Analysis

  • max time kernel
    104s
  • max time network
    134s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    26-01-2023 08:07

General

  • Target

    has been verified. However PDF, IMG, xlsx, .docx

  • Size

    10KB

  • MD5

    107fe2ac90955572fd89d53510ca9242

  • SHA1

    6a461ca59b3b132459447b5a975830f6617e5471

  • SHA256

    a99b49f2067ae486a530b63a38cc373ed8d28c0e7f60d5b24e4fc3e0fe60f677

  • SHA512

    1b3bd3a46e52e52ddc5436c88a00d4a82c6a151ff30faad6f76c7417ce46b46da1fcdc6e45d6942d8c978c4abc6354da6fd483ddcadb737e4a296d89fb60a08a

  • SSDEEP

    192:ScIMmtP8ar5G/bfIdTO5namWBX8ex6y3wrN:SPXt4ATO5nosMwZ

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot5940813834:AAF8mKehOQ2jtgluy4NISP8DYRvxgz__xCQ/

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 1 IoCs
  • Abuses OpenXML format to download file from external location 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Launches Equation Editor 1 TTPs 1 IoCs

    Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.

  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\has been verified. However PDF, IMG, xlsx, .docx"
    1⤵
    • Abuses OpenXML format to download file from external location
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2036
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:1232
    • C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
      "C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
      1⤵
      • Blocklisted process makes network request
      • Loads dropped DLL
      • Launches Equation Editor
      • Suspicious use of WriteProcessMemory
      PID:864
      • C:\Users\Public\vbc.exe
        "C:\Users\Public\vbc.exe"
        2⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:748
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
          3⤵
          • Accesses Microsoft Outlook profiles
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • outlook_office_path
          • outlook_win_path
          PID:1612

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Execution

    Scripting

    1
    T1064

    Exploitation for Client Execution

    1
    T1203

    Defense Evasion

    Scripting

    1
    T1064

    Modify Registry

    1
    T1112

    Collection

    Email Collection

    1
    T1114

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Public\vbc.exe
      Filesize

      715KB

      MD5

      f8c6822fe70e93d3645d98fb2f096f47

      SHA1

      8401789ffdd3df0861daea339bee4f19e2037d19

      SHA256

      18581776643e7ff918c5d6f8217e33b3ec7afe8c3df566a8d92833befb6e20b8

      SHA512

      8f8d6c72e37bbf9045b6cc3dff5844e9bf048d04a43582eae30a217bcc0f29389e8556310ad1af86f7fdc1e020e344fa3fbeb94285d9ed74d56b2b681861d652

    • C:\Users\Public\vbc.exe
      Filesize

      715KB

      MD5

      f8c6822fe70e93d3645d98fb2f096f47

      SHA1

      8401789ffdd3df0861daea339bee4f19e2037d19

      SHA256

      18581776643e7ff918c5d6f8217e33b3ec7afe8c3df566a8d92833befb6e20b8

      SHA512

      8f8d6c72e37bbf9045b6cc3dff5844e9bf048d04a43582eae30a217bcc0f29389e8556310ad1af86f7fdc1e020e344fa3fbeb94285d9ed74d56b2b681861d652

    • \Users\Public\vbc.exe
      Filesize

      715KB

      MD5

      f8c6822fe70e93d3645d98fb2f096f47

      SHA1

      8401789ffdd3df0861daea339bee4f19e2037d19

      SHA256

      18581776643e7ff918c5d6f8217e33b3ec7afe8c3df566a8d92833befb6e20b8

      SHA512

      8f8d6c72e37bbf9045b6cc3dff5844e9bf048d04a43582eae30a217bcc0f29389e8556310ad1af86f7fdc1e020e344fa3fbeb94285d9ed74d56b2b681861d652

    • \Users\Public\vbc.exe
      Filesize

      715KB

      MD5

      f8c6822fe70e93d3645d98fb2f096f47

      SHA1

      8401789ffdd3df0861daea339bee4f19e2037d19

      SHA256

      18581776643e7ff918c5d6f8217e33b3ec7afe8c3df566a8d92833befb6e20b8

      SHA512

      8f8d6c72e37bbf9045b6cc3dff5844e9bf048d04a43582eae30a217bcc0f29389e8556310ad1af86f7fdc1e020e344fa3fbeb94285d9ed74d56b2b681861d652

    • memory/748-73-0x0000000000CE0000-0x0000000000D1E000-memory.dmp
      Filesize

      248KB

    • memory/748-72-0x0000000005520000-0x0000000005596000-memory.dmp
      Filesize

      472KB

    • memory/748-71-0x0000000000560000-0x000000000056A000-memory.dmp
      Filesize

      40KB

    • memory/748-68-0x0000000000510000-0x0000000000520000-memory.dmp
      Filesize

      64KB

    • memory/748-66-0x0000000000F80000-0x0000000001038000-memory.dmp
      Filesize

      736KB

    • memory/748-63-0x0000000000000000-mapping.dmp
    • memory/1232-70-0x000007FEFBFB1000-0x000007FEFBFB3000-memory.dmp
      Filesize

      8KB

    • memory/1232-69-0x0000000000000000-mapping.dmp
    • memory/1612-80-0x000000000043773E-mapping.dmp
    • memory/1612-74-0x0000000000400000-0x000000000043C000-memory.dmp
      Filesize

      240KB

    • memory/1612-84-0x0000000000400000-0x000000000043C000-memory.dmp
      Filesize

      240KB

    • memory/1612-82-0x0000000000400000-0x000000000043C000-memory.dmp
      Filesize

      240KB

    • memory/1612-78-0x0000000000400000-0x000000000043C000-memory.dmp
      Filesize

      240KB

    • memory/1612-79-0x0000000000400000-0x000000000043C000-memory.dmp
      Filesize

      240KB

    • memory/1612-77-0x0000000000400000-0x000000000043C000-memory.dmp
      Filesize

      240KB

    • memory/1612-75-0x0000000000400000-0x000000000043C000-memory.dmp
      Filesize

      240KB

    • memory/2036-56-0x000000005FFF0000-0x0000000060000000-memory.dmp
      Filesize

      64KB

    • memory/2036-58-0x000000007153D000-0x0000000071548000-memory.dmp
      Filesize

      44KB

    • memory/2036-55-0x0000000070551000-0x0000000070553000-memory.dmp
      Filesize

      8KB

    • memory/2036-59-0x000000007153D000-0x0000000071548000-memory.dmp
      Filesize

      44KB

    • memory/2036-57-0x0000000075511000-0x0000000075513000-memory.dmp
      Filesize

      8KB

    • memory/2036-54-0x0000000072AD1000-0x0000000072AD4000-memory.dmp
      Filesize

      12KB

    • memory/2036-86-0x000000005FFF0000-0x0000000060000000-memory.dmp
      Filesize

      64KB

    • memory/2036-87-0x000000007153D000-0x0000000071548000-memory.dmp
      Filesize

      44KB