agenttesla | 828803e774a6a8a421b89862344bcce0445e8f38664baa1ceea169633fb3a73a

General

Target

BANK COPY.doc
Size

440KB
MD5

978891042c401f4f06a7575d86c62533
SHA1

1e51fadad4f54b068a3693aec6693c78feba3ee0
SHA256

828803e774a6a8a421b89862344bcce0445e8f38664baa1ceea169633fb3a73a
SHA512

71dd81bae7d55713a4716a29ece7af66d5a6d73d835b08bda29fdefe9d98a8a11921b64d6825f52a9e55cc9c087008811abb330c8c247d0c573b0a4eca83adaa

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.vivaldi.net
Port:
587
Username:
[email protected]
Password:
payment@1234

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1724-78-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1724-79-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1724-80-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1724-81-0x000000000043762E-mapping.dmp	family_agenttesla
behavioral1/memory/1724-83-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Executes dropped EXE 2 IoCs

Processes:

BANK COPY.exeBANK COPY.exe

pid process

1536 BANK COPY.exe
1724 BANK COPY.exe
Loads dropped DLL 5 IoCs

Processes:

WINWORD.EXEBANK COPY.exe

pid process

1648 WINWORD.EXE
1648 WINWORD.EXE
1648 WINWORD.EXE
1648 WINWORD.EXE
1536 BANK COPY.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

BANK COPY.exe

description pid process target process

PID 1536 set thread context of 1724 1536 BANK COPY.exe BANK COPY.exe
Drops file in Windows directory 1 IoCs

Processes:

WINWORD.EXE

description ioc process

File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Office loads VBA resources, possible macro or embedded object present
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

908 schtasks.exe

pid	process
1536	BANK COPY.exe
1724	BANK COPY.exe

description	pid	process	target process
PID 1536 set thread context of 1724	1536	BANK COPY.exe	BANK COPY.exe

description	ioc	process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE

pid	process
908	schtasks.exe

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

Processes:

WINWORD.EXE

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE

Modifies registry class 64 IoCs

Processes:

WINWORD.EXE

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1"	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\ = "&Open"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\ = "&Edit"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\ShellEx	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\ = "&Open"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel"	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohevi.dll"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\ShellEx	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\ = "&Open"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ = "&Open"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon\ = "\"%1\""	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ = "&Open"	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

1648 WINWORD.EXE
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

BANK COPY.exeBANK COPY.exe

pid process

1536 BANK COPY.exe
1536 BANK COPY.exe
1724 BANK COPY.exe
1724 BANK COPY.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

BANK COPY.exeBANK COPY.exe

description pid process

Token: SeDebugPrivilege 1536 BANK COPY.exe
Token: SeDebugPrivilege 1724 BANK COPY.exe

pid	process
1536	BANK COPY.exe
1536	BANK COPY.exe
1724	BANK COPY.exe
1724	BANK COPY.exe

description	pid	process
Token: SeDebugPrivilege	1536	BANK COPY.exe
Token: SeDebugPrivilege	1724	BANK COPY.exe

Suspicious use of SetWindowsHookEx 16 IoCs

Processes:

WINWORD.EXE

pid	process
1648	WINWORD.EXE
1648	WINWORD.EXE
1648	WINWORD.EXE
1648	WINWORD.EXE
1648	WINWORD.EXE
1648	WINWORD.EXE
1648	WINWORD.EXE
1648	WINWORD.EXE
1648	WINWORD.EXE
1648	WINWORD.EXE
1648	WINWORD.EXE
1648	WINWORD.EXE
1648	WINWORD.EXE
1648	WINWORD.EXE
1648	WINWORD.EXE
1648	WINWORD.EXE

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

WINWORD.EXEBANK COPY.exe

description	pid	process	target process
PID 1648 wrote to memory of 396	1648	WINWORD.EXE	splwow64.exe
PID 1648 wrote to memory of 396	1648	WINWORD.EXE	splwow64.exe
PID 1648 wrote to memory of 396	1648	WINWORD.EXE	splwow64.exe
PID 1648 wrote to memory of 396	1648	WINWORD.EXE	splwow64.exe
PID 1648 wrote to memory of 1536	1648	WINWORD.EXE	BANK COPY.exe
PID 1648 wrote to memory of 1536	1648	WINWORD.EXE	BANK COPY.exe
PID 1648 wrote to memory of 1536	1648	WINWORD.EXE	BANK COPY.exe
PID 1648 wrote to memory of 1536	1648	WINWORD.EXE	BANK COPY.exe
PID 1536 wrote to memory of 908	1536	BANK COPY.exe	schtasks.exe
PID 1536 wrote to memory of 908	1536	BANK COPY.exe	schtasks.exe
PID 1536 wrote to memory of 908	1536	BANK COPY.exe	schtasks.exe
PID 1536 wrote to memory of 908	1536	BANK COPY.exe	schtasks.exe
PID 1536 wrote to memory of 1724	1536	BANK COPY.exe	BANK COPY.exe
PID 1536 wrote to memory of 1724	1536	BANK COPY.exe	BANK COPY.exe
PID 1536 wrote to memory of 1724	1536	BANK COPY.exe	BANK COPY.exe
PID 1536 wrote to memory of 1724	1536	BANK COPY.exe	BANK COPY.exe
PID 1536 wrote to memory of 1724	1536	BANK COPY.exe	BANK COPY.exe
PID 1536 wrote to memory of 1724	1536	BANK COPY.exe	BANK COPY.exe
PID 1536 wrote to memory of 1724	1536	BANK COPY.exe	BANK COPY.exe
PID 1536 wrote to memory of 1724	1536	BANK COPY.exe	BANK COPY.exe
PID 1536 wrote to memory of 1724	1536	BANK COPY.exe	BANK COPY.exe

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\BANK COPY.doc"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1648
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:396
- C:\Users\Admin\AppData\Local\Temp\BANK COPY.exe
  "C:\Users\Admin\AppData\Local\Temp\BANK COPY.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1536
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ntSpZrqZ" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2607.tmp"
    3⤵
    - Creates scheduled task(s)
    PID:908
- - C:\Users\Admin\AppData\Local\Temp\BANK COPY.exe
    "C:\Users\Admin\AppData\Local\Temp\BANK COPY.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1724

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\BANK COPY.exe

MD5
e6c4cc5d13cbcca766ec3f7370d3794d

SHA1
2fc631568b1d0202c9e637aac7331cb32575cf88

SHA256
dfe2eca5a711af26bcc1dd31db2d2dab3a65baffd35cf8bf0505dca19a21a7f5

SHA512
7fff07de70c7d53d5f4e59dcad42433f390fbd639e47b92f81e6d3d4ce7ea92c23f7f403f6bf1e56be7ab8b590273008f0da0f2294910f7fcf1769be82385ab4

Download Submit
C:\Users\Admin\AppData\Local\Temp\BANK COPY.exe

MD5
e6c4cc5d13cbcca766ec3f7370d3794d

SHA1
2fc631568b1d0202c9e637aac7331cb32575cf88

SHA256
dfe2eca5a711af26bcc1dd31db2d2dab3a65baffd35cf8bf0505dca19a21a7f5

SHA512
7fff07de70c7d53d5f4e59dcad42433f390fbd639e47b92f81e6d3d4ce7ea92c23f7f403f6bf1e56be7ab8b590273008f0da0f2294910f7fcf1769be82385ab4

Download Submit
C:\Users\Admin\AppData\Local\Temp\BANK COPY.exe

MD5
e6c4cc5d13cbcca766ec3f7370d3794d

SHA1
2fc631568b1d0202c9e637aac7331cb32575cf88

SHA256
dfe2eca5a711af26bcc1dd31db2d2dab3a65baffd35cf8bf0505dca19a21a7f5

SHA512
7fff07de70c7d53d5f4e59dcad42433f390fbd639e47b92f81e6d3d4ce7ea92c23f7f403f6bf1e56be7ab8b590273008f0da0f2294910f7fcf1769be82385ab4

Download Submit
\Users\Admin\AppData\Local\Temp\BANK COPY.exe

MD5
e6c4cc5d13cbcca766ec3f7370d3794d

SHA1
2fc631568b1d0202c9e637aac7331cb32575cf88

SHA256
dfe2eca5a711af26bcc1dd31db2d2dab3a65baffd35cf8bf0505dca19a21a7f5

SHA512
7fff07de70c7d53d5f4e59dcad42433f390fbd639e47b92f81e6d3d4ce7ea92c23f7f403f6bf1e56be7ab8b590273008f0da0f2294910f7fcf1769be82385ab4

Download Submit
\Users\Admin\AppData\Local\Temp\BANK COPY.exe

MD5
e6c4cc5d13cbcca766ec3f7370d3794d

SHA1
2fc631568b1d0202c9e637aac7331cb32575cf88

SHA256
dfe2eca5a711af26bcc1dd31db2d2dab3a65baffd35cf8bf0505dca19a21a7f5

SHA512
7fff07de70c7d53d5f4e59dcad42433f390fbd639e47b92f81e6d3d4ce7ea92c23f7f403f6bf1e56be7ab8b590273008f0da0f2294910f7fcf1769be82385ab4

Download Submit
\Users\Admin\AppData\Local\Temp\BANK COPY.exe

MD5
e6c4cc5d13cbcca766ec3f7370d3794d

SHA1
2fc631568b1d0202c9e637aac7331cb32575cf88

SHA256
dfe2eca5a711af26bcc1dd31db2d2dab3a65baffd35cf8bf0505dca19a21a7f5

SHA512
7fff07de70c7d53d5f4e59dcad42433f390fbd639e47b92f81e6d3d4ce7ea92c23f7f403f6bf1e56be7ab8b590273008f0da0f2294910f7fcf1769be82385ab4

Download Submit
\Users\Admin\AppData\Local\Temp\BANK COPY.exe

MD5
e6c4cc5d13cbcca766ec3f7370d3794d

SHA1
2fc631568b1d0202c9e637aac7331cb32575cf88

SHA256
dfe2eca5a711af26bcc1dd31db2d2dab3a65baffd35cf8bf0505dca19a21a7f5

SHA512
7fff07de70c7d53d5f4e59dcad42433f390fbd639e47b92f81e6d3d4ce7ea92c23f7f403f6bf1e56be7ab8b590273008f0da0f2294910f7fcf1769be82385ab4

Download Submit
\Users\Admin\AppData\Local\Temp\BANK COPY.exe

MD5
e6c4cc5d13cbcca766ec3f7370d3794d

SHA1
2fc631568b1d0202c9e637aac7331cb32575cf88

SHA256
dfe2eca5a711af26bcc1dd31db2d2dab3a65baffd35cf8bf0505dca19a21a7f5

SHA512
7fff07de70c7d53d5f4e59dcad42433f390fbd639e47b92f81e6d3d4ce7ea92c23f7f403f6bf1e56be7ab8b590273008f0da0f2294910f7fcf1769be82385ab4

Download Submit
memory/396-59-0x0000000000000000-mapping.dmp

Download
memory/396-60-0x000007FEFC461000-0x000007FEFC463000-memory.dmp

Filesize
8KB

Download
memory/908-74-0x0000000000000000-mapping.dmp

Download
memory/1536-71-0x0000000000500000-0x0000000000507000-memory.dmp

Filesize
28KB

Download
memory/1536-65-0x0000000000000000-mapping.dmp

Download
memory/1536-68-0x0000000001320000-0x0000000001321000-memory.dmp

Filesize
4KB

Download
memory/1536-72-0x00000000012C0000-0x00000000012C1000-memory.dmp

Filesize
4KB

Download
memory/1536-73-0x0000000004FD0000-0x0000000005028000-memory.dmp

Filesize
352KB

Download
memory/1648-55-0x0000000072DB1000-0x0000000072DB4000-memory.dmp

Filesize
12KB

Download
memory/1648-58-0x0000000076241000-0x0000000076243000-memory.dmp

Filesize
8KB

Download
memory/1648-57-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1648-56-0x0000000070831000-0x0000000070833000-memory.dmp

Filesize
8KB

Download
memory/1724-77-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1724-78-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1724-79-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1724-80-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1724-81-0x000000000043762E-mapping.dmp

Download
memory/1724-76-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1724-83-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1724-85-0x0000000000EE0000-0x0000000000EE1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads