{"id":1188,"date":"2018-10-24T20:55:52","date_gmt":"2018-10-24T19:55:52","guid":{"rendered":"http:\/\/www.herbiez.com\/?p=1188"},"modified":"2018-10-24T20:55:52","modified_gmt":"2018-10-24T19:55:52","slug":"2018-10-24-agent-telsa-malspam","status":"publish","type":"post","link":"https:\/\/www.herbiez.com\/?p=1188","title":{"rendered":"2018-10-24 Agent Telsa Malspam"},"content":{"rendered":"

This is a quick write-up of some Agent Telsa malspam that I was able to find within our email filters. For a good overview of what this malware is and how it works, please see the following links:<\/p>\n

http:\/\/krebsonsecurity.com\/2018\/10\/who-is-agent-tesla\/<\/a>
\nhttp:\/\/www.fortinet.com\/blog\/threat-research\/analysis-of-new-agent-tesla-spyware-variant.html<\/a><\/p>\n

For the artifacts found from this investigation, please see my Github repo located here<\/a>. <\/p>\n

\"\"<\/a><\/p>\n

IOCs:
\n=====
\n208.91.199.225:587 (TCP)<\/p>\n

Artifacts
\n=======
\nFile name: RFQ-HMA-2120864-18.arj
\nFile size: 216K
\nFile path: NA
\nMD5 hash: 321a93e4393042bcae84ee695def3e63
\nVirustotal: http:\/\/www.virustotal.com\/#\/file\/a84aafdffc64e7755dd1025781095c3244c9f1389e2e836ac2691ac0fa1a0925\/detection<\/a>
\nDetection ratio: 25 \/ 56
\nFirst Detected: 2018-10-21 10:43:42<\/p>\n

File name: RFQ-HMA-2120864-18.exe \/ tmpG998.tmp \/ MyOtApp.exe
\nFile size: 260K
\nFile path: NA \/ C:\\Users\\%username%\\AppData\\Local\\Temp \/ C:\\Users\\Bill\\AppData\\Roaming\\MyOtApp
\nMD5 hash: 7b9e6b6a3c279a274a5e3e525e722639
\nVirustotal: http:\/\/www.virustotal.com\/#\/file\/4cadcc03d5341ca1e570b318474bbf87faabfa51101dfbf040df5794b813ea52\/detection<\/a>
\nDetection ratio: 38 \/ 67
\nFirst Detected: 2018-10-21 11:09:15
\nAny.Run: http:\/\/app.any.run\/tasks\/9a031c5b-8ad5-4709-8043-37fd17fa79e1<\/a><\/p>\n

File name: temp.tmp
\nFile size: 1B
\nFile path: C:\\Users\\%username%\\AppData\\Local\\Temp
\nMD5 hash: c4ca4238a0b923820dcc509a6f75849b
\nVirustotal: http:\/\/www.virustotal.com\/#\/file\/6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b\/community<\/a>
\nDetection ratio: NA
\nFirst Detected: 2008-05-01 01:30:22<\/p>\n

Analysis
\n=======
\nThis is pretty straight forward as far as how this binary works. Once the user has run the binary, the malware takes upwards of 20 seconds before it gets going. It launched itself as a new process (PID 1936), and proceeded to scan the system looking for credentials as seen below.<\/p>\n

\"\"<\/a><\/p>\n

It also proceeded to use the UAC bypass method talked about at enigma0x3’s blog<\/a> to elevate the process to HIGH. <\/p>\n

\"\"<\/a><\/p>\n

Once the malicious binary gets elevated from the UAC bypass to HIGH it proceeds to run as a new process (PID 2860) and then ultimately as another new process (PID 2656). It is this process that writes the two temp files in the %TEMP% folder and also the “MyOtApp” folder\/binary. Persistence is maintained by adding a registry key for boot time under the HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run.<\/p>\n

\"\"<\/a><\/p>\n

With regards to the data exfil, secure SMTP seems to be the choice for Agent Telsa. The interesting thing about this is the fact that I could see the login information being sent via secure smtp as seen below:<\/p>\n

\r\n- tcp.stream eq 4 -\r\n------------------------\r\n220 us2.outbound.mailhostbox.com ESMTP Postfix\r\nEHLO Bill-PC\r\n250-us2.outbound.mailhostbox.com\r\n250-PIPELINING\r\n250-SIZE 41648128\r\n250-VRFY\r\n250-ETRN\r\n250-STARTTLS\r\n250-AUTH PLAIN LOGIN\r\n250-AUTH=PLAIN LOGIN\r\n250-ENHANCEDSTATUSCODES\r\n250-8BITMIME\r\n250 DSN\r\nAUTH login bXBvdHlyYWxhQHBicmVuZC5jb20=\r\n334 UGFzc3dvcmQ6\r\nUF5kQ1RWSjY=\r\n235 2.7.0 Authentication successful\r\nMAIL FROM:<mpotyrala@pbrend.com>\r\n250 2.1.0 Ok\r\nRCPT TO:<mpotyrala@pbrend.com>\r\n550 5.4.6 <mpotyrala@pbrend.com>: Recipient address rejected: Email Sending Quota Exceeded\r\n\r\n- tcp.stream eq 5 -\r\n------------------------\r\n220 us2.outbound.mailhostbox.com ESMTP Postfix\r\nEHLO Bill-PC\r\n250-us2.outbound.mailhostbox.com\r\n250-PIPELINING\r\n250-SIZE 41648128\r\n250-VRFY\r\n250-ETRN\r\n250-STARTTLS\r\n250-AUTH PLAIN LOGIN\r\n250-AUTH=PLAIN LOGIN\r\n250-ENHANCEDSTATUSCODES\r\n250-8BITMIME\r\n250 DSN\r\nAUTH login bXBvdHlyYWxhQHBicmVuZC5jb20=\r\n334 UGFzc3dvcmQ6\r\nUF5kQ1RWSjY=\r\n235 2.7.0 Authentication successful\r\nMAIL FROM:<mpotyrala@pbrend.com>\r\n250 2.1.0 Ok\r\nRCPT TO:<mpotyrala@pbrend.com>\r\n550 5.4.6 <mpotyrala@pbrend.com>: Recipient address rejected: Email Sending Quota Exceeded\r\n<\/pre>\n
Unfortunately the compromised email service has exceeded its sending quota by the time I ran this in my test VM. If you look at the Any.Run results you will see data being exfil’ed via secure SMTP.<\/p>\n","protected":false},"excerpt":{"rendered":"
This is a quick write-up of some Agent Telsa malspam that I was able to find within our email filters. For a good overview of what this malware is and how it works, please see the following links: http:\/\/krebsonsecurity.com\/2018\/10\/who-is-agent-tesla\/ http:\/\/www.fortinet.com\/blog\/threat-research\/analysis-of-new-agent-tesla-spyware-variant.html For the artifacts found from this investigation, please see my Github repo located here. IOCs: ===== 208.91.199.225:587 (TCP) Artifacts ======= File name: RFQ-HMA-2120864-18.arj File size: 216K File path: NA MD5 hash: 321a93e4393042bcae84ee695def3e63 Virustotal: http:\/\/www.virustotal.com\/#\/file\/a84aafdffc64e7755dd1025781095c3244c9f1389e2e836ac2691ac0fa1a0925\/detection Detection ratio: 25 \/ 56 First Detected: 2018-10-21 10:43:42 File name: RFQ-HMA-2120864-18.exe \/ tmpG998.tmp \/ MyOtApp.exe File size: 260K File path: NA \/ C:\\Users\\%username%\\AppData\\Local\\Temp \/ C:\\Users\\Bill\\AppData\\Roaming\\MyOtApp…<\/p>\n
 Continue reading<\/span><\/i><\/a> <\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[30],"class_list":["post-1188","post","type-post","status-publish","format-standard","hentry","category-packet-analysis","tag-agent-telsa"],"_links":{"self":[{"href":"https:\/\/www.herbiez.com\/index.php?rest_route=\/wp\/v2\/posts\/1188","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.herbiez.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.herbiez.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.herbiez.com\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.herbiez.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1188"}],"version-history":[{"count":2,"href":"https:\/\/www.herbiez.com\/index.php?rest_route=\/wp\/v2\/posts\/1188\/revisions"}],"predecessor-version":[{"id":1195,"href":"https:\/\/www.herbiez.com\/index.php?rest_route=\/wp\/v2\/posts\/1188\/revisions\/1195"}],"wp:attachment":[{"href":"https:\/\/www.herbiez.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1188"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.herbiez.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1188"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.herbiez.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1188"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}