General

  • Target

    omass.exe

  • Size

    36KB

  • Sample

    210120-xkcxttydcx

  • MD5

    aaa69c3544561ed70b13847f6ec763e9

  • SHA1

    1e53ed306bd193cffa691f51f940e908ef18cf4b

  • SHA256

    cfa46220d1b96e515eedbb82a0285229467f377ede30f732f7f6c48caba3ae1e

  • SHA512

    b922f8bdbcc6ee25b635965a24ae87b8d129a8ac7cdd0458e5ddd1c5a62ede6f34b4a5c704fd6a08988f93ab4af424a95b18a563760d8dd584bb5eeba7062016

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    mail.privateemail.com
  • Port:
    587
  • Username:
    ashfaq.ali@nationalfuels.pw
  • Password:
    @Mexico1.,

Targets

    • Target

      omass.exe

    • Size

      36KB

    • MD5

      aaa69c3544561ed70b13847f6ec763e9

    • SHA1

      1e53ed306bd193cffa691f51f940e908ef18cf4b

    • SHA256

      cfa46220d1b96e515eedbb82a0285229467f377ede30f732f7f6c48caba3ae1e

    • SHA512

      b922f8bdbcc6ee25b635965a24ae87b8d129a8ac7cdd0458e5ddd1c5a62ede6f34b4a5c704fd6a08988f93ab4af424a95b18a563760d8dd584bb5eeba7062016

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Modifies WinLogon for persistence

    • Modifies Windows Defender Real-time Protection settings

    • Turns off Windows Defender SpyNet reporting

    • Windows security bypass

    • AgentTesla Payload

    • Looks for VirtualBox Guest Additions in registry

    • Looks for VMWare Tools registry key

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Drops startup file

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Adds Run key to start application

    • Legitimate hosting services abused for malware hosting/C2

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Winlogon Helper DLL

1
T1004

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

6
T1112

Disabling Security Tools

4
T1089

Virtualization/Sandbox Evasion

2
T1497

Credential Access

Credentials in Files

3
T1081

Discovery

Query Registry

4
T1012

Virtualization/Sandbox Evasion

2
T1497

System Information Discovery

3
T1082

Peripheral Device Discovery

1
T1120

Collection

Data from Local System

3
T1005

Command and Control

Web Service

1
T1102

Tasks