Overview

overview

10

Static

static

8

25.pps

windows7_x64

10

25.pps

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    25.pps

  • Size

    143KB

  • Sample

    210224-m1dh313m1j

  • MD5

    c475bbc0142c89758cb3f15625f5dee7

  • SHA1

    eea1ff58d1a0b6a471f9a34d97b102c2cd0a3431

  • SHA256

    7df670fa6de80e87fa03dfba84f5777054d5a55737f8fce07679a637342250a3

  • SHA512

    241a3575dd78dcc2b4f20d20a46f53f4910c7e613ba1dba87b5dd7c9aaa4cc5ebf83784c2560e60fee5ad11732cb3a36a445a6cc82ae851e10367fbbdda8ad9f

Score
10/10
agentteslakeyloggermacropersistencespywarestealertrojan

Malware Config

Targets

    • Target

      25.pps

    • Size

      143KB

    • MD5

      c475bbc0142c89758cb3f15625f5dee7

    • SHA1

      eea1ff58d1a0b6a471f9a34d97b102c2cd0a3431

    • SHA256

      7df670fa6de80e87fa03dfba84f5777054d5a55737f8fce07679a637342250a3

    • SHA512

      241a3575dd78dcc2b4f20d20a46f53f4910c7e613ba1dba87b5dd7c9aaa4cc5ebf83784c2560e60fee5ad11732cb3a36a445a6cc82ae851e10367fbbdda8ad9f

    Score
    10/10
    agentteslakeyloggerpersistencespywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • AgentTesla Payload

    • Blocklisted process makes network request

    • Drops file in Drivers directory

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Registry Run Keys / Startup Folder

1
T1060

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

System Information Discovery

3
T1082

Query Registry

2
T1012

Remote System Discovery

1
T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks