agenttesla | ddb6e90b3fd4767a65a7d190e7dda1994108c268e94efe307be80e6cce56eda2

General

Target

RFQ-2201847.xlsx
Size

2.1MB
MD5

7835c3614e688a977aeb63cafdd04d23
SHA1

c6b11868797ad66a460030da17c76f5eeee8bbda
SHA256

ddb6e90b3fd4767a65a7d190e7dda1994108c268e94efe307be80e6cce56eda2
SHA512

cd53a0cef5f0da591330a79fd6b8420005b252a49ad8c9806f7d904c89c045b5b7deb67971132a5f297d32a67f403372f19690b6c3ded900e28eebd9a9558e5f

Score

10^/10

agenttesla keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.yandex.com
Port:
587
Username:
[email protected]
Password:
Rollingstone147

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/552-76-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/552-77-0x000000000043760E-mapping.dmp	family_agenttesla
behavioral1/memory/552-78-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

CustAttr .NET packer 1 IoCs

Detects CustAttr .NET packer in memory.

Processes:

resource	yara_rule
behavioral1/memory/1352-71-0x00000000001C0000-0x00000000001CB000-memory.dmp	CustAttr

Blocklisted process makes network request 1 IoCs

Processes:

EQNEDT32.EXE

flow pid process

6 2032 EQNEDT32.EXE
Downloads MZ/PE file
Executes dropped EXE 1 IoCs

Processes:

winmedia.exe

pid process

1352 winmedia.exe
Loads dropped DLL 1 IoCs

Processes:

EQNEDT32.EXE

pid process

2032 EQNEDT32.EXE

flow	pid	process
6	2032	EQNEDT32.EXE

pid	process
1352	winmedia.exe

pid	process
2032	EQNEDT32.EXE

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

RegSvcs.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\qweruiuyt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\qweruiuyt\\qweruiuyt.exe"	RegSvcs.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

winmedia.exe

description pid process target process

PID 1352 set thread context of 552 1352 winmedia.exe RegSvcs.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1368 schtasks.exe
Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry
T1012

System Information Discovery
T1082

Processes:

EXCEL.EXE

description ioc process

Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE
Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
exploit

Exploitation for Client Execution
T1203

Processes:

EQNEDT32.EXE

pid process

2032 EQNEDT32.EXE

description	pid	process	target process
PID 1352 set thread context of 552	1352	winmedia.exe	RegSvcs.exe

pid	process
1368	schtasks.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE

pid	process
2032	EQNEDT32.EXE

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

Processes:

EXCEL.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

1644 EXCEL.EXE
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

RegSvcs.exe

pid process

552 RegSvcs.exe
552 RegSvcs.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RegSvcs.exe

description pid process

Token: SeDebugPrivilege 552 RegSvcs.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

EXCEL.EXE

pid process

1644 EXCEL.EXE
1644 EXCEL.EXE
1644 EXCEL.EXE

pid	process
1644	EXCEL.EXE

pid	process
552	RegSvcs.exe
552	RegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	552	RegSvcs.exe

pid	process
1644	EXCEL.EXE
1644	EXCEL.EXE
1644	EXCEL.EXE

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

EQNEDT32.EXEwinmedia.exe

description	pid	process	target process
PID 2032 wrote to memory of 1352	2032	EQNEDT32.EXE	winmedia.exe
PID 2032 wrote to memory of 1352	2032	EQNEDT32.EXE	winmedia.exe
PID 2032 wrote to memory of 1352	2032	EQNEDT32.EXE	winmedia.exe
PID 2032 wrote to memory of 1352	2032	EQNEDT32.EXE	winmedia.exe
PID 1352 wrote to memory of 1368	1352	winmedia.exe	schtasks.exe
PID 1352 wrote to memory of 1368	1352	winmedia.exe	schtasks.exe
PID 1352 wrote to memory of 1368	1352	winmedia.exe	schtasks.exe
PID 1352 wrote to memory of 1368	1352	winmedia.exe	schtasks.exe
PID 1352 wrote to memory of 552	1352	winmedia.exe	RegSvcs.exe
PID 1352 wrote to memory of 552	1352	winmedia.exe	RegSvcs.exe
PID 1352 wrote to memory of 552	1352	winmedia.exe	RegSvcs.exe
PID 1352 wrote to memory of 552	1352	winmedia.exe	RegSvcs.exe
PID 1352 wrote to memory of 552	1352	winmedia.exe	RegSvcs.exe
PID 1352 wrote to memory of 552	1352	winmedia.exe	RegSvcs.exe
PID 1352 wrote to memory of 552	1352	winmedia.exe	RegSvcs.exe
PID 1352 wrote to memory of 552	1352	winmedia.exe	RegSvcs.exe
PID 1352 wrote to memory of 552	1352	winmedia.exe	RegSvcs.exe
PID 1352 wrote to memory of 552	1352	winmedia.exe	RegSvcs.exe
PID 1352 wrote to memory of 552	1352	winmedia.exe	RegSvcs.exe
PID 1352 wrote to memory of 552	1352	winmedia.exe	RegSvcs.exe

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\RFQ-2201847.xlsx
1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1644

C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
PID:2032

C:\Users\Admin\AppData\Roaming\winmedia.exe
C:\Users\Admin\AppData\Roaming\winmedia.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1352

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\KJsjFmxs" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF5D4.tmp"
3⤵
- Creates scheduled task(s)
PID:1368

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
3⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:552

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Exploitation for Client Execution

1

T1203

Persistence

Registry Run Keys / Startup Folder

1

T1060

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

2

T1082

Query Registry

1

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpF5D4.tmp
MD5
853a19056ee907bb5068a2ec8f30e256

SHA1
5a2ef8160dd5ea30ee24a7ee4b818ba5deb22eec

SHA256
576f8948d1d9ce96393c20d9ba57ebb59909b85bb3beb690c1f6c8fc3bb08422

SHA512
3556f422dc93ae142f48a734a7322af75ae8cc1f508df8b1f0262ce5a4739864cf47710015d1549699e4b1428e2dfd3a0000c75e4c49dba9f047f01f9c9204a2

Download Submit
C:\Users\Admin\AppData\Roaming\winmedia.exe
MD5
555b48b7565f9087b9b2fe729033f749

SHA1
c882dae67d048ed21e74330e1810f179ebd1998f

SHA256
9b9fd1d526b912539aa4ee382927ba156c3de6c475b60a1358e99a98a65df09f

SHA512
75e3782af8a4be9b51cda6918dfe31c35a83ac3bc983bc6956dc58a61d722cde583718887fd233ece02030f9a25baa9c4b3cd066686e00654dafa4f1514716fe

Download Submit
C:\Users\Admin\AppData\Roaming\winmedia.exe
MD5
555b48b7565f9087b9b2fe729033f749

SHA1
c882dae67d048ed21e74330e1810f179ebd1998f

SHA256
9b9fd1d526b912539aa4ee382927ba156c3de6c475b60a1358e99a98a65df09f

SHA512
75e3782af8a4be9b51cda6918dfe31c35a83ac3bc983bc6956dc58a61d722cde583718887fd233ece02030f9a25baa9c4b3cd066686e00654dafa4f1514716fe

Download Submit
\Users\Admin\AppData\Roaming\winmedia.exe
MD5
555b48b7565f9087b9b2fe729033f749

SHA1
c882dae67d048ed21e74330e1810f179ebd1998f

SHA256
9b9fd1d526b912539aa4ee382927ba156c3de6c475b60a1358e99a98a65df09f

SHA512
75e3782af8a4be9b51cda6918dfe31c35a83ac3bc983bc6956dc58a61d722cde583718887fd233ece02030f9a25baa9c4b3cd066686e00654dafa4f1514716fe

Download Submit
memory/552-80-0x00000000006C0000-0x00000000006C1000-memory.dmp

Filesize
4KB

Download
memory/552-78-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/552-77-0x000000000043760E-mapping.dmp

Download
memory/552-76-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1352-65-0x0000000000000000-mapping.dmp

Download
memory/1352-70-0x0000000005070000-0x0000000005071000-memory.dmp

Filesize
4KB

Download
memory/1352-71-0x00000000001C0000-0x00000000001CB000-memory.dmp

Filesize
44KB

Download
memory/1352-72-0x00000000054F0000-0x000000000556D000-memory.dmp

Filesize
500KB

Download
memory/1352-73-0x00000000004C0000-0x00000000004F9000-memory.dmp

Filesize
228KB

Download
memory/1352-68-0x0000000000910000-0x0000000000911000-memory.dmp

Filesize
4KB

Download
memory/1368-74-0x0000000000000000-mapping.dmp

Download
memory/1644-60-0x000000002FD91000-0x000000002FD94000-memory.dmp

Filesize
12KB

Download
memory/1644-62-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1644-61-0x0000000070D71000-0x0000000070D73000-memory.dmp

Filesize
8KB

Download
memory/1644-81-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2032-63-0x0000000075041000-0x0000000075043000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads