Analysis
-
max time kernel
152s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
21-05-2022 11:59
Static task
static1
Behavioral task
behavioral1
Sample
items 001.xlsm.exe
Resource
win7-20220414-en
General
-
Target
items 001.xlsm.exe
-
Size
859KB
-
MD5
fb7e94850448226bd2a498aa3b1563ea
-
SHA1
d700879ce59f46b7a774db6e4cb106245971e235
-
SHA256
2a4411192b4d6c488f67079fa17e4c245825df49a8858fadd887dd616ab1c0a3
-
SHA512
d43314e5e70070127c60813c026a928f5ee76fd92c94dee516adf6104b59337585fcab030e9678eb2447e67f1e9f355b7c20dc669569f8b1f164feb5dca6c631
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.villanika.gr - Port:
587 - Username:
info@villanika.gr - Password:
n2^-9wE@Wl}t
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4540-164-0x0000000000400000-0x0000000000452000-memory.dmp family_agenttesla -
Disables Task Manager via registry modification
-
Drops file in Drivers directory 1 IoCs
Processes:
RegSvcs.exedescription ioc process File opened for modification C:\Windows\system32\drivers\etc\hosts RegSvcs.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
items 001.xlsm.exeRegSvcs.exedescription pid process target process PID 1200 set thread context of 1648 1200 items 001.xlsm.exe RegSvcs.exe PID 1648 set thread context of 4540 1648 RegSvcs.exe RegSvcs.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3708 4540 WerFault.exe RegSvcs.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
RegSvcs.exeRegSvcs.exepid process 1648 RegSvcs.exe 1648 RegSvcs.exe 1648 RegSvcs.exe 1648 RegSvcs.exe 1648 RegSvcs.exe 1648 RegSvcs.exe 4540 RegSvcs.exe 4540 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
RegSvcs.exeRegSvcs.exedescription pid process Token: SeDebugPrivilege 1648 RegSvcs.exe Token: SeDebugPrivilege 4540 RegSvcs.exe -
Suspicious use of WriteProcessMemory 27 IoCs
Processes:
items 001.xlsm.exeRegSvcs.exeRegSvcs.exedescription pid process target process PID 1200 wrote to memory of 1648 1200 items 001.xlsm.exe RegSvcs.exe PID 1200 wrote to memory of 1648 1200 items 001.xlsm.exe RegSvcs.exe PID 1200 wrote to memory of 1648 1200 items 001.xlsm.exe RegSvcs.exe PID 1200 wrote to memory of 1648 1200 items 001.xlsm.exe RegSvcs.exe PID 1200 wrote to memory of 1648 1200 items 001.xlsm.exe RegSvcs.exe PID 1200 wrote to memory of 1648 1200 items 001.xlsm.exe RegSvcs.exe PID 1200 wrote to memory of 1648 1200 items 001.xlsm.exe RegSvcs.exe PID 1200 wrote to memory of 1648 1200 items 001.xlsm.exe RegSvcs.exe PID 1200 wrote to memory of 1648 1200 items 001.xlsm.exe RegSvcs.exe PID 1200 wrote to memory of 1648 1200 items 001.xlsm.exe RegSvcs.exe PID 1648 wrote to memory of 4712 1648 RegSvcs.exe RegSvcs.exe PID 1648 wrote to memory of 4712 1648 RegSvcs.exe RegSvcs.exe PID 1648 wrote to memory of 4712 1648 RegSvcs.exe RegSvcs.exe PID 1648 wrote to memory of 3732 1648 RegSvcs.exe RegSvcs.exe PID 1648 wrote to memory of 3732 1648 RegSvcs.exe RegSvcs.exe PID 1648 wrote to memory of 3732 1648 RegSvcs.exe RegSvcs.exe PID 1648 wrote to memory of 4540 1648 RegSvcs.exe RegSvcs.exe PID 1648 wrote to memory of 4540 1648 RegSvcs.exe RegSvcs.exe PID 1648 wrote to memory of 4540 1648 RegSvcs.exe RegSvcs.exe PID 1648 wrote to memory of 4540 1648 RegSvcs.exe RegSvcs.exe PID 1648 wrote to memory of 4540 1648 RegSvcs.exe RegSvcs.exe PID 1648 wrote to memory of 4540 1648 RegSvcs.exe RegSvcs.exe PID 1648 wrote to memory of 4540 1648 RegSvcs.exe RegSvcs.exe PID 1648 wrote to memory of 4540 1648 RegSvcs.exe RegSvcs.exe PID 4540 wrote to memory of 4148 4540 RegSvcs.exe REG.exe PID 4540 wrote to memory of 4148 4540 RegSvcs.exe REG.exe PID 4540 wrote to memory of 4148 4540 RegSvcs.exe REG.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\items 001.xlsm.exe"C:\Users\Admin\AppData\Local\Temp\items 001.xlsm.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"3⤵
- Drops file in Drivers directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\REG.exeREG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f4⤵
- Modifies registry key
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4540 -s 14804⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4540 -ip 45401⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegSvcs.exe.logFilesize
1KB
MD5400f1cc1a0a0ce1cdabda365ab3368ce
SHA11ecf683f14271d84f3b6063493dce00ff5f42075
SHA256c8fa64f4b69df13ed6408fd4a204f318a36c2f38c85d4a4d42adfc9173f73765
SHA51214c8cfd58d097e5e89c8cabe1e665173f1ccf604a9ef70cdcb84116e265f90819c19c891be408e0ad7e29086a5c2ea2883b7a7d1184878dbbac63e2cabcd1c45
-
memory/1200-130-0x00000000009A0000-0x0000000000A7E000-memory.dmpFilesize
888KB
-
memory/1200-131-0x000000000AEF0000-0x000000000B494000-memory.dmpFilesize
5.6MB
-
memory/1200-132-0x000000000A940000-0x000000000A9D2000-memory.dmpFilesize
584KB
-
memory/1200-133-0x00000000053E0000-0x00000000053EA000-memory.dmpFilesize
40KB
-
memory/1200-134-0x0000000005660000-0x00000000056FC000-memory.dmpFilesize
624KB
-
memory/1648-146-0x0000000000400000-0x0000000000488000-memory.dmpFilesize
544KB
-
memory/1648-155-0x0000000000400000-0x0000000000488000-memory.dmpFilesize
544KB
-
memory/1648-139-0x0000000000400000-0x0000000000488000-memory.dmpFilesize
544KB
-
memory/1648-140-0x0000000000400000-0x0000000000488000-memory.dmpFilesize
544KB
-
memory/1648-141-0x0000000000400000-0x0000000000488000-memory.dmpFilesize
544KB
-
memory/1648-142-0x0000000000400000-0x0000000000488000-memory.dmpFilesize
544KB
-
memory/1648-143-0x0000000000400000-0x0000000000488000-memory.dmpFilesize
544KB
-
memory/1648-144-0x0000000000400000-0x0000000000488000-memory.dmpFilesize
544KB
-
memory/1648-136-0x0000000000400000-0x0000000000488000-memory.dmpFilesize
544KB
-
memory/1648-147-0x0000000000400000-0x0000000000488000-memory.dmpFilesize
544KB
-
memory/1648-149-0x0000000000400000-0x0000000000488000-memory.dmpFilesize
544KB
-
memory/1648-151-0x0000000000400000-0x0000000000488000-memory.dmpFilesize
544KB
-
memory/1648-152-0x0000000000400000-0x0000000000488000-memory.dmpFilesize
544KB
-
memory/1648-138-0x0000000000400000-0x0000000000488000-memory.dmpFilesize
544KB
-
memory/1648-157-0x0000000000400000-0x0000000000488000-memory.dmpFilesize
544KB
-
memory/1648-158-0x0000000000400000-0x0000000000488000-memory.dmpFilesize
544KB
-
memory/1648-160-0x0000000000400000-0x0000000000488000-memory.dmpFilesize
544KB
-
memory/1648-135-0x0000000000000000-mapping.dmp
-
memory/3732-162-0x0000000000000000-mapping.dmp
-
memory/4148-167-0x0000000000000000-mapping.dmp
-
memory/4540-163-0x0000000000000000-mapping.dmp
-
memory/4540-164-0x0000000000400000-0x0000000000452000-memory.dmpFilesize
328KB
-
memory/4540-166-0x0000000005DC0000-0x0000000005E26000-memory.dmpFilesize
408KB
-
memory/4540-168-0x0000000006210000-0x0000000006260000-memory.dmpFilesize
320KB
-
memory/4712-161-0x0000000000000000-mapping.dmp