Analysis
- max time kernel
133s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20220310-en - submitted
11/04/2022, 17:29
General
- Target 00101GHDB2022.xls
- Size 38KB
- Sample220411-v2jm9abba2
- SHA256 ba40d672744d9fea782381b7b609bc2cb381437d94afdaf458e17e8be0271fc2
Malware Config
Extracted
-
agenttesla
-
https://api.telegram.org/bot5099610183:AAGv1rqCueTCpJI237fn-NcdTSUGTq_-GNY/sendDocument
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Downloads MZ/PE file
- Executes dropped EXE 4 IoCs
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 10 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SendNotifyMessage 1 IoCs
- Suspicious use of SetWindowsHookEx 13 IoCs
- Suspicious use of WriteProcessMemory 14 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\00101GHDB2022.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\dropped.exeC:\Users\Admin\AppData\Local\Temp\dropped.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\dropped.exe"C:\Users\Admin\AppData\Local\Temp\dropped.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\dropped.exe"C:\Users\Admin\AppData\Local\Temp\dropped.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\dropped.exe"C:\Users\Admin\AppData\Local\Temp\dropped.exe"2⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
dropped.exe.log
dropped.exe
dropped.exe
dropped.exe
dropped.exe
dropped.exe
memory/1584-146-0x0000000008340000-0x00000000083A6000-memory.dmp
memory/1584-143-0x0000000005510000-0x00000000055A2000-memory.dmp
memory/1584-144-0x00000000054F0000-0x00000000054FA000-memory.dmp
memory/1584-145-0x0000000007CC0000-0x0000000007D5C000-memory.dmp
memory/1584-141-0x0000000000A60000-0x0000000000B4E000-memory.dmp
memory/1584-142-0x0000000005BC0000-0x0000000006164000-memory.dmp
memory/4792-155-0x0000000006880000-0x00000000068D0000-memory.dmp
memory/4792-152-0x0000000000400000-0x000000000043A000-memory.dmp
memory/4964-137-0x00007FFA3ACB0000-0x00007FFA3ACC0000-memory.dmp
memory/4964-138-0x00007FFA3ACB0000-0x00007FFA3ACC0000-memory.dmp
memory/4964-136-0x00007FFA3ACB0000-0x00007FFA3ACC0000-memory.dmp
memory/4964-135-0x00007FFA3ACB0000-0x00007FFA3ACC0000-memory.dmp
memory/4964-134-0x00007FFA3ACB0000-0x00007FFA3ACC0000-memory.dmp
memory/4964-156-0x00007FFA3ACB0000-0x00007FFA3ACC0000-memory.dmp
memory/4964-157-0x00007FFA3ACB0000-0x00007FFA3ACC0000-memory.dmp
memory/4964-158-0x00007FFA3ACB0000-0x00007FFA3ACC0000-memory.dmp
memory/4964-159-0x00007FFA3ACB0000-0x00007FFA3ACC0000-memory.dmp