Extracted

• • Target
    127e68ca27a35db46bd09e61516bc247e517daea3f66bc23fb74132260958955.exe
  • Size 1.0MB
  • SHA256 127e68ca27a35db46bd09e61516bc247e517daea3f66bc23fb74132260958955
  • MD5 7d9e484d3a1ac6a6595ffb91b80496a4
  • SHA1 32424f5bb5a8b7a497e3f4ac31da0979e30a7088
  • SHA512 232599b4e4f06175d8e86dbcda183e7d40d9f121c782b4293389d1b994ce32ab94c969873b200436e8f09b4f17bda4b156a3ce1de2fbc4fae1ae3e47b8d5cb3e
  • SSDEEP 24576:Tkj2TMqpXIq/NFQ2qTqhuYTHVjmIx6cot0bftG:T+2nXIMQ2qW8YTHVHot0
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslaexecutionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2
• • Target
    82ac5f31ddf6476f7322ed63c871f2e63d78757629c6adf76b4c2aea8cf7afe1.dll
  • Size 3.8MB
  • SHA256 82ac5f31ddf6476f7322ed63c871f2e63d78757629c6adf76b4c2aea8cf7afe1
  • MD5 ae5ce67a93c92c160afc19d9724ffb07
  • SHA1 7e8220ffa157a576b2bc9c9e609c43ff9d3d075e
  • SHA512 5d164192d4dc4fc27d5f4b7c4686b02feb3c22433c02044efe28b09ffa1a701d51ed9f102756c1802b3168cf1e1c535c7490e954d6e3f2bf886aac80dc705c22
  • SSDEEP 98304:OKhSG0eZtyfi2CH6kk3iezordqKDmRUpLxjMj6taUiVmj:mGRZ4YHBnesrYofMj6Iwj
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral3behavioral4
• • Target
    9d7ce3ddff107c5a4815c7ae9c459a66b545a7706b5485d66eda8b2cfdc0a4c5.exe
  • Size 3.2MB
  • SHA256 9d7ce3ddff107c5a4815c7ae9c459a66b545a7706b5485d66eda8b2cfdc0a4c5
  • MD5 069d8565f208c71cb5496278392a3e8d
  • SHA1 2276be9129c6e50c4bb38ebe34e209ced3538492
  • SHA512 b85064722385adcea34546f6729eacf99612807abf3603fd011bd464254d61c1748b76c93f6eff07fc0324cac941a57e3b2f024f5c0b15a089138b39c923f431
  • SSDEEP 49152:/QswzIgfd2FhMj0pPKEg5QlLCO0pMHBVlFP2R7Yt5ibo0/1lliJEq1pC1G:/9+kFOj+PKEaQlLNBDRtuo9Eq10
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  executionpersistence

  • Modifies WinLogon for persistence

    persistence

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  behavioral5behavioral6
• • Target
    cf9aee9be42a9a9b88268906e8751200b84e727e39953ab0e1da4ec590db695e.exe
  • Size 4.3MB
  • SHA256 cf9aee9be42a9a9b88268906e8751200b84e727e39953ab0e1da4ec590db695e
  • MD5 8d253537af839ffffa35002272a69975
  • SHA1 75def7b867b5d7930416337d32fa7735cd62c9d1
  • SHA512 6e6a29739e4a1d2153787cc726e1aea51e37f51ea4b31fbde97cb55105dbc67413aa4e2b079df67332823615f76ffc1b06de0e6a4a09a4b881a89d79c0ce84ca
  • SSDEEP 24576:tTCsLxyCB/T0DwDCuk1H4ki+kwQpQPm0TVBTBMqpPYx0d41QixgN463thBedtE:tusLx
  • MD5 SHA1 SHA512 SSDEEP

  Score

  7^/10

  persistence

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral7behavioral8