General

  • Target

    REVISED INVOICE.xlsx

  • Size

    180KB

  • Sample

    221003-h1hcksecdj

  • MD5

    4f12f3d51d9d16c64b0a4b826bbc5b11

  • SHA1

    f1e8d4ac587fc56e83fff309b7e4684298e3d8c0

  • SHA256

    29013957f0c83fb4e8b4c8e8461b17987fa66101fc438c07d0e89c42aa3db4e2

  • SHA512

    e1cbe000d390c3a276a7b067fabdb25814aea2b96c06375171a72d8c65992c46e12806a5fc77272034ec1be5ef0653c980f5d2e5546cea8d64895d128e58a0ee

  • SSDEEP

    3072:OuLGZNKq0qSv+tiKx9RT8FhaWAbVnXLxZryxVsE3h3SY2W8U+6oEgVPAsW+mS:4ZNwVv0GtA9XdxyYER3d2W8hFEgRAr+P

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot2134979594:AAFk4QkrlHlt2a-q-EhIoHZBbzxSH0QxiBI/sendDocument

Targets

    • Target

      REVISED INVOICE.xlsx

    • Size

      180KB

    • MD5

      4f12f3d51d9d16c64b0a4b826bbc5b11

    • SHA1

      f1e8d4ac587fc56e83fff309b7e4684298e3d8c0

    • SHA256

      29013957f0c83fb4e8b4c8e8461b17987fa66101fc438c07d0e89c42aa3db4e2

    • SHA512

      e1cbe000d390c3a276a7b067fabdb25814aea2b96c06375171a72d8c65992c46e12806a5fc77272034ec1be5ef0653c980f5d2e5546cea8d64895d128e58a0ee

    • SSDEEP

      3072:OuLGZNKq0qSv+tiKx9RT8FhaWAbVnXLxZryxVsE3h3SY2W8U+6oEgVPAsW+mS:4ZNwVv0GtA9XdxyYER3d2W8hFEgRAr+P

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • AgentTesla payload

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Drops file in Drivers directory

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scripting

1
T1064

Exploitation for Client Execution

1
T1203

Defense Evasion

Scripting

1
T1064

Modify Registry

1
T1112

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Tasks