Overview

overview

10

Static

static

1

5620e82c34...26.exe

windows7-x64

10

5620e82c34...26.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5620e82c34754f8c0a8ee61597fd43b037e810f2dc2be1b2968dfbfee279bd26.exe

  • Size

    639KB

  • Sample

    240912-hslp2axamn

  • MD5

    29ef191ed82ea8c11cf1f99695ea0faf

  • SHA1

    e9e71a843dec6db3f47f1d7b5c25044761e378d9

  • SHA256

    5620e82c34754f8c0a8ee61597fd43b037e810f2dc2be1b2968dfbfee279bd26

  • SHA512

    51d405194b0be85e75c0af8349e2585cc70ccadff7f2e54cb63cd6ef46b923e59907b0f0ef0318958bea87cf34e8441afe59c625cc781c78f16926186e50c476

  • SSDEEP

    12288:7a7kvHzL2pOM7a1t0B51zwIkIGGvtmRM1SHTl7MKAdfwr2lCACZ5ymmkR:7aoHTsGIkCcRMQHOKGIreg5yQ

Score
10/10
agentteslacredential_accessdiscoveryexecutionkeyloggerpersistencespywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      5620e82c34754f8c0a8ee61597fd43b037e810f2dc2be1b2968dfbfee279bd26.exe

    • Size

      639KB

    • MD5

      29ef191ed82ea8c11cf1f99695ea0faf

    • SHA1

      e9e71a843dec6db3f47f1d7b5c25044761e378d9

    • SHA256

      5620e82c34754f8c0a8ee61597fd43b037e810f2dc2be1b2968dfbfee279bd26

    • SHA512

      51d405194b0be85e75c0af8349e2585cc70ccadff7f2e54cb63cd6ef46b923e59907b0f0ef0318958bea87cf34e8441afe59c625cc781c78f16926186e50c476

    • SSDEEP

      12288:7a7kvHzL2pOM7a1t0B51zwIkIGGvtmRM1SHTl7MKAdfwr2lCACZ5ymmkR:7aoHTsGIkCcRMQHOKGIreg5yQ

    Score
    10/10
    agentteslacredential_accessdiscoveryexecutionkeyloggerpersistencespywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

      credential_accessstealer

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks