agenttesla | 4f25edbad3cf2f2cdd2ebb591ca119cef1df895e01d34012fb4292340b3045c4

Analysis

max time kernel
99s
max time network
104s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
05/07/2023, 01:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4f25edbad3cf2f2cdd2ebb591ca119cef1df895e01d34012fb4292340b3045c4.docx
Size

10KB
MD5

75b5fb86bd2cc8fc41d253b5b90a767f
SHA1

4370d24b51f5689172afe913527f76b276e5c0cc
SHA256

4f25edbad3cf2f2cdd2ebb591ca119cef1df895e01d34012fb4292340b3045c4
SHA512

6035561fa54da886b06331e8c53be563c1d16423c515b13141c3ed03ebad443fe613a6d0c68b7009a3cc49e0a987c4f3e1ae4d1330538e3b00867de7fec95a84
SSDEEP

192:Rya0N09FtWvARgZVPCK44AG9xXSJ+Ej7vJYtKwuKovDWYZcWe5F9u6:RyX09FtWvANK4499xXSJf7vJYtG6YZOT

Score

10^/10

agenttesla collection keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.gmail.com
Port:
587
Username:
[email protected]
Password:
tgpirxryibfagkfs
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Blocklisted process makes network request 1 IoCs

flow	pid	Process
6	2656	EQNEDT32.EXE

Downloads MZ/PE file
Abuses OpenXML format to download file from external location

Executes dropped EXE 3 IoCs

pid	Process
2680	obinier457846.exe
808	obinier457846.exe
668	obinier457846.exe

Loads dropped DLL 1 IoCs

pid	Process
2656	EQNEDT32.EXE

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	obinier457846.exe
Key opened	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	obinier457846.exe
Key opened	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	obinier457846.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
8	api.ipify.org
9	api.ipify.org

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2680 set thread context of 668	2680	obinier457846.exe	37

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Office loads VBA resources, possible macro or embedded object present

Launches Equation Editor 1 TTPs 1 IoCs

Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.

exploit

Exploitation for Client Execution

T1203

pid	Process
2656	EQNEDT32.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1800	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2680	obinier457846.exe
2680	obinier457846.exe
2188	powershell.exe
668	obinier457846.exe
668	obinier457846.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2680	obinier457846.exe
Token: SeDebugPrivilege	668	obinier457846.exe
Token: SeDebugPrivilege	2188	powershell.exe
Token: SeShutdownPrivilege	1800	WINWORD.EXE

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1800	WINWORD.EXE
1800	WINWORD.EXE
668	obinier457846.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 2656 wrote to memory of 2680	2656	EQNEDT32.EXE	30
PID 2656 wrote to memory of 2680	2656	EQNEDT32.EXE	30
PID 2656 wrote to memory of 2680	2656	EQNEDT32.EXE	30
PID 2656 wrote to memory of 2680	2656	EQNEDT32.EXE	30
PID 1800 wrote to memory of 604	1800	WINWORD.EXE	33
PID 1800 wrote to memory of 604	1800	WINWORD.EXE	33
PID 1800 wrote to memory of 604	1800	WINWORD.EXE	33
PID 1800 wrote to memory of 604	1800	WINWORD.EXE	33
PID 2680 wrote to memory of 2188	2680	obinier457846.exe	34
PID 2680 wrote to memory of 2188	2680	obinier457846.exe	34
PID 2680 wrote to memory of 2188	2680	obinier457846.exe	34
PID 2680 wrote to memory of 2188	2680	obinier457846.exe	34
PID 2680 wrote to memory of 808	2680	obinier457846.exe	36
PID 2680 wrote to memory of 808	2680	obinier457846.exe	36
PID 2680 wrote to memory of 808	2680	obinier457846.exe	36
PID 2680 wrote to memory of 808	2680	obinier457846.exe	36
PID 2680 wrote to memory of 668	2680	obinier457846.exe	37
PID 2680 wrote to memory of 668	2680	obinier457846.exe	37
PID 2680 wrote to memory of 668	2680	obinier457846.exe	37
PID 2680 wrote to memory of 668	2680	obinier457846.exe	37
PID 2680 wrote to memory of 668	2680	obinier457846.exe	37
PID 2680 wrote to memory of 668	2680	obinier457846.exe	37
PID 2680 wrote to memory of 668	2680	obinier457846.exe	37
PID 2680 wrote to memory of 668	2680	obinier457846.exe	37
PID 2680 wrote to memory of 668	2680	obinier457846.exe	37

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	obinier457846.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	obinier457846.exe

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\4f25edbad3cf2f2cdd2ebb591ca119cef1df895e01d34012fb4292340b3045c4.docx"
1⤵
- Drops file in Windows directory
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1800
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:604

C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
PID:2656
- C:\Users\Admin\AppData\Roaming\obinier457846.exe
  "C:\Users\Admin\AppData\Roaming\obinier457846.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2680
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\obinier457846.exe"
    3⤵
    - Drops file in System32 directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2188
- - C:\Users\Admin\AppData\Roaming\obinier457846.exe
    "C:\Users\Admin\AppData\Roaming\obinier457846.exe"
    3⤵
    - Executes dropped EXE
    PID:808
- - C:\Users\Admin\AppData\Roaming\obinier457846.exe
    "C:\Users\Admin\AppData\Roaming\obinier457846.exe"
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - outlook_office_path
    - outlook_win_path
    PID:668

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Exploitation for Client Execution

T1203

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\FSD-CNRY.FSD

Filesize
128KB

MD5
4cbd2d9ee8687e4d97e9e9331384a6b3

SHA1
2d0de682113873c4f6cfa9affe48722dbd2391a1

SHA256
02e2db970994576f5bbd6ad0c099582f5c72d40dd6828b444c48b0ded0e738e5

SHA512
72e88fb94ae5c92546e48db9782a7e4e31a0c95679616078c4d7404afdfa5af1bf55f3bf97a785fb3be034a9806b3e8c2d2deb1cc459f37cc7c190b5f7679669

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSD-CNRY.FSD

Filesize
128KB

MD5
2b97e0d31a403c4200ed4fe65ef99833

SHA1
6294ef16482b9bdb8c86098a2031881c6e238051

SHA256
c6791ac874733bbedc989f64a9e56873cd76d650e72a48d7a42e6167435355b5

SHA512
3d3e84cce279410730dc0fee0f103ab06abf40b5c8db56bede99febdaf18c07d79bcbb6b03bd7c29fa18b358ffd88f126d0994f25472ee521a426f16906dcf41

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSD-{4D24FF0B-ABDB-4517-8664-08A4A448EB10}.FSD

Filesize
128KB

MD5
c8b4beb207aa03eec59ff65c342810f4

SHA1
c52820bd1f7ab956223a7029c78d0ff1ce0dddfb

SHA256
943750a7396f42f75a4df1b491a4c1ea655a525cccc07a856cf1068e83375380

SHA512
1294863315aa835fd1f7e9ae643790ca42ca09dd4e1692c3bcdbb36db20e13aace177b7e40ee35cf6c10b4e42040cb6d48fa8620f37c666d1f5424a6cd323124

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JHFV4GXP\obizx[1].doc

Filesize
27KB

MD5
4ba517cee0b4e4c77e6178a1f77d862b

SHA1
1b5bb3efa1bb347352dc7bceae7bb55b0819eb91

SHA256
741f2c4f961034604f560c89ada5369e772eac51def7ebd6b4ac7840f8d0562e

SHA512
bf57232240e62a7957bb8081ad5355a392cdc6133766947e566614340b8ae96d2bc8ad6c38e2024a9096eb63ca491b8bb51dce8d76451e273c0a92dd0eb2f609

Download Submit
C:\Users\Admin\AppData\Local\Temp\{930C85BB-B927-4354-8560-B5E1DD390347}

Filesize
128KB

MD5
37db371d13b5a78081e066bae7b11a9a

SHA1
6066fde0f5219450c53b6b1dc098539efe314974

SHA256
4e3dd0a05a0ce54e8ae2d0a10d4048c7af00a352c95be1a9107227a3739a5077

SHA512
d9b5ea61b5a61607e8ad8a0c7d0d52e2ca68f64d21e0ee7991a75b4775e8e0339fe570e5057e3d56c8ce32060d529220589d29d7d061b977f937923c673537a8

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

Filesize
57B

MD5
e703f2159cad75a31759b2a55359281f

SHA1
41b6e0e9c8896aa7c934b9765300c6c65d2ecd59

SHA256
db330a6567ad0ff2cf0396dfbbe973369f16a07a155ca6c8a2187afb7104d9ee

SHA512
e0541fbf81cddc199d2111487d018ebae5f3dd291cdb765b0fe18e35b0f3f7846717bca15c71531d889ce041505fdb8e37df903ca993610b791c73ac4204eec7

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

Filesize
20KB

MD5
a082c193e56600b7fc368b70d2cc1684

SHA1
d16b11b36fec89063549f5c9b71c68b7497b6685

SHA256
c0246ad46db9835f59b3e743c5ace993b85dc809122bada4a9b9d15e7e405186

SHA512
049bd6c3b034a188f33e40ce5171b43e9c6efbc581af9ee308450514c491b2fa6383e701dac1730d4cdc8417dfbaae7ae0747c94bf378a3df9eb769afeb7381d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lex

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Roaming\obinier457846.exe

Filesize
706KB

MD5
c1095a10913a5b0bf7952a253fc80d59

SHA1
cef63c5a0e9a3f82524b9d7a7c04592e2eaf0a0b

SHA256
7fa82e801a137ca5986e6d7544be241063e9bb46c5b03398b84a6a75acc52f1c

SHA512
dccdc197d03268809d7827725af05584277bdbd3df5e37a264bdc50e1250709d9f7a991a453f29154db43c7c59a409a80dac231351bb1b94693d3bc70cc3856f

Download Submit
C:\Users\Admin\AppData\Roaming\obinier457846.exe

Filesize
706KB

MD5
c1095a10913a5b0bf7952a253fc80d59

SHA1
cef63c5a0e9a3f82524b9d7a7c04592e2eaf0a0b

SHA256
7fa82e801a137ca5986e6d7544be241063e9bb46c5b03398b84a6a75acc52f1c

SHA512
dccdc197d03268809d7827725af05584277bdbd3df5e37a264bdc50e1250709d9f7a991a453f29154db43c7c59a409a80dac231351bb1b94693d3bc70cc3856f

Download Submit
C:\Users\Admin\AppData\Roaming\obinier457846.exe

Filesize
706KB

MD5
c1095a10913a5b0bf7952a253fc80d59

SHA1
cef63c5a0e9a3f82524b9d7a7c04592e2eaf0a0b

SHA256
7fa82e801a137ca5986e6d7544be241063e9bb46c5b03398b84a6a75acc52f1c

SHA512
dccdc197d03268809d7827725af05584277bdbd3df5e37a264bdc50e1250709d9f7a991a453f29154db43c7c59a409a80dac231351bb1b94693d3bc70cc3856f

Download Submit
C:\Users\Admin\AppData\Roaming\obinier457846.exe

Filesize
706KB

MD5
c1095a10913a5b0bf7952a253fc80d59

SHA1
cef63c5a0e9a3f82524b9d7a7c04592e2eaf0a0b

SHA256
7fa82e801a137ca5986e6d7544be241063e9bb46c5b03398b84a6a75acc52f1c

SHA512
dccdc197d03268809d7827725af05584277bdbd3df5e37a264bdc50e1250709d9f7a991a453f29154db43c7c59a409a80dac231351bb1b94693d3bc70cc3856f

Download Submit
C:\Users\Admin\AppData\Roaming\obinier457846.exe

Filesize
706KB

MD5
c1095a10913a5b0bf7952a253fc80d59

SHA1
cef63c5a0e9a3f82524b9d7a7c04592e2eaf0a0b

SHA256
7fa82e801a137ca5986e6d7544be241063e9bb46c5b03398b84a6a75acc52f1c

SHA512
dccdc197d03268809d7827725af05584277bdbd3df5e37a264bdc50e1250709d9f7a991a453f29154db43c7c59a409a80dac231351bb1b94693d3bc70cc3856f

Download Submit
\Users\Admin\AppData\Roaming\obinier457846.exe

Filesize
706KB

MD5
c1095a10913a5b0bf7952a253fc80d59

SHA1
cef63c5a0e9a3f82524b9d7a7c04592e2eaf0a0b

SHA256
7fa82e801a137ca5986e6d7544be241063e9bb46c5b03398b84a6a75acc52f1c

SHA512
dccdc197d03268809d7827725af05584277bdbd3df5e37a264bdc50e1250709d9f7a991a453f29154db43c7c59a409a80dac231351bb1b94693d3bc70cc3856f

Download Submit
memory/668-174-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/668-172-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/668-182-0x0000000004D20000-0x0000000004D60000-memory.dmp

Filesize
256KB

Download
memory/668-170-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/668-169-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/668-171-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/668-173-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/668-177-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/668-185-0x0000000004D20000-0x0000000004D60000-memory.dmp

Filesize
256KB

Download
memory/668-179-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1800-54-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1800-209-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2188-184-0x0000000000690000-0x00000000006D0000-memory.dmp

Filesize
256KB

Download
memory/2188-183-0x0000000000690000-0x00000000006D0000-memory.dmp

Filesize
256KB

Download
memory/2680-153-0x0000000004AF0000-0x0000000004B30000-memory.dmp

Filesize
256KB

Download
memory/2680-166-0x00000000005E0000-0x00000000005EC000-memory.dmp

Filesize
48KB

Download
memory/2680-154-0x0000000000580000-0x000000000058C000-memory.dmp

Filesize
48KB

Download
memory/2680-148-0x00000000008F0000-0x00000000009A6000-memory.dmp

Filesize
728KB

Download
memory/2680-164-0x0000000004AF0000-0x0000000004B30000-memory.dmp

Filesize
256KB

Download
memory/2680-167-0x0000000005130000-0x000000000519A000-memory.dmp

Filesize
424KB

Download