General

  • Target

    DRAFT BL & MBL PO NO ECM1D2403-29.xls

  • Size

    1.1MB

  • Sample

    241112-hemp6sxbrk

  • MD5

    9d92634ba9c56395b993a433abadec4f

  • SHA1

    016c81b545343fc20609bf76c1588a358336deea

  • SHA256

    0980c818b185071ebf00005388e6d09283692a33cdd5a28005b76c0018960f40

  • SHA512

    93f9f07d6e7d06c54e88d4c5aa9e53138e2d62ea522b35e08d94f075ed3e9cbde7b163dd79b897811a2677d5b3a804d9a55fd2bbeca2c4b74b7df3ba18a7c7a0

  • SSDEEP

    24576:8q9PLiijE2Z5Z2am8gshXCdQtF84LJQodsKVXyiTsMEWyByK:8EPLiij7Z5ZK8gsAsFjLJQodH5TGWyB

Malware Config

Targets

    • Target

      DRAFT BL & MBL PO NO ECM1D2403-29.xls

    • Size

      1.1MB

    • MD5

      9d92634ba9c56395b993a433abadec4f

    • SHA1

      016c81b545343fc20609bf76c1588a358336deea

    • SHA256

      0980c818b185071ebf00005388e6d09283692a33cdd5a28005b76c0018960f40

    • SHA512

      93f9f07d6e7d06c54e88d4c5aa9e53138e2d62ea522b35e08d94f075ed3e9cbde7b163dd79b897811a2677d5b3a804d9a55fd2bbeca2c4b74b7df3ba18a7c7a0

    • SSDEEP

      24576:8q9PLiijE2Z5Z2am8gshXCdQtF84LJQodsKVXyiTsMEWyByK:8EPLiij7Z5ZK8gsAsFjLJQodH5TGWyB

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Agenttesla family

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Evasion via Device Credential Deployment

    • Executes dropped EXE

    • Loads dropped DLL

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks