Overview

overview

10

Static

static

Order 200234#.doc

windows7_x64

10

Order 200234#.doc

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Order 200234#.doc

  • Size

    295KB

  • Sample

    210421-hjfb17wy6e

  • MD5

    452e11d23c80550a45b6a498bac85733

  • SHA1

    1b1355594eecbfad9803e771bedefedf96ecceee

  • SHA256

    8ac32b7faa79aabd51156f6503e624a53ee5d355d602784273376ad45e7dbdbf

  • SHA512

    fcf7955fe9b6e84e6361a2e0beca3bce9a64d7f413c8629a877e37da016144c4c886ecbf0d61586233aecb15f9215ac0378fc5349ed127465904658af1a3f3a5

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

httP://katchobinnas.duckdns.org/obi.exe

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    us2.smtp.mailhostbox.com
  • Port:
    587
  • Username:
    zhoubing.wu.zeruimetal@pppkglobal.net
  • Password:
    Thanks202#

Targets

    • Target

      Order 200234#.doc

    • Size

      295KB

    • MD5

      452e11d23c80550a45b6a498bac85733

    • SHA1

      1b1355594eecbfad9803e771bedefedf96ecceee

    • SHA256

      8ac32b7faa79aabd51156f6503e624a53ee5d355d602784273376ad45e7dbdbf

    • SHA512

      fcf7955fe9b6e84e6361a2e0beca3bce9a64d7f413c8629a877e37da016144c4c886ecbf0d61586233aecb15f9215ac0378fc5349ed127465904658af1a3f3a5

    Score
    10/10
    agentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • AgentTesla Payload

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

3
T1082

Query Registry

2
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks