2021-05-12 01:18:39 Author: www.vmray.com(查看原文) 阅读量:169 收藏
Agent Tesla is a spyware that has been around since 2014. It’s in active development, constantly being updated and improved with new features, obfuscation, and encryption methods. The malware is sold as a service with a relatively cheap licensing model, which makes it particularly easy to use and can explain its distribution on such a wide scale. At the time of writing two versions of Agent Tesla can still be found in the wild – version 2 and 3. Version 3 comes with some updates and additional features and is currently the most prevalent.
Agent Tesla’s most common and successful delivery method is through email, either in the form of spam or more targeted campaigns (OPEC+, COVID-19, ISPS), where the malware is bundled as an attachment, usually in the form of a document or a compressed archive (Figure 1).
Figure 1: VMRay Analyzer – Email delivering Agent Tesla (top) and the email displayed in an email client (bottom).
In the following Threat Bulletin, we’ll explore the delivery process of an Agent Tesla sample and some of the differences and similarities between different versions of Agent Tesla. With that in mind, we begin by looking into a fairly recent sample of Agent Tesla (v3) delivered as an email attachment (Figure 1).
Agent Tesla – Initial Stages
The email arrives with an attachment posing as an invoice with the .doc extension but is actually an RTF document. When it’s opened, it exploits CVE-2017-11882 to execute further stages. The shellcode used in the exploitation of the Equation Editor (eqnedt32.exe) is responsible for downloading and executing the next stage (Figure 2).
Figure 2: VMRay function log of the Equation Editor process downloading the next stage (top) and a VTI depicting document creating other processes (bottom).
Interestingly, with this delivery, the threat actors leverage the CMSTP.exe to launch further stages (Figure 3).
Figure 3: Abusing CMSTP to launch further stages.
CMSTP is usually used to install Connection Manager service profiles. It takes an .INF file’s path as argument. It describes the profile’s characteristics and the steps to be taken when installing it. This can be abused to start another executable by a legitimate, signed binary or used as a UAC bypass. It’s one of the Living Off The Land techniques. In this case, the .INF file itself seems to have been taken from a public example (by Tyler Applebaum) (Figure 4). It extends the installation with a RunPreSetupCommandsSection which allows one to run commands before the profile is installed. The malicious actor leverages this to run the malware.
Figure 4: .INF file passed to CMSTP.exe as an argument.
During the following steps of the execution, we observe how Agent Tesla makes sure that it’s not easily discovered by adding its image path as an exclusion for Windows Defender (Figure 5). Additionally, it also disables the UAC dialog by overwriting the corresponding settings in the registry. Doing this, the user won’t be notified or prompted for permission if an elevated (requiring administrator access token) action is taken. Thus, Agent Tesla is silently installed.
Figure 5: Defense evasion methods
Finally, the actual Agent Tesla payload is extracted and injected using the process hollowing method (Figure 6). We have observed many samples using this approach however there were also cases using .NET in-memory reflective loading or a similar method. The process of delivering and loading Agent Tesla varies greatly but the actual payload has many similarities even between versions.
Figure 6: Agent Tesla’s loader using process hollowing
Agent Tesla – Execution Flow
Even though Agent Tesla has been in development for at least 7 years, the overall execution flow hasn’t changed much. Some new features were added to the newer versions of Agent Tesla, but the behavior has remained fairly similar. The following section summarizes the high-level execution steps it usually performs. In some cases, we have observed that the order changes slightly but it doesn’t impact the behavior. It also highlights additions made in the newer version of Agent Tesla (v3).
At the beginning of its execution, Agent Tesla often uses certain methods to evade automatic analyses (dynamic analysis?). Some of the common evasion techniques include the introduction of an execution delay, which can evade sandboxes that have a limited monitoring duration, and checking the user and computer name for certain hard-coded values that could indicate it’s being analyzed (Figure 7). The spyware also makes sure that no other processes with the same name are currently running. It iterates over all processes with the same name and kills any which aren’t the current process.
Each infected system is identified by a unique ID generated from different hardware information. There are different ways Agent Tesla can achieve this. It applies the MD5 hashing algorithm on a string created by concatenating different hardware properties:
- System Serial Number,
- CPU identification value retrieved from the processorID property of the Win32_Processor WMI management class,
- The MAC address is taken from the MACAddress property of the Win32_NetworkAdapterConfiguration WMI class. It takes the MAC address of a network adapter that is currently connected.
The hardware ID is generated at the beginning of the execution but appears to be only used during the HTTP communication.
Another common “evasion” between versions, that Agent Tesla uses at the beginning of its execution, is the GetLastInputInfo function. If no input event was detected in the last 10 minutes a configuration variable is set (Figure 7).
Figure 7: Agent Tesla’s last input detection (top) and user/computer name detection (bottom).
Its next step is usually to copy itself to a less obvious location (an installation folder) like %appdata% which is also configurable and might not be used at all. The config file also indicates if the file should have the hidden and system attributes set. Persistence is achieved by installing itself as a startup application in the registry. In this case, Agent Tesla also enables the corresponding startup entry via \Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run by setting the value 02 00 00 00 00 00 (Figure 8).
Figure 8: Agent Tesla’s persistence via Registry.
Furthermore, it also deletes the ZoneIdentifier from the base image. A ZoneIdentifier is an Alternate Data Stream created (when a file is downloaded and saved from the internet). This information is used by Windows and various security products. Deleting it makes the malware look as if it wasn’t downloaded from the internet. Depending on the configuration Agent Tesla is able to take screenshots periodically. It uses a timer that will invoke the registered callback function according to a specified interval which is also configurable. One difference between versions is in the choice of protocols the malware can use to exfiltrate the collected information. Version 2 and 3 are both capable of using HTTP, SMTP, and FTP. On top of that, v3 comes with another possibility which is sending a document to a Telegram channel (Figure 9).
Figure 9: Example configuration of Agent Tesla using Telegram as C2 (left) and screenshot functionality of a v3 that can use Telegram (right).
A new addition that came with Agent Tesla v3 is the ability to collect clipboard data and the external IP of the infected host (Figure 10).
Figure 10: Agent Tesla v3 checking external IP.
Furthermore, v3 comes with the option to use the Tor proxy for its HTTP communication. This is a newer addition which isn’t found in the previous versions (Figure 11). If the corresponding configuration is set, Agent Tesla first tries to kill all currently running Tor instances and then download and set up the Tor client.
Figure 11: Agent Tesla with the Tor proxy option (v3) (left) and Agent Tesla without Tor proxy v2 (right).
With HTTP communication set-up, Agent Tesla starts one of its main tasks – credential-stealing (Figure 12). Agent Tesla v3 has some additions to the application list that it targets.
Figure 12: Agent Tesla’s Stealing attempts
Both versions are also able to function as a keylogger. The keylogging functionality is again implemented with the help of timers. The set interval specifies how often the logs are collected and exfiltrated (Figure 13). The hook itself is installed using the native SetWindowsHookExA function with idHook WH_KEYBOARD_LL which takes an application-defined hook.
Figure 13: Keyboard log exfiltration (top) and hook installation (bottom).
String and Config Decryption
All strings that are used by Agent Tesla are encrypted by default and mostly used on demand. The ability to decrypt Agent Tesla’s strings, allows one to extract parts of the configuration information like the c2 server, the passwords used, or other data related to network connections. Appendix B contains a small list of extracted network information from different Agent Tesla samples.
Version 2
Agent Tesla v2’s encrypted strings are usually located in the .text segment of the PE file. To be exact, they start 0x50 bytes past the beginning of the section. The strings are encrypted using AES in CBC mode (Figure 14). Each string is encrypted with its own Key and IV. Strings are stored in an array of objects, where each object is an array of units. The decryption routine takes an encoded offset into the array which is then decoded at runtime to extract the corresponding string.
Figure 14: Agent Tesla v2 string decryption routine.
Investigating the object in dnSpy shows that the static object array corresponds to the token 0x04000001 (Figure 15 left). It describes the Field table (0x4) and its first row (0x000001). Each element in the array is described by its own token (Figure 15 right). dnSpy already provides us with the corresponding RVA and file offset. However, this information can also be extracted manually from the FieldRVA table in the metadata stream of the PE file by looking up the corresponding row number. This information would allow to statically parse the file and its metadata, extract the RVAs and decrypt the strings without assuming any offsets.
Figure 15: Encrypted strings as shown in dnSpy (left) and the metadata of each element (right).
Version 3
Agent Tesla v3 changes how the strings are encrypted. AES is no longer used for decryption. Instead, the encrypted strings are stored in a byte array which is decrypted by XORing the value with the current array offset and a hard-coded key. This decryption takes place when the class is constructed, i.e., the array and the decryption loop (Figure 16 left) are implemented inside a class constructor. The decrypted strings are stored without any separators as a single blob of characters. When a particular string is required, a function that takes the offset and length of the string as parameters is used (Figure 16 right). This also means that it’s harder to statically extract information from the strings and requires, e.g., parsing of the actual decoding function wherever it’s used and extracting its arguments.
Figure 16: String decryption in a class constructor (top) and example decoding function (bottom)
Conclusions
Understanding a malware family, its usual delivery methods, and the techniques used can be very beneficial from an incident response standpoint. The research of a family can give the blue team enough information to start an internal investigation if a breach is suspected. They can better assess the initial impact of such a breach, can look for indicators and start their initial analysis from there and expand outwards.
References
https://cofense.com/strategic-analysis-agent-tesla-expands-targeting-and-networking-capabilities/
https://docs.microsoft.com/de-de/windows-server/administration/windows-commands/cmstp
https://docs.microsoft.com/en-us/dotnet/standard/metadata-and-self-describing-components
https://attack.mitre.org/techniques/T1218/003/
https://gist.github.com/tylerapplebaum/ae8cb38ed8314518d95b2e32a6f0d3f1#file-uacbypass-inf
https://attack.mitre.org/techniques/T1055/012/
https://blog.f-secure.com/detecting-malicious-use-of-net-part-1/
https://news.sophos.com/en-us/2021/02/02/agent-tesla-amps-up-information-stealing-attacks/
https://www.fortinet.com/blog/threat-research/in-depth-analysis-of-net-malware-javaupdtr
https://thisissecurity.stormshield.com/2018/01/12/agent-tesla-campaign/
Appendix A
IOCs
Agent Tesla Payloads – Hashes
88F94C1E8A555D84BF7AD2E0FE21D82D33F1976786267AF93808CC050D039BD9 1B91B0EDA8B823353154334C5031ECA8F9CB8E022BBC2DCB47494AFB33A1C9CF D5454DC627980449EADC9DF01A94A38DD7DD32090713FB9C1C3A93FDD316A78B 8FD0DCAE134D32EB666D576A85756E35C022810BC767263CF9A12A5F52801409 AB056BF16EDC280DF3D80740C132B7B8667EC1F69CB225FAC2E3017C2CE5F802 ED59B3FC26DE2B31E908F025C23D01EB8ED9834B2BDD740745E1DC0737E443B9 ED59B3FC26DE2B31E908F025C23D01EB8ED9834B2BDD740745E1DC0737E443B9 E409F3663952399F60A9A112D3B05B5648E8F73D41E167121279EBDB17E8173B 505FC5FAAE424387A6036FA41C02EB83E44DC4A6CA60BC0125EFFFCB49D5AD8C 1B91B0EDA8B823353154334C5031ECA8F9CB8E022BBC2DCB47494AFB33A1C9CF D3806488B3DDA1092E3F53EC8A18EE68EE1C34CC4241CDFDB8171DD0CF9F4F57
Loaders – Hashes
1ea47052336cde8e7336e678acc989a3ad9a05301654cc380bf97f70f2b9d8aa 82213cd55fee5374e407b4b98c45d7b0d291682ec0fd91b3ea47c32752b54ab9 ae7d14d604ceb767afe056f099002dba0741eaf6e0ad49ce1f7b403b522b9862 c6001e599745f9e8b432fcfdcb2d5001d1b2c56871db82ecea6882e2d48cd67f 174d9ba2e89f897d84a612d59117d349773c91f129aa8cdb8ad8a29d576fa8af f1563e5a3fb811e08b76cdce4db15bd8c1b90d193d2dc064efe50b2f42cfd01b 80027a51f615b2eb637b672f5560e083d2ba43f61e01ca28a2c591d6376dd9b3 4f332e317c5116e7c9b64ea8084a39aa4fff859a056ce9463557bdb0093eab55 9733220cd3a69b55438876d8fb6477f2ebec950de8151f4732d415468e58535d 5f1b120f79f227f26c489f998c4d3f3c73e7bf1eb885b2405c962d0ef915dd77 826d203e305f770a9c3b2b3ec8b024ceced15fbc2cf8c1bae72ffa86888edeef f92af92a9a58c941191e13ceb8a16b061ee450e832ac08f7fd837a0ae2d80bb1
Documents – Hashes
ad72a15b0a2f1a577fc422ae2803a96e1ecb2dfe43f2ce2db851b16804fa2406 327de1f64dd092c41e96ddb5b4e23c227ee64c19b49b3de7dd07711e810b8e50
Appendix B
Some of the extracted configurations presented in the MWCP format.
Configs
{'version': [3], 'other': {'xor_key': 170, 'smtp': 'smtp.arles-cz.co'}, 'email_address': ['[email protected]'], 'password': ['fP******']}
{'version': [3], 'other': {'xor_key': 170, 'smtp': 'mail.otecfundacionredes.cl'}, 'email_address': ['[email protected]'], 'password': ['sg**********']}
{'version': [3], 'other': {'xor_key': 170, 'smtp': 'smtp.fnsst.com'}, 'email_address': ['[email protected]'], 'password': ['ma*******']}
{'version': [3], 'other': {'xor_key': 170, 'smtp': 'mail.shyamindofab.com', 'toemail': '[email protected]'}, 'email_address': ['[email protected]'], 'password': ['an*********']}
{'version': [3], 'other': {'xor_key': 170, 'chat_id': '1063661839', 'token': 'bot16********:AAF2v81NoI*************************', 'method': 'sendDocument'}, 'c2_address': ['https://api.telegram.org']}
{'version': [3], 'other': {'xor_key': 170, 'smtp': 'mail.prinutrition.com'}, 'email_address': ['[email protected]'], 'password': ['fo*****']}
{'version': [2], 'email_address': ['[email protected]'], 'password': ['721*************'], 'other': {'smtp': 'bh-58.webhostbox.net', 'toemail': '[email protected]'}}
{'version': [3], 'other': {'xor_key': 170, 'smtp': 'mail.bodrumosmanlialuminyum.com'}, 'email_address': ['[email protected]'], 'password': ['bd***************']}
{'version': [3], 'other': {'xor_key': 170, 'smtp': 'mail.gcclatinoamerica.com', 'toemail': '[email protected]'}, 'email_address': ['[email protected]'], 'password': ['4r**********']}
{'version': [3], 'other': {'xor_key': 170, 'smtp': 'smtp.yandex.com'}, 'email_address': ['[email protected]'], 'password': ['Chi*****']}
{'version': [2], 'email_address': ['[email protected]'], 'password': ['stl*****'], 'other': {'smtp': 'mail.stalexinc.com'}}
{'version': [3], 'other': {'xor_key': 170, 'smtp': 'mail.privateemail.com'}, 'email_address': ['[email protected]'], 'password': ['m*****']}
{'version': [3], 'other': {'xor_key': 170, 'smtp': 'smtp.gmail.com'}, 'email_address': ['[email protected]'], 'password': ['Jes*****']}
{'version': [3], 'other': {'xor_key': 170, 'smtp': 'peopleinpower.biz', 'toemail': '[email protected]'}, 'email_address': ['[email protected]'], 'password': ['D***************']}
{'version': [3], 'other': {'xor_key': 170, 'smtp': 'hisensetech.ml', 'toemail': '[email protected]'}, 'email_address': ['[email protected]'], 'password': ['721*************']}
{'version': [3], 'other': {'xor_key': 170, 'chat_id': '1464755657', 'token': 'bot14********:AAHvvJmG-W*************************', 'method': 'sendDocument'}, 'c2_address': ['https://api.telegram.org']}
{'version': [3], 'other': {'xor_key': 170, 'smtp': 'smtp.rulkeroil.com'}, 'email_address': ['[email protected]'], 'password': ['sta*******']}
{'version': [3], 'other': {'xor_key': 170, 'smtp': 'mail.electro-plomb.cf', 'toemail': '[email protected]'}, 'email_address': ['[email protected]'], 'password': ['ZA**********']}
{'version': [2], 'email_address': ['[email protected]'], 'password': ['B**********'], 'other': {'smtp': 'mail.blc.com.np', 'toemail': '[email protected]'}}
{'version': [3], 'other': {'xor_key': 170}, 'ftp': ['ftp://ftp.travels-plan.com/', 'travelsplan', '3p**********']}
{'version': [3], 'other': {'xor_key': 170, 'smtp': 'smtp.vivaldi.net'}, 'email_address': ['[email protected]'], 'password': ['Reb**********']}
{'version': [3], 'other': {'xor_key': 170, 'smtp': 'mail.yusufgroups.com'}, 'email_address': ['[email protected]'], 'password': ['@@**********']}
{'version': [3], 'other': {'xor_key': 170, 'smtp': 'mail.akdogulojistik.com'}, 'email_address': ['[email protected]'], 'password': ['Ak************']}
{'version': [3], 'other': {'xor_key': 170, 'smtp': 'sixjan.club'}, 'email_address': ['[email protected]'], 'password': ['{D**********']}
{'version': [3], 'other': {'xor_key': 170, 'smtp': 'mail.privateemail.com'}, 'email_address': ['[email protected]'], 'password': ['@M********']}
{'version': [3], 'other': {'xor_key': 170, 'smtp': 'mail.ckclegal.com'}, 'email_address': ['[email protected]'], 'password': ['S1**********']}
{'version': [3], 'other': {'xor_key': 170, 'smtp': 'smtp.arroweuorpe.com'}, 'email_address': ['[email protected]'], 'password': ['Q*******']}
{'version': [3], 'other': {'xor_key': 170, 'smtp': 'mail.gruptruck.com'}, 'email_address': ['[email protected]'], 'password': ['dg**********']}
如有侵权请联系:admin#unsafe.sh