General

  • Target

    HR approval announcement for annual open vacation plan.exe

  • Size

    673KB

  • Sample

    221128-mrbkwsce4v

  • MD5

    2305ae8629b667d0098cfb85b4df3ba7

  • SHA1

    aa682b558cb4886e1d6bc5faa03570dbaf3db915

  • SHA256

    6e54e29b53682fa0e89848a7fca8f33f459876428ca0d5ec56d942545100ade9

  • SHA512

    0f3584a594d32234c53a0e6d3e08f3c940e76283c978687e1d5033ef7ecaee5e0180a70055e50818321d78737b79b9c2bc2f021f42f88a1e057fb121de2d7b3d

  • SSDEEP

    12288:v1cLpbKbfhwLGlNsa3bcfCQgFyhronjcN3mcWg/0k2hEi+:vO9bKtSGlH3bcfTUnEBWI0k2

Malware Config

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    smtp.yandex.com
  • Port:
    587
  • Username:
    wise1ne@yandex.com
  • Password:
    Password.000

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    smtp.yandex.com
  • Port:
    587
  • Username:
    wise1ne@yandex.com
  • Password:
    Password.000

Targets

    • Target

      HR approval announcement for annual open vacation plan.exe

    • Size

      673KB

    • MD5

      2305ae8629b667d0098cfb85b4df3ba7

    • SHA1

      aa682b558cb4886e1d6bc5faa03570dbaf3db915

    • SHA256

      6e54e29b53682fa0e89848a7fca8f33f459876428ca0d5ec56d942545100ade9

    • SHA512

      0f3584a594d32234c53a0e6d3e08f3c940e76283c978687e1d5033ef7ecaee5e0180a70055e50818321d78737b79b9c2bc2f021f42f88a1e057fb121de2d7b3d

    • SSDEEP

      12288:v1cLpbKbfhwLGlNsa3bcfCQgFyhronjcN3mcWg/0k2hEi+:vO9bKtSGlH3bcfTUnEBWI0k2

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Credential Access

Credentials in Files

3
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Collection

Data from Local System

3
T1005

Email Collection

1
T1114

Tasks