Overview

overview

10

Static

static

8

PO 71035.pps

windows7_x64

10

PO 71035.pps

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    PO 71035.pps

  • Size

    82KB

  • Sample

    210316-8b1l9nb7dn

  • MD5

    76b3407328a71015dbc4afc88f17cd49

  • SHA1

    fc52c238d348c7ebe5078489ed478bbb3b03b83d

  • SHA256

    0d49d76014a2eeb82b331092ee3ba58548c564dea13451fada229da7fda132b1

  • SHA512

    ef793485309bdd790d6c90162716e9629c1c338c0b4173648dfce97980c61d716df16be5ea361a857b03c5fc75ae8378fcfcc358a258d40829a7076f78880955

Score
10/10
agentteslaevasionkeyloggermacromacro_on_actionpersistencespywarestealertrojanxlm

Malware Config

Extracted

Family

agenttesla

C2

http://103.133.105.179/3030/inc/66714cb5e3f035.php

Targets

    • Target

      PO 71035.pps

    • Size

      82KB

    • MD5

      76b3407328a71015dbc4afc88f17cd49

    • SHA1

      fc52c238d348c7ebe5078489ed478bbb3b03b83d

    • SHA256

      0d49d76014a2eeb82b331092ee3ba58548c564dea13451fada229da7fda132b1

    • SHA512

      ef793485309bdd790d6c90162716e9629c1c338c0b4173648dfce97980c61d716df16be5ea361a857b03c5fc75ae8378fcfcc358a258d40829a7076f78880955

    Score
    10/10
    evasionpersistencetrojanagentteslakeyloggerspywarestealer

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Contains code to disable Windows Defender

      A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • UAC bypass

      evasiontrojan

    • AgentTesla Payload

    • Blocklisted process makes network request

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Scheduled Task

1
T1053

Privilege Escalation

Bypass User Account Control

1
T1088

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

6
T1112

Disabling Security Tools

2
T1089

Bypass User Account Control

1
T1088

Install Root Certificate

1
T1130

Credential Access

Discovery

System Information Discovery

4
T1082

Query Registry

2
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks