Analysis

  • max time kernel
    120s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    28-03-2024 02:00

General

  • Target

    e8fac55896700a6e6505cc1b8d4f98570358c0a1275564d587845cfb5ec47068.rtf

  • Size

    3KB

  • MD5

    99a565b1df705062e82bd4d7587c2959

  • SHA1

    1817b3ef54cf96f71bbb581ef21c37c820c125f0

  • SHA256

    e8fac55896700a6e6505cc1b8d4f98570358c0a1275564d587845cfb5ec47068

  • SHA512

    6893bb6540e7c92cb2d39dae83dd7e16a5ed0cc8bc468e13d65dc1a4e5b909bc9a249b306323167a986ee199b6ff6a9d444b673028e4b92aeb9b0b62607ed15c

Malware Config

Extracted

Family

agenttesla

Credentials

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Blocklisted process makes network request 4 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 6 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Launches Equation Editor 1 TTPs 1 IoCs

    Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.

  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 33 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\e8fac55896700a6e6505cc1b8d4f98570358c0a1275564d587845cfb5ec47068.rtf"
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:2880
  • C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
    "C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
    1⤵
    • Blocklisted process makes network request
    • Loads dropped DLL
    • Launches Equation Editor
    • Suspicious use of WriteProcessMemory
    PID:2872
    • C:\Users\Admin\AppData\Roaming\word.exe
      C:\Users\Admin\AppData\Roaming\word.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2452
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:2968
      • C:\Windows\system32\WerFault.exe
        C:\Windows\system32\WerFault.exe -u -p 2452 -s 732
        3⤵
        • Loads dropped DLL
        PID:3004

Network

MITRE ATT&CK Matrix ATT&CK v13

Execution

Exploitation for Client Execution

1
T1203

Defense Evasion

Modify Registry

1
T1112

Credential Access

Unsecured Credentials

4
T1552

Credentials In Files

3
T1552.001

Credentials in Registry

1
T1552.002

Collection

Data from Local System

4
T1005

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Roaming\word.exe
    Filesize

    686KB

    MD5

    5d76a9e3a1948a1307330e52cfefd7bb

    SHA1

    28b7ec354c2d4202278bab3c742eb06f36c56902

    SHA256

    5b494f1ff90dc1d527b8c1b301bdccef380ee9b0bc771486975c1f0075ba9243

    SHA512

    5d29d8b0153c21c9d33ea72b9abc50a66324e6291a7ae4ef96d7e284253f774f9f1a75794df859eb0f456c219076f7330b1d1bbdf2ac16c1d6125dcb2c81b376

  • \Users\Admin\AppData\Roaming\word.exe
    Filesize

    270KB

    MD5

    81e134139b279d1ab6906d391f5acf9d

    SHA1

    5c52c57685cd1d35198686e843c292ff23d6d138

    SHA256

    006492edd0bcabc74696d4c7cfeffde60398a25d038177a021374256253cfcde

    SHA512

    8d311649413ce876c860f8a1c67b113d9c2dd70dfc6702ad704eb4d0edd586b9da49d168ea77bb4e92a17ea4a7d31a5b7aefd0d7644e3890914d3027c7b2d0e1

  • memory/2452-29-0x0000000000BC0000-0x0000000000BDC000-memory.dmp
    Filesize

    112KB

  • memory/2452-30-0x000007FEF5680000-0x000007FEF606C000-memory.dmp
    Filesize

    9.9MB

  • memory/2452-31-0x0000000001FE0000-0x0000000002060000-memory.dmp
    Filesize

    512KB

  • memory/2452-37-0x000000001B3B0000-0x000000001B444000-memory.dmp
    Filesize

    592KB

  • memory/2452-55-0x0000000001FE0000-0x0000000002060000-memory.dmp
    Filesize

    512KB

  • memory/2452-54-0x000007FEF5680000-0x000007FEF606C000-memory.dmp
    Filesize

    9.9MB

  • memory/2880-1-0x000000005FFF0000-0x0000000060000000-memory.dmp
    Filesize

    64KB

  • memory/2880-2-0x000000007104D000-0x0000000071058000-memory.dmp
    Filesize

    44KB

  • memory/2880-0-0x000000002F291000-0x000000002F292000-memory.dmp
    Filesize

    4KB

  • memory/2880-53-0x000000007104D000-0x0000000071058000-memory.dmp
    Filesize

    44KB

  • memory/2968-43-0x0000000000400000-0x0000000000440000-memory.dmp
    Filesize

    256KB

  • memory/2968-39-0x0000000000400000-0x0000000000440000-memory.dmp
    Filesize

    256KB

  • memory/2968-45-0x0000000000400000-0x0000000000440000-memory.dmp
    Filesize

    256KB

  • memory/2968-47-0x0000000000400000-0x0000000000440000-memory.dmp
    Filesize

    256KB

  • memory/2968-40-0x0000000000400000-0x0000000000440000-memory.dmp
    Filesize

    256KB

  • memory/2968-42-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
    Filesize

    4KB

  • memory/2968-41-0x0000000000400000-0x0000000000440000-memory.dmp
    Filesize

    256KB

  • memory/2968-38-0x0000000000400000-0x0000000000440000-memory.dmp
    Filesize

    256KB