Overview

overview

10

Static

static

8

DHL#AWB031121.ppt

windows7_x64

10

DHL#AWB031121.ppt

windows10_x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    DHL#AWB031121.ppt

  • Size

    121KB

  • Sample

    210311-kf5ntmema2

  • MD5

    49c5e5cf4fec6d41cf03e25995e664d4

  • SHA1

    d8bfbe0acf50553ddd7a8bb4160ebf3f163e608a

  • SHA256

    f62126148a3e6cc7bc2662a8d3b4def7ba95af74265b8f13c2abf6254ea8f0f7

  • SHA512

    6e2f2d9977b6666209d984be665dffa0fb6a13aee7814a4727eaf4eeb66d0017dcffcfac2ae8ba4679bf70b0c0f3ef2ea5640f12619959dcf114851bb25946a9

Score
10/10
agentteslaevasionkeyloggermacropersistencespywarestealertrojan

Malware Config

Extracted

Family

agenttesla

C2

http://193.56.28.231/webpanel-ice/inc/8a33becdbb4cb1.php

Targets

    • Target

      DHL#AWB031121.ppt

    • Size

      121KB

    • MD5

      49c5e5cf4fec6d41cf03e25995e664d4

    • SHA1

      d8bfbe0acf50553ddd7a8bb4160ebf3f163e608a

    • SHA256

      f62126148a3e6cc7bc2662a8d3b4def7ba95af74265b8f13c2abf6254ea8f0f7

    • SHA512

      6e2f2d9977b6666209d984be665dffa0fb6a13aee7814a4727eaf4eeb66d0017dcffcfac2ae8ba4679bf70b0c0f3ef2ea5640f12619959dcf114851bb25946a9

    Score
    10/10
    agentteslaevasionkeyloggerpersistencespywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Contains code to disable Windows Defender

      A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • UAC bypass

      evasiontrojan

    • AgentTesla Payload

    • Blocklisted process makes network request

    • Drops file in Drivers directory

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Scheduled Task

1
T1053

Privilege Escalation

Bypass User Account Control

1
T1088

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

6
T1112

Disabling Security Tools

2
T1089

Bypass User Account Control

1
T1088

Install Root Certificate

1
T1130

Credential Access

Discovery

System Information Discovery

4
T1082

Query Registry

2
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks