Overview

overview

10

Static

static

1

AN.exe

windows7-x64

10

AN.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    AN.exe

  • Size

    730KB

  • Sample

    240904-ngklgsyfjp

  • MD5

    d72520639cb73d3364d7258c15518f55

  • SHA1

    6e1ebb649b0e00d4c8ebae01d481b4bd75b64eaf

  • SHA256

    ca9f996e829c1e7ad89c66f78bde33741d46a0b7ed03c8892f263937b0e6b400

  • SHA512

    207ab7047077f8c29ce24c46c2dc11ea5cbbbc2e00aa5955a3217518ffaf325c4cd2eb101be5d5885d9e78e6599402df7356bf4c02bd2bf8b32a3f62f9049be2

  • SSDEEP

    12288:Zb9eGY0igo17oLwnqDUMeEDAYERZu9Kt0ZoV54IqOVEOYCa0qCkR:Zb8G/q1csnIuEobu97a54INCOsB

Score
10/10
agentteslacredential_accessdiscoveryexecutionkeyloggerpersistencespywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      AN.exe

    • Size

      730KB

    • MD5

      d72520639cb73d3364d7258c15518f55

    • SHA1

      6e1ebb649b0e00d4c8ebae01d481b4bd75b64eaf

    • SHA256

      ca9f996e829c1e7ad89c66f78bde33741d46a0b7ed03c8892f263937b0e6b400

    • SHA512

      207ab7047077f8c29ce24c46c2dc11ea5cbbbc2e00aa5955a3217518ffaf325c4cd2eb101be5d5885d9e78e6599402df7356bf4c02bd2bf8b32a3f62f9049be2

    • SSDEEP

      12288:Zb9eGY0igo17oLwnqDUMeEDAYERZu9Kt0ZoV54IqOVEOYCa0qCkR:Zb8G/q1csnIuEobu97a54INCOsB

    Score
    10/10
    agentteslacredential_accessdiscoveryexecutionkeyloggerpersistencespywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

      credential_accessstealer

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks