Overview

overview

10

Static

static

IRQ2107797.ppam

windows7_x64

10

IRQ2107797.ppam

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    IRQ2107797.ppam

  • Size

    31KB

  • Sample

    211202-j9j37sgcf6

  • MD5

    2936bf1e690b55f6a47ef697378ba926

  • SHA1

    95853ff912a9c3a25e6fe0836b62e77082c592db

  • SHA256

    ac42d77d458fc7947f1d80ae7032c5922713f24cc708488d9a39291af1403235

  • SHA512

    c861b4e35739a332bb102dce4148aed98a8fb0d06803b6265182f852fca03fc5ade4b3b44e8ed3ae8e496c20bdacb1649c1d201ab8f783c45b75e1e6451e2aa3

Score
10/10
agentteslacollectionevasionkeyloggerspywarestealertrojan

Malware Config

Targets

    • Target

      IRQ2107797.ppam

    • Size

      31KB

    • MD5

      2936bf1e690b55f6a47ef697378ba926

    • SHA1

      95853ff912a9c3a25e6fe0836b62e77082c592db

    • SHA256

      ac42d77d458fc7947f1d80ae7032c5922713f24cc708488d9a39291af1403235

    • SHA512

      c861b4e35739a332bb102dce4148aed98a8fb0d06803b6265182f852fca03fc5ade4b3b44e8ed3ae8e496c20bdacb1649c1d201ab8f783c45b75e1e6451e2aa3

    Score
    10/10
    agentteslacollectionevasionkeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • AgentTesla Payload

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Drops file in Drivers directory

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Accesses Microsoft Outlook profiles

      collection

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks