General

  • Target

    new order.exe

  • Size

    497KB

  • Sample

    200529-hs3y8rr2p2

  • MD5

    d0e301c9c9892ff14f1a5fdd7b94d840

  • SHA1

    1764dfe3ff7917388032b34c378d30c2fd81fb15

  • SHA256

    0c630248507337f2835d5ff76bcadd48aca15cc50c4b334eabea3a93bac8a6cb

  • SHA512

    ed63a440aa1c7e617c0c8013b781bf1fed6b970fa0ec602b5b9522bd3d9a6f522627dd4d432c0a3382b77c8e3cef9328e36fe75766e1236455bdd2de73492662

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    mail.tandempakistan.com
  • Port:
    587
  • Username:
    mngacct@tandempakistan.com
  • Password:
    fayyazrml

Targets

    • Target

      new order.exe

    • Size

      497KB

    • MD5

      d0e301c9c9892ff14f1a5fdd7b94d840

    • SHA1

      1764dfe3ff7917388032b34c378d30c2fd81fb15

    • SHA256

      0c630248507337f2835d5ff76bcadd48aca15cc50c4b334eabea3a93bac8a6cb

    • SHA512

      ed63a440aa1c7e617c0c8013b781bf1fed6b970fa0ec602b5b9522bd3d9a6f522627dd4d432c0a3382b77c8e3cef9328e36fe75766e1236455bdd2de73492662

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • AgentTesla Payload

    • Looks for VirtualBox Guest Additions in registry

    • Looks for VMWare Tools registry key

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Registry Run Keys / Startup Folder

1
T1060

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Virtualization/Sandbox Evasion

2
T1497

Modify Registry

1
T1112

Credential Access

Credentials in Files

3
T1081

Discovery

Query Registry

4
T1012

Virtualization/Sandbox Evasion

2
T1497

System Information Discovery

3
T1082

Peripheral Device Discovery

1
T1120

Collection

Data from Local System

3
T1005

Tasks