Analysis

  • max time kernel
    120s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    27-04-2024 01:53

General

  • Target

    eb2b566c94331f5769045ee94794c3a287b79e7b9805179ff2b900b8adfc36e8.rtf

  • Size

    39KB

  • MD5

    4986c7f004f15f6d2a6a09206292b1db

  • SHA1

    e861d80f9a7fb383039a34a4adab2a45dc5973e1

  • SHA256

    eb2b566c94331f5769045ee94794c3a287b79e7b9805179ff2b900b8adfc36e8

  • SHA512

    76d51fe3a59179c3ad2e34f0954f90e3733651a5f544dbe3273d3dcf9da4ec6908ad48abe3d8852748764dbd05596b36a74b3fbb43e1e2dcd1f773f27820b56b

  • SSDEEP

    384:amQ/0GXmU4bwCP08D3wVU4KIp0n1ZV6sEj8Zg9TiwGSi6FgMGs/PvTtVrhmVN:ad0oWUK01VNKIuVPSOsRThm

Malware Config

Extracted

Family

agenttesla

Credentials

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Launches Equation Editor 1 TTPs 1 IoCs

    Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.

  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\eb2b566c94331f5769045ee94794c3a287b79e7b9805179ff2b900b8adfc36e8.rtf"
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2204
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:1244
    • C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
      "C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
      1⤵
      • Blocklisted process makes network request
      • Loads dropped DLL
      • Launches Equation Editor
      • Suspicious use of WriteProcessMemory
      PID:2564
      • C:\Users\Admin\AppData\Roaming\hjcl.exe
        "C:\Users\Admin\AppData\Roaming\hjcl.exe"
        2⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:2576
        • C:\Users\Admin\AppData\Roaming\hjcl.exe
          "C:\Users\Admin\AppData\Roaming\hjcl.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:1380

    Network

    MITRE ATT&CK Matrix ATT&CK v13

    Execution

    Exploitation for Client Execution

    1
    T1203

    Defense Evasion

    Modify Registry

    1
    T1112

    Credential Access

    Unsecured Credentials

    4
    T1552

    Credentials In Files

    3
    T1552.001

    Credentials in Registry

    1
    T1552.002

    Collection

    Data from Local System

    4
    T1005

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm
      Filesize

      20KB

      MD5

      5e77e72a7e19b40ac54fe6300266cead

      SHA1

      63ae8a6e5b7597a5e29dbfab10673822073daa3e

      SHA256

      5df5ceec0f14a81f856eabb850583e3194d69e7a52f33cad8a66bd2a8b0883da

      SHA512

      8737d543f8b7c9f1fe8b3f7eb0c71653b7678fa4e93cab8c072b6605cece45252be253f66ab53758f57378745cbb12ae1b085f83069a61b0d430cddb245b86cd

    • \Users\Admin\AppData\Roaming\hjcl.exe
      Filesize

      821KB

      MD5

      186c87bc84233c8a932a5406541c97ac

      SHA1

      d1e74b3ce6a2ca2c0323a1cfea1cfb6e97f5c1e4

      SHA256

      a195a1b02e190c4d00c7d2349429efb7d1c4abd907927e2e9ad231d2f80a135e

      SHA512

      38d400fbaf79d30f504a52f495399cfc1723e2422f88eb0d604c3925d16b709669d4671d1159e7afd7d865c592bba77e246c6ff0c06ce2b5adea592fe62c53f1

    • memory/1380-37-0x0000000000400000-0x0000000000440000-memory.dmp
      Filesize

      256KB

    • memory/1380-40-0x0000000000400000-0x0000000000440000-memory.dmp
      Filesize

      256KB

    • memory/1380-39-0x0000000000400000-0x0000000000440000-memory.dmp
      Filesize

      256KB

    • memory/1380-36-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
      Filesize

      4KB

    • memory/1380-34-0x0000000000400000-0x0000000000440000-memory.dmp
      Filesize

      256KB

    • memory/1380-32-0x0000000000400000-0x0000000000440000-memory.dmp
      Filesize

      256KB

    • memory/1380-28-0x0000000000400000-0x0000000000440000-memory.dmp
      Filesize

      256KB

    • memory/1380-30-0x0000000000400000-0x0000000000440000-memory.dmp
      Filesize

      256KB

    • memory/2204-0-0x000000002FFE1000-0x000000002FFE2000-memory.dmp
      Filesize

      4KB

    • memory/2204-2-0x0000000070BED000-0x0000000070BF8000-memory.dmp
      Filesize

      44KB

    • memory/2204-41-0x0000000070BED000-0x0000000070BF8000-memory.dmp
      Filesize

      44KB

    • memory/2204-1-0x000000005FFF0000-0x0000000060000000-memory.dmp
      Filesize

      64KB

    • memory/2204-59-0x000000005FFF0000-0x0000000060000000-memory.dmp
      Filesize

      64KB

    • memory/2576-27-0x0000000005A00000-0x0000000005A82000-memory.dmp
      Filesize

      520KB

    • memory/2576-26-0x00000000007A0000-0x00000000007B4000-memory.dmp
      Filesize

      80KB

    • memory/2576-24-0x00000000004A0000-0x00000000004C0000-memory.dmp
      Filesize

      128KB

    • memory/2576-19-0x0000000000B70000-0x0000000000C42000-memory.dmp
      Filesize

      840KB