Analysis of New wave of .PPAM Agent Tesla – Part 2

In the previous post, we saw how the Agent Tesla malware has infected its victims by using the PS1 Powershell script to invoke the web request from the blacklisted IPs. Agent Tesla’s successful delivery method is through email, either in the form of spam or more targeted phishing campaigns with OPEC (Oil Production Export Countries) and a COVID-19-based theme, where the malware is sent as an attachment, a macro-enabled Microsoft document (.DOC,.XLA/.XLS,.PPT file format), Microsoft document add-on files (.XLL), or a compressed archive. According to LMNTRIX CDC’s observations, there were reports of over 8000 customers delivering files infected with Agent Tesla RAT as recently as 2021/22.

This kind of email contains Microsoft Office documents (Excel) of .XLA/.XLS files, but this sample uses the .PPAM extension, which contains VBA macros to execute and automate tasks. ‘.PPAM’ is an add-in file used by Microsoft PowerPoint where a program is used to develop slideshow presentations.

It contains components that can provide additional functionality, including extra commands, customized macros, and new tools for extending default PowerPoint functions. Mainly, it supports “add-ins” developed by third parties to add new features that attackers can abuse to automatically execute macros for further action on objectives.

Control Flow Diagram of Agent Tesla RAT (Version 3x)

Infection Chain

The initial vectors may vary depending on their targets and, it’s well known that the threat actors will perform basic reconnaissance methodologies before deciding on their method of infection.

Sample Information

PPT: 34c5d4ce20a550336303c0bdb5df78f6ed1727c3993e79e27d58f30ac5cbc055

File Metadata

Technical Analysis of .PPAM Document

When a user opens an office file containing macros, then the macros will execute from the Internet. We are well aware that the VBA macro is a common method for malicious actors to gain initial access to deploy malware. These files are based on the Office Open XML standard. This is an XML-based file format introduced by Microsoft that is unreadable with PowerPoint versions earlier than MS Office 2010/2013. Now, we can extract & view the contents of the file. The XML file format is human-readable or machine-readable and designed to transport data over the internet.

The XML file format contains three categories:

• Section one with Document Identification
• The Document Content
• Meta Data with fields and facets

Malware Persistence

Agent Tesla malware can achieve persistence by creating the following registry entries on Windows:
\Software\Microsoft\Windows\CurrentVersion\Run
\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run

Agent Tesla can also create a scheduled task by using schtasks.exe to add and/or modify the task schedule,
Process created: C:\Windows\System32\schtasks.exe” /Create /TN “” /XML “C:\Users\\AppData\Local\Temp\.tmp

VBA_ Dialog msgbox

Once the user successfully executes the macros, the above mentioned message box will be displayed.

It can occur during the opening of the document, or, while closing the document.

This is a simple and known method to evade detection rules. (i.e;) Auto_Open ()  or Auto_Close () method.

File structure of the .PPAM file

The folders shown above contain the base function of the process, which is used to initiate the VBA_Project macros. The VBA Project is where the modules and forms are stored when you write VBA code in Excel. Microsoft Forms is an Object Library Adding a reference to the Forms library, in-order to use the Forms library in a VBA project.

Temp files

We all know that TEMP files (aka foo files) with the .TMP extension are temporary files that may be created by various software programs. It is typically generated while the program is running to temporarily store information, then is automatically deleted when the program is closed.

The temp folder is a prime target for malware such as Agent Tesla. Recent strains malware are often attached to or embedded in legitimate programs to perform malicious actions.

VBA Project Content

Decoded Content

Command line for Powershell [.PS1] script

Once the macros are executed, using the powershell script, the malware invokes web requests from the domain shown above (bigXXXXet domain). Actually, the connecting domain is a legitimate website, but as we noticed the full URI of the website makes use believe it’s a phishing website.

How is it done? As per the VBA_project code, the URI is formed and please refer the decoded content.z

Indicators of Compromise for Agent Tesla Sample

Preventive Measures for Agent Tesla RAT

Recent updates from MSRC Security blog, suggests that users can block the execution of MS Office macros in files which are obtained from the Internet, or from an unknown source.

If you don’t use the “Block macros from running in Office files from the Internet” policy, you can use the “VBA Macro Notification Settings” policy to manage how macros are handled by Office. This policy prevents users from being lured into enabling malicious macros.

For more information, please check “Macros from the internet will be blocked by default in Office” from MSDN.