Overview

overview

10

Static

static

1

elements.exp

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    elements.exp

  • Size

    339B

  • Sample

    240612-wevmnsxfmk

  • MD5

    21d2e6e281398404012724a6e8f3242d

  • SHA1

    11ca6bd4edb1466712e10c57c02c5a1cc3475176

  • SHA256

    31a13807659b75ab5dfd25e097f727705bdbdc9a6d61a8673df2510aa04110d0

  • SHA512

    3b2ab9dc7cc615a9b61bd421d416845748ad18c38bc31663496d3f54314538a480cc6b0ec1a976f7e66e9382fae5b6db97fce20c7ef5bb85f929da16755251fe

Score
10/10
agentteslaumbralexecutionkeyloggerspywarestealertrojan

Malware Config

Targets

    • Target

      elements.exp

    • Size

      339B

    • MD5

      21d2e6e281398404012724a6e8f3242d

    • SHA1

      11ca6bd4edb1466712e10c57c02c5a1cc3475176

    • SHA256

      31a13807659b75ab5dfd25e097f727705bdbdc9a6d61a8673df2510aa04110d0

    • SHA512

      3b2ab9dc7cc615a9b61bd421d416845748ad18c38bc31663496d3f54314538a480cc6b0ec1a976f7e66e9382fae5b6db97fce20c7ef5bb85f929da16755251fe

    Score
    10/10
    agentteslaumbralexecutionkeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Detect Umbral payload

    • Umbral

      Umbral stealer is an opensource moduler stealer written in C#.

      stealerumbral

    • AgentTesla payload

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Downloads MZ/PE file

    • Drops file in Drivers directory

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks