Overview

overview

10

Static

static

QUOTATION 343.doc

windows7_x64

10

QUOTATION 343.doc

windows10_x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    QUOTATION 343.doc

  • Size

    3KB

  • Sample

    210728-2l7yj7fb4x

  • MD5

    7187e199ddefe203d8d25be24ec5faa5

  • SHA1

    11dd9bf957419a4608ab086b4af6d7e86eb1aa0b

  • SHA256

    a8e8a068ad37fffa43336ca0cc9f6aea938db591b91d22ffa61c97de2d4c3cc0

  • SHA512

    76da8b59b5ed845072852c7ed7c6e41206c802541e2d3787cff75cd56afc94481bc14e82d2b1e62223cb89aeedb6463ea3eeaac0c5abf61e914a92a8a97fa5a6

Score
10/10
agentteslakeyloggerspywarestealersuricatatrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    mail.privateemail.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    NewMexcico@123

Targets

    • Target

      QUOTATION 343.doc

    • Size

      3KB

    • MD5

      7187e199ddefe203d8d25be24ec5faa5

    • SHA1

      11dd9bf957419a4608ab086b4af6d7e86eb1aa0b

    • SHA256

      a8e8a068ad37fffa43336ca0cc9f6aea938db591b91d22ffa61c97de2d4c3cc0

    • SHA512

      76da8b59b5ed845072852c7ed7c6e41206c802541e2d3787cff75cd56afc94481bc14e82d2b1e62223cb89aeedb6463ea3eeaac0c5abf61e914a92a8a97fa5a6

    Score
    10/10
    agentteslakeyloggerspywarestealersuricatatrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • suricata: ET MALWARE Possible Malicious Macro DL EXE Feb 2016

      suricata

    • AgentTesla Payload

    • CustAttr .NET packer

      Detects CustAttr .NET packer in memory.

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Exploitation for Client Execution

1
T1203

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

3
T1082

Query Registry

2
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks