General
-
Target
wvP.exe
-
Size
722KB
-
Sample
240914-q9wwbsxgja
-
MD5
b33d730136cae062a912aebbdf3364d4
-
SHA1
2aa45f4bff155e5f2b717c3108ed60eb4e82f7d8
-
SHA256
83bd0492ad4599669d45f30993c0f6758940875008ee00a2b460f85566e1afee
-
SHA512
8a5a0654b6afae7d791b4c4c1236b28925a7e0d25d04e9b82f26c73e95a6abd7173067a7f81167ec6107ed9b3dcbb2004b2feab4c77d2c4f9c9ba17893554924
-
SSDEEP
12288:MWYIPXjxannnHg2tJVf4E/c3xVnBv66wHVKk8zbHPdeXfiD/KzKkjbD5T:MWYIPFannnHg2dQ8cx6LKkkbvdeQK+K
Static task
static1
Behavioral task
behavioral1
Sample
wvP.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
wvP.exe
Resource
win10v2004-20240802-en
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot5419172676:AAGNCqb7KIw9SSEGRFeD_N3VWL9qYPGdqaw/
Targets
-
-
Target
wvP.exe
-
Size
722KB
-
MD5
b33d730136cae062a912aebbdf3364d4
-
SHA1
2aa45f4bff155e5f2b717c3108ed60eb4e82f7d8
-
SHA256
83bd0492ad4599669d45f30993c0f6758940875008ee00a2b460f85566e1afee
-
SHA512
8a5a0654b6afae7d791b4c4c1236b28925a7e0d25d04e9b82f26c73e95a6abd7173067a7f81167ec6107ed9b3dcbb2004b2feab4c77d2c4f9c9ba17893554924
-
SSDEEP
12288:MWYIPXjxannnHg2tJVf4E/c3xVnBv66wHVKk8zbHPdeXfiD/KzKkjbD5T:MWYIPFannnHg2dQ8cx6LKkkbvdeQK+K
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Credentials from Password Stores: Credentials from Web Browsers
Malicious Access or copy of Web Browser Credential store.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
4Credentials In Files
3Credentials in Registry
1