256
56d24e5d0336a8aefcaab14ba38932966d7f69c46ea874ab8d7565ea6de94a7d

SHA512
2cc73578715f8d107f48a5db6b82b295ff746feb56e1b42f3ec6ac79ca897f96bab1aa1577b72d3fbdb314e474d1316fc3b0dcd721669431bb4c508f05de364b

Download Submit
memory/948-80-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/948-81-0x000000000043748E-mapping.dmp

Download
memory/948-85-0x00000000042D0000-0x00000000042D1000-memory.dmp

Filesize
4KB

Download
memory/948-83-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/996-72-0x0000000000000000-mapping.dmp

Download
memory/996-73-0x000007FEFB891000-0x000007FEFB893000-memory.dmp

Filesize
8KB

Download
memory/1088-59-0x0000000072391000-0x0000000072394000-memory.dmp

Filesize
12KB

Download
memory/1088-86-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1088-62-0x0000000075AA1000-0x0000000075AA3000-memory.dmp

Filesize
8KB

Download
memory/1088-61-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1088-60-0x000000006FE11000-0x000000006FE13000-memory.dmp

Filesize
8KB

Download
memory/1212-71-0x0000000000450000-0x000000000045B000-memory.dmp

Filesize
44KB

Download
memory/1212-75-0x0000000000C50000-0x0000000000C8D000-memory.dmp

Filesize
244KB

Download
memory/1212-74-0x0000000004DC0000-0x0000000004E3F000-memory.dmp

Filesize
508KB

Download
memory/1212-65-0x0000000000000000-mapping.dmp

Download
memory/1212-70-0x00000000047F0000-0x00000000047F1000-memory.dmp

Filesize
4KB

Download
memory/1212-68-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/1324-76-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads