Overview

overview

10

Static

static

1

new order.exe

windows7-x64

10

new order.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    eb026b5d60b6f11392358a1f9ac9c3887fc47bc79d2f17eab64133a1d0485b32

  • Size

    640KB

  • Sample

    240523-c3x8xsba68

  • MD5

    dce89621c29e47535df7ba8922eaeff2

  • SHA1

    85e060c3b4d33d56bd9ef830439fd406f169df09

  • SHA256

    eb026b5d60b6f11392358a1f9ac9c3887fc47bc79d2f17eab64133a1d0485b32

  • SHA512

    7cca866d2b498fa16afcd80cd769533a67e5b97c8b2726bafe2a64290359d055fd6b59baaa1122b137c3c723436eb9e926444789d0d16316b2d88a8de844385b

  • SSDEEP

    12288:cI7gSfzCBdVtbMq1Rr1KLhJ8JIzkcSg+JEKeEGOCJBmxdCcnxdjd:37gSfzq1t+8JJEKeErGMxdB/jd

Score
10/10
agentteslaexecutionkeyloggerpersistencespywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      new order.exe

    • Size

      668KB

    • MD5

      cf021b7974c2665564085795f85a0ede

    • SHA1

      d2084747f540500ab61974ac288ab05f9d91334a

    • SHA256

      044ce9e194f5194b8d0e12e8e05fc3a3ff3782e60d5b3838351e80ac43663e4d

    • SHA512

      cf5d6acecf132c3a01ec82b3f4e8e2c66c854611b6d71b53d2b148fa492c47f800eb443a9e46828fb3cc3b408da571ee86ecc31facb67f8d7bfbd9560b7780aa

    • SSDEEP

      12288:iGCCi8LkpEatgdWrtzQswH4X1nqcSg+jEKAEGaCtXm3dCcQBoTY2ZkR:i9ZjE0GqNA4X1ijEKAER023d2BWE

    Score
    10/10
    agentteslaexecutionkeyloggerpersistencespywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Scheduled Task/Job

1
T1053

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Scheduled Task/Job

1
T1053

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Scheduled Task/Job

1
T1053

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks