Analysis
-
max time kernel
101s -
max time network
78s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
28-07-2021 11:15
Static task
static1
Behavioral task
behavioral1
Sample
RFQ-2201847.xlsx
Resource
win7v20210408
Behavioral task
behavioral2
Sample
RFQ-2201847.xlsx
Resource
win10v20210410
General
-
Target
RFQ-2201847.xlsx
-
Size
2.1MB
-
MD5
7835c3614e688a977aeb63cafdd04d23
-
SHA1
c6b11868797ad66a460030da17c76f5eeee8bbda
-
SHA256
ddb6e90b3fd4767a65a7d190e7dda1994108c268e94efe307be80e6cce56eda2
-
SHA512
cd53a0cef5f0da591330a79fd6b8420005b252a49ad8c9806f7d904c89c045b5b7deb67971132a5f297d32a67f403372f19690b6c3ded900e28eebd9a9558e5f
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.yandex.com - Port:
587 - Username:
[email protected] - Password:
Rollingstone147
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/552-76-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla behavioral1/memory/552-77-0x000000000043760E-mapping.dmp family_agenttesla behavioral1/memory/552-78-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla -
CustAttr .NET packer 1 IoCs
Detects CustAttr .NET packer in memory.
Processes:
resource yara_rule behavioral1/memory/1352-71-0x00000000001C0000-0x00000000001CB000-memory.dmp CustAttr -
Blocklisted process makes network request 1 IoCs
Processes:
EQNEDT32.EXEflow pid process 6 2032 EQNEDT32.EXE -
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
Processes:
winmedia.exepid process 1352 winmedia.exe -
Loads dropped DLL 1 IoCs
Processes:
EQNEDT32.EXEpid process 2032 EQNEDT32.EXE -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
RegSvcs.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\qweruiuyt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\qweruiuyt\\qweruiuyt.exe" RegSvcs.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
winmedia.exedescription pid process target process PID 1352 set thread context of 552 1352 winmedia.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
-
Processes:
EXCEL.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 1644 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
RegSvcs.exepid process 552 RegSvcs.exe 552 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RegSvcs.exedescription pid process Token: SeDebugPrivilege 552 RegSvcs.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
EXCEL.EXEpid process 1644 EXCEL.EXE 1644 EXCEL.EXE 1644 EXCEL.EXE -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
EQNEDT32.EXEwinmedia.exedescription pid process target process PID 2032 wrote to memory of 1352 2032 EQNEDT32.EXE winmedia.exe PID 2032 wrote to memory of 1352 2032 EQNEDT32.EXE winmedia.exe PID 2032 wrote to memory of 1352 2032 EQNEDT32.EXE winmedia.exe PID 2032 wrote to memory of 1352 2032 EQNEDT32.EXE winmedia.exe PID 1352 wrote to memory of 1368 1352 winmedia.exe schtasks.exe PID 1352 wrote to memory of 1368 1352 winmedia.exe schtasks.exe PID 1352 wrote to memory of 1368 1352 winmedia.exe schtasks.exe PID 1352 wrote to memory of 1368 1352 winmedia.exe schtasks.exe PID 1352 wrote to memory of 552 1352 winmedia.exe RegSvcs.exe PID 1352 wrote to memory of 552 1352 winmedia.exe RegSvcs.exe PID 1352 wrote to memory of 552 1352 winmedia.exe RegSvcs.exe PID 1352 wrote to memory of 552 1352 winmedia.exe RegSvcs.exe PID 1352 wrote to memory of 552 1352 winmedia.exe RegSvcs.exe PID 1352 wrote to memory of 552 1352 winmedia.exe RegSvcs.exe PID 1352 wrote to memory of 552 1352 winmedia.exe RegSvcs.exe PID 1352 wrote to memory of 552 1352 winmedia.exe RegSvcs.exe PID 1352 wrote to memory of 552 1352 winmedia.exe RegSvcs.exe PID 1352 wrote to memory of 552 1352 winmedia.exe RegSvcs.exe PID 1352 wrote to memory of 552 1352 winmedia.exe RegSvcs.exe PID 1352 wrote to memory of 552 1352 winmedia.exe RegSvcs.exe
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\RFQ-2201847.xlsx1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\winmedia.exeC:\Users\Admin\AppData\Roaming\winmedia.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\KJsjFmxs" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF5D4.tmp"3⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpF5D4.tmpMD5
853a19056ee907bb5068a2ec8f30e256
SHA15a2ef8160dd5ea30ee24a7ee4b818ba5deb22eec
SHA256576f8948d1d9ce96393c20d9ba57ebb59909b85bb3beb690c1f6c8fc3bb08422
SHA5123556f422dc93ae142f48a734a7322af75ae8cc1f508df8b1f0262ce5a4739864cf47710015d1549699e4b1428e2dfd3a0000c75e4c49dba9f047f01f9c9204a2
-
C:\Users\Admin\AppData\Roaming\winmedia.exeMD5
555b48b7565f9087b9b2fe729033f749
SHA1c882dae67d048ed21e74330e1810f179ebd1998f
SHA2569b9fd1d526b912539aa4ee382927ba156c3de6c475b60a1358e99a98a65df09f
SHA51275e3782af8a4be9b51cda6918dfe31c35a83ac3bc983bc6956dc58a61d722cde583718887fd233ece02030f9a25baa9c4b3cd066686e00654dafa4f1514716fe
-
C:\Users\Admin\AppData\Roaming\winmedia.exeMD5
555b48b7565f9087b9b2fe729033f749
SHA1c882dae67d048ed21e74330e1810f179ebd1998f
SHA2569b9fd1d526b912539aa4ee382927ba156c3de6c475b60a1358e99a98a65df09f
SHA51275e3782af8a4be9b51cda6918dfe31c35a83ac3bc983bc6956dc58a61d722cde583718887fd233ece02030f9a25baa9c4b3cd066686e00654dafa4f1514716fe
-
\Users\Admin\AppData\Roaming\winmedia.exeMD5
555b48b7565f9087b9b2fe729033f749
SHA1c882dae67d048ed21e74330e1810f179ebd1998f
SHA2569b9fd1d526b912539aa4ee382927ba156c3de6c475b60a1358e99a98a65df09f
SHA51275e3782af8a4be9b51cda6918dfe31c35a83ac3bc983bc6956dc58a61d722cde583718887fd233ece02030f9a25baa9c4b3cd066686e00654dafa4f1514716fe
-
memory/552-80-0x00000000006C0000-0x00000000006C1000-memory.dmpFilesize
4KB
-
memory/552-78-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/552-77-0x000000000043760E-mapping.dmp
-
memory/552-76-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1352-65-0x0000000000000000-mapping.dmp
-
memory/1352-70-0x0000000005070000-0x0000000005071000-memory.dmpFilesize
4KB
-
memory/1352-71-0x00000000001C0000-0x00000000001CB000-memory.dmpFilesize
44KB
-
memory/1352-72-0x00000000054F0000-0x000000000556D000-memory.dmpFilesize
500KB
-
memory/1352-73-0x00000000004C0000-0x00000000004F9000-memory.dmpFilesize
228KB
-
memory/1352-68-0x0000000000910000-0x0000000000911000-memory.dmpFilesize
4KB
-
memory/1368-74-0x0000000000000000-mapping.dmp
-
memory/1644-60-0x000000002FD91000-0x000000002FD94000-memory.dmpFilesize
12KB
-
memory/1644-62-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1644-61-0x0000000070D71000-0x0000000070D73000-memory.dmpFilesize
8KB
-
memory/1644-81-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/2032-63-0x0000000075041000-0x0000000075043000-memory.dmpFilesize
8KB