Overview

overview

10

Static

static

04052021pa...py.doc

windows7_x64

10

04052021pa...py.doc

windows10_x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    04052021paymentscancopy.doc

  • Size

    4KB

  • Sample

    210504-j9ecc957nj

  • MD5

    05c282367425cd1e07674f9f92a76c7a

  • SHA1

    2c2ea2e9ef29dc7dc2018200918d8e5e7d282b6b

  • SHA256

    3f324b36806b1580450a1957e73f4a9c74567d3281db2db9a924dcb4c226202a

  • SHA512

    96402db55346d59684204c553741f75b417a8dfad88930e72baf219ecb021b5de78e6a59b7efeade8606abb6f2bc1a45911567373c2dbecce953d44398bd8355

Score
10/10
agentteslaevasionkeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot1774464259:AAF9FzZxHVqbPEcJ50c3sNsdvyt_OEQ0GcA/sendDocument

Targets

    • Target

      04052021paymentscancopy.doc

    • Size

      4KB

    • MD5

      05c282367425cd1e07674f9f92a76c7a

    • SHA1

      2c2ea2e9ef29dc7dc2018200918d8e5e7d282b6b

    • SHA256

      3f324b36806b1580450a1957e73f4a9c74567d3281db2db9a924dcb4c226202a

    • SHA512

      96402db55346d59684204c553741f75b417a8dfad88930e72baf219ecb021b5de78e6a59b7efeade8606abb6f2bc1a45911567373c2dbecce953d44398bd8355

    Score
    10/10
    agentteslaevasionkeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Windows security bypass

      evasiontrojan

    • AgentTesla Payload

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Drops startup file

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Exploitation for Client Execution

1
T1203

Persistence

Privilege Escalation

Defense Evasion

Disabling Security Tools

2
T1089

Modify Registry

3
T1112

Credential Access

Discovery

System Information Discovery

3
T1082

Query Registry

2
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks