Overview

overview

10

Static

static

8

PO ORDER 13012020.pps

windows7_x64

10

PO ORDER 13012020.pps

windows10_x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    PO ORDER 13012020.pps

  • Size

    115KB

  • Sample

    210113-ykkanfg53s

  • MD5

    ef0aed5496df29894d543f176f58ffb8

  • SHA1

    c76d78256b743d6401c2272b69eb307f1ada4a9a

  • SHA256

    d2f1f28bac56207164e2c5364be21700303c8a8b6ef05270038736255c4593b2

  • SHA512

    e02803c05b3ab2ffc3d93655d0c474f8af0813101da568e2f39e1c5e28d62f49aaf7d8627f1125e4d92a952cac0307b62a20686f0c0ff41dc96081dd4e204740

Score
10/10
agentteslakeyloggermacropersistencespywarestealertrojan

Malware Config

Extracted

Family

agenttesla

C2

http://103.133.105.179/8/inc/359ffad84790de.php

Targets

    • Target

      PO ORDER 13012020.pps

    • Size

      115KB

    • MD5

      ef0aed5496df29894d543f176f58ffb8

    • SHA1

      c76d78256b743d6401c2272b69eb307f1ada4a9a

    • SHA256

      d2f1f28bac56207164e2c5364be21700303c8a8b6ef05270038736255c4593b2

    • SHA512

      e02803c05b3ab2ffc3d93655d0c474f8af0813101da568e2f39e1c5e28d62f49aaf7d8627f1125e4d92a952cac0307b62a20686f0c0ff41dc96081dd4e204740

    Score
    10/10
    agentteslakeyloggerpersistencespywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • AgentTesla Payload

    • Blocklisted process makes network request

    • Drops file in Drivers directory

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Registry Run Keys / Startup Folder

1
T1060

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

System Information Discovery

3
T1082

Query Registry

2
T1012

Remote System Discovery

1
T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks