General
-
Target
09820292829102.exe
-
Size
2.9MB
-
Sample
240612-p2cbaaygkj
-
MD5
1792b18d02c63465622a19b9c23fb084
-
SHA1
a409526cd3cecf1ad3f38fb4b280cad653b4e644
-
SHA256
5af99aa393db806ec2eef81788fdd8d819c4d3c98c006c93d715d3f4d1446752
-
SHA512
9706ac0b16011b37a5609035863b111e76a15151600e176a3953f0d5e30f006085add8cca1236c8dc573ff95d04e71d80db14254986be9e953d395f01ccff1c1
-
SSDEEP
12288:tEBGxqqxP5/svGne2/PypI4DHIXG4k9eRCuHneNOPI:tEEJP5kvGnbPypsXk9eRCuHeNOPI
Static task
static1
Behavioral task
behavioral1
Sample
09820292829102.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
09820292829102.exe
Resource
win10v2004-20240611-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.pishgamsanaat.com - Port:
587 - Username:
[email protected] - Password:
Pishgam123456 - Email To:
[email protected]
Extracted
Protocol: smtp- Host:
mail.pishgamsanaat.com - Port:
587 - Username:
[email protected] - Password:
Pishgam123456
Targets
-
-
Target
09820292829102.exe
-
Size
2.9MB
-
MD5
1792b18d02c63465622a19b9c23fb084
-
SHA1
a409526cd3cecf1ad3f38fb4b280cad653b4e644
-
SHA256
5af99aa393db806ec2eef81788fdd8d819c4d3c98c006c93d715d3f4d1446752
-
SHA512
9706ac0b16011b37a5609035863b111e76a15151600e176a3953f0d5e30f006085add8cca1236c8dc573ff95d04e71d80db14254986be9e953d395f01ccff1c1
-
SSDEEP
12288:tEBGxqqxP5/svGne2/PypI4DHIXG4k9eRCuHneNOPI:tEEJP5kvGnbPypsXk9eRCuHeNOPI
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5