Overview

overview

10

Static

static

1

INV000381021.rtf

windows7-x64

10

INV000381021.rtf

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    INV000381021.doc

  • Size

    26KB

  • Sample

    230403-pncpwsef47

  • MD5

    8b33f455d3011f5b75cdf053e59ab724

  • SHA1

    29c35484623d8b483e4f4e2f053b873b4d08f55c

  • SHA256

    a274aac5116a0ac420cbef327f96663a687239d4e8668a2b89ad65b6147c8fe1

  • SHA512

    ad487296f19b63e6fcc0eb2df6d52d7bd8c10375517f0ef3a60eaf032ad9ee13afa84784b74b6df1be3a962e60c7ec3d0d7aa92c5d39d0ab238cbb73a3c12734

  • SSDEEP

    384:wQMmdOFNYY0aaaIswqPeOrka1+fHQJ+t3rQkRhZV1Xb14nJ33OzEQKXEq88koTs:sFx0XaIsnPRIa4fwJMdqnJ33QKXEj3j

Score
10/10
agentteslacollectionkeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      INV000381021.doc

    • Size

      26KB

    • MD5

      8b33f455d3011f5b75cdf053e59ab724

    • SHA1

      29c35484623d8b483e4f4e2f053b873b4d08f55c

    • SHA256

      a274aac5116a0ac420cbef327f96663a687239d4e8668a2b89ad65b6147c8fe1

    • SHA512

      ad487296f19b63e6fcc0eb2df6d52d7bd8c10375517f0ef3a60eaf032ad9ee13afa84784b74b6df1be3a962e60c7ec3d0d7aa92c5d39d0ab238cbb73a3c12734

    • SSDEEP

      384:wQMmdOFNYY0aaaIswqPeOrka1+fHQJ+t3rQkRhZV1Xb14nJ33OzEQKXEq88koTs:sFx0XaIsnPRIa4fwJMdqnJ33QKXEj3j

    Score
    10/10
    agentteslacollectionkeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Exploitation for Client Execution

1
T1203

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks