Overview

overview

10

Static

static

RFQ-2201847.xlsx

windows7_x64

10

RFQ-2201847.xlsx

windows10_x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    RFQ-2201847.xlsx

  • Size

    2.1MB

  • Sample

    210728-nkb1vdh5vs

  • MD5

    7835c3614e688a977aeb63cafdd04d23

  • SHA1

    c6b11868797ad66a460030da17c76f5eeee8bbda

  • SHA256

    ddb6e90b3fd4767a65a7d190e7dda1994108c268e94efe307be80e6cce56eda2

  • SHA512

    cd53a0cef5f0da591330a79fd6b8420005b252a49ad8c9806f7d904c89c045b5b7deb67971132a5f297d32a67f403372f19690b6c3ded900e28eebd9a9558e5f

Score
10/10
agentteslakeyloggerpersistencespywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    smtp.yandex.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    Rollingstone147

Targets

    • Target

      RFQ-2201847.xlsx

    • Size

      2.1MB

    • MD5

      7835c3614e688a977aeb63cafdd04d23

    • SHA1

      c6b11868797ad66a460030da17c76f5eeee8bbda

    • SHA256

      ddb6e90b3fd4767a65a7d190e7dda1994108c268e94efe307be80e6cce56eda2

    • SHA512

      cd53a0cef5f0da591330a79fd6b8420005b252a49ad8c9806f7d904c89c045b5b7deb67971132a5f297d32a67f403372f19690b6c3ded900e28eebd9a9558e5f

    Score
    10/10
    agentteslakeyloggerpersistencespywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • AgentTesla Payload

    • CustAttr .NET packer

      Detects CustAttr .NET packer in memory.

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Exploitation for Client Execution

1
T1203

Persistence

Registry Run Keys / Startup Folder

1
T1060

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

System Information Discovery

3
T1082

Query Registry

2
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks