Analysis

  • max time kernel
    122s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    21/05/2024, 03:40

General

  • Target

    21052024_0340_20052024_PO-2450911513.xlsx

  • Size

    722KB

  • MD5

    72bbc8eea573f5ea9f2ee266613e32b1

  • SHA1

    8f758b58795c443da1ad41ee3826cdcea1eea179

  • SHA256

    0e88bae5d75ca26aa096ddeb628fc74fa3d512f4c7efd8d69e2101fc1c26b050

  • SHA512

    741e2308fe4e49084e8824121cd1d1566e060e45f706446fc53b81b77b660e5f4b4c5315139b8e0be53738c6b4f3e9cd7dba514ce1c7b67616de45607a6ba147

  • SSDEEP

    12288:HfLq6SUd9GMlNkh1ATswAFjEt9bT3AR1fOUpbSuu4rUck/XPQWvE1fhEmgkuoiLN:Hfjh/llNmcXojKOOyuMrzk/ffvE1Cmgd

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    ftp
  • Host:
    ftp://ftp.midhcodistribuciones.com
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    ,A7}+JV4KExQ

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Blocklisted process makes network request 6 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Launches Equation Editor 1 TTPs 1 IoCs

    Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.

  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\21052024_0340_20052024_PO-2450911513.xlsx
    1⤵
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:2104
  • C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
    "C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
    1⤵
    • Blocklisted process makes network request
    • Loads dropped DLL
    • Launches Equation Editor
    • Suspicious use of WriteProcessMemory
    PID:2004
    • C:\Users\Admin\AppData\Local\Temp\zrdsgyxoQEs.exe
      C:\Users\Admin\AppData\Local\Temp\zrdsgyxoQEs.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:2684
      • C:\Users\Admin\AppData\Local\Temp\zrdsgyxoQEs.exe
        "C:\Users\Admin\AppData\Local\Temp\zrdsgyxoQEs.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1968

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

          Filesize

          68KB

          MD5

          29f65ba8e88c063813cc50a4ea544e93

          SHA1

          05a7040d5c127e68c25d81cc51271ffb8bef3568

          SHA256

          1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

          SHA512

          e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          344B

          MD5

          82c652d840363dcb7aaef454c05e5ffd

          SHA1

          4df28043f54466b22219fb8af8b70a4e46fa3ac1

          SHA256

          6866f77e42fff8d131ad2691e0e3bc0e709e0ad487a04dd015c717f6bbef6d14

          SHA512

          9b930abf9cb7c8aaca490e5b030a50fe8844150d97a397eca7e2b020be08da7d4e1b43a2f277a1ccc11e1f2301a3a08361d6b846aa4b0b7e5d298d71edc85b27

        • C:\Users\Admin\AppData\Local\Temp\Cab2A3E.tmp

          Filesize

          65KB

          MD5

          ac05d27423a85adc1622c714f2cb6184

          SHA1

          b0fe2b1abddb97837ea0195be70ab2ff14d43198

          SHA256

          c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

          SHA512

          6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

        • C:\Users\Admin\AppData\Local\Temp\Tar2B3E.tmp

          Filesize

          177KB

          MD5

          435a9ac180383f9fa094131b173a2f7b

          SHA1

          76944ea657a9db94f9a4bef38f88c46ed4166983

          SHA256

          67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

          SHA512

          1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

        • \Users\Admin\AppData\Local\Temp\zrdsgyxoQEs.exe

          Filesize

          774KB

          MD5

          8b7b19184d4eaa008d1cbba2bfece478

          SHA1

          6b9eb0677d179ccdbb102c9afd7301861f704dfc

          SHA256

          781880fa9f1197427d5a1ba2c3931da4be0612ad0b83bfce4d38725f97c436b5

          SHA512

          c4a18213049ceb04d32f102bde262a6e05ea231e3aeca4a0f343e292316921c29f7cafbe5d61fb2ae87f0ecbd68657f142c6333754b5d857ccffefd90df0551f

        • memory/1968-138-0x0000000000400000-0x0000000000442000-memory.dmp

          Filesize

          264KB

        • memory/1968-140-0x0000000000400000-0x0000000000442000-memory.dmp

          Filesize

          264KB

        • memory/1968-146-0x0000000000400000-0x0000000000442000-memory.dmp

          Filesize

          264KB

        • memory/1968-145-0x0000000000400000-0x0000000000442000-memory.dmp

          Filesize

          264KB

        • memory/1968-142-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

          Filesize

          4KB

        • memory/1968-143-0x0000000000400000-0x0000000000442000-memory.dmp

          Filesize

          264KB

        • memory/1968-134-0x0000000000400000-0x0000000000442000-memory.dmp

          Filesize

          264KB

        • memory/1968-136-0x0000000000400000-0x0000000000442000-memory.dmp

          Filesize

          264KB

        • memory/2104-132-0x0000000072C0D000-0x0000000072C18000-memory.dmp

          Filesize

          44KB

        • memory/2104-0-0x000000005FFF0000-0x0000000060000000-memory.dmp

          Filesize

          64KB

        • memory/2104-1-0x0000000072C0D000-0x0000000072C18000-memory.dmp

          Filesize

          44KB

        • memory/2104-149-0x000000005FFF0000-0x0000000060000000-memory.dmp

          Filesize

          64KB

        • memory/2104-150-0x0000000072C0D000-0x0000000072C18000-memory.dmp

          Filesize

          44KB

        • memory/2684-131-0x00000000050F0000-0x0000000005174000-memory.dmp

          Filesize

          528KB

        • memory/2684-130-0x0000000000370000-0x0000000000380000-memory.dmp

          Filesize

          64KB

        • memory/2684-129-0x0000000000260000-0x000000000026C000-memory.dmp

          Filesize

          48KB

        • memory/2684-128-0x0000000000440000-0x0000000000462000-memory.dmp

          Filesize

          136KB

        • memory/2684-127-0x0000000001210000-0x00000000012D4000-memory.dmp

          Filesize

          784KB