Overview

overview

10

Static

static

BOOKING- ...65.rtf

windows7-x64

10

BOOKING- ...65.rtf

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    BOOKING- SHIPMENT DOCS- ORDER # 10038574 & 10038565.doc

  • Size

    25KB

  • Sample

    221207-xq538aff96

  • MD5

    76ce4cfe5dad029abff24fc30be1403d

  • SHA1

    effbcd4525862d04b16cc0147847af534c0de83d

  • SHA256

    9556c06806c14dfcfc716d3d8ec91fff72cf5fefee8c28c77af9c07d915895b9

  • SHA512

    a39b4532a0b46ddcae44a1bea090b1d6cdd81047a8509431f42ff8f4e9cec909474a3a01e33fc02def6703538db66ff462258d2a2af5aa4e2c00a20e065bed32

  • SSDEEP

    768:KFx0XaIsnPRIa4fwJMjpIAO/G94/gjFUGm:Kf0Xvx3EMyTG94IRg

Score
10/10
agentteslacollectionkeyloggerspywarestealertrojan

Malware Config

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtp.yandex.com
  • Port:
    587
  • Username:
    andreasconstant@yandex.com
  • Password:
    DreamChaser101

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    smtp.yandex.com
  • Port:
    587
  • Username:
    andreasconstant@yandex.com
  • Password:
    DreamChaser101

Targets

    • Target

      BOOKING- SHIPMENT DOCS- ORDER # 10038574 & 10038565.doc

    • Size

      25KB

    • MD5

      76ce4cfe5dad029abff24fc30be1403d

    • SHA1

      effbcd4525862d04b16cc0147847af534c0de83d

    • SHA256

      9556c06806c14dfcfc716d3d8ec91fff72cf5fefee8c28c77af9c07d915895b9

    • SHA512

      a39b4532a0b46ddcae44a1bea090b1d6cdd81047a8509431f42ff8f4e9cec909474a3a01e33fc02def6703538db66ff462258d2a2af5aa4e2c00a20e065bed32

    • SSDEEP

      768:KFx0XaIsnPRIa4fwJMjpIAO/G94/gjFUGm:Kf0Xvx3EMyTG94IRg

    Score
    10/10
    agentteslacollectionkeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Exploitation for Client Execution

1
T1203

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks