Overview

overview

10

Static

static

1

Shipping d...ts.exe

windows7-x64

10

Shipping d...ts.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f126a67a8f8b0108fa85b7d9b772a37635446f4067ea50d05024c563507c52ed

  • Size

    650KB

  • Sample

    240913-hwzfaszhjk

  • MD5

    6c2ecb0954f10db4a0a201ea29bcb531

  • SHA1

    2ce2f073f5bd7f877db41c99b77faec84cc834d8

  • SHA256

    f126a67a8f8b0108fa85b7d9b772a37635446f4067ea50d05024c563507c52ed

  • SHA512

    2fa70399cc3f9236e57c596c39515a8e8f2421a2bc3f7bebcfa7df4e7fe1c983d7dfd79164df4303b70d08ead07d87356d1d71e235b353d4cf1698800faf0e98

  • SSDEEP

    12288:iZPPsKoPafQk0WYeRUJh060O0uuiI3jcntuHaKoR4JA1cS3wY6e+ci:nKutReRqt0LiI3YnYom9b0+ci

Score
10/10
agentteslacredential_accessdiscoveryexecutionkeyloggerpersistencespywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      Shipping documents.exe

    • Size

      714KB

    • MD5

      21951471cfc7c9beee8e3768e5a7665d

    • SHA1

      9de3b9262f971589fa4c50959aee765919886184

    • SHA256

      b9fecad5e2608354188022661b5e468b713da87adaaeda9d574fd3526c39cde3

    • SHA512

      e003272c18574d0664bb31d0ddb4bc98677ec7b1971f0ddff350cabd355a2411b95ac1f26e2f21d2e1fd1241ff7a070fe446325d83a9267ccf1cd97de7020e58

    • SSDEEP

      12288:oeO6upxZF7RRfNBXyc8NTh0O0O0gui03jcntzLYBViwt5XH/kR:DupTXhClT0Ni03YnJY7iw5q

    Score
    10/10
    agentteslacredential_accessdiscoveryexecutionkeyloggerpersistencespywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

      credential_accessstealer

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Network Configuration Discovery

1
T1016

Internet Connection Discovery

1
T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks