Edit tour

Windows Analysis Report
NEW ORDER.exe

Overview

General Information

Sample Name:	NEW ORDER.exe
Analysis ID:	626340
MD5:	2ab185544e86862dab6a5e7a4413c49f
SHA1:	695efe1081e5b65894132e870f882b587ad4dfce
SHA256:	ae376c158f4f8a123ca19b3fe6c96a158c8f7f88257cf07de7987b33d376acb2
Tags:	exe
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Yara detected AgentTesla

Yara detected AntiVM3

Multi AV Scanner detection for dropped file

Snort IDS alert for network traffic

Tries to steal Mail credentials (via file / registry access)

Initial sample is a PE file and has a suspicious name

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Machine Learning detection for sample

Injects a PE file into a foreign processes

.NET source code contains very large array initializations

Machine Learning detection for dropped file

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Uses schtasks.exe or at.exe to add and modify task schedules

Tries to harvest and steal browser information (history, passwords, etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

Antivirus or Machine Learning detection for unpacked file

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Internet Provider seen in connection with other malware

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

Yara detected Credential Stealer

Contains long sleeps (>= 3 min)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Sample file is different than original file name gathered from version info

Drops PE files

Detected TCP or UDP traffic on non-standard ports

Uses SMTP (mail sending)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64

NEW ORDER.exe (PID: 7016 cmdline: "C:\Users\user\Desktop\NEW ORDER.exe" MD5: 2AB185544E86862DAB6A5E7A4413C49F)

schtasks.exe (PID: 7120 cmdline: C:\Windows\System32\schtasks.exe" /Create /TN "Updates\IrUpgWwdRBJK" /XML "C:\Users\user\AppData\Local\Temp\tmp354B.tmp MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 7128 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

NEW ORDER.exe (PID: 3968 cmdline: {path} MD5: 2AB185544E86862DAB6A5E7A4413C49F)

cleanup

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Username": "whford@focuzauto.com", "Password": "Gdn4ford@2016", "Host": "mail.focuzauto.com"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000003.00000000.486980862.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000003.00000000.486980862.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000000.00000002.505972636.000000000362F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.505972636.000000000362F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000003.00000002.698717283.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000003.00000002.698717283.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000003.00000000.487669907.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000003.00000000.487669907.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000003.00000000.485892465.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000003.00000000.485892465.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000003.00000000.486525104.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000003.00000000.486525104.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000003.00000002.705211244.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000003.00000002.705211244.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: NEW ORDER.exe PID: 7016	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: NEW ORDER.exe PID: 7016	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: NEW ORDER.exe PID: 3968	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: NEW ORDER.exe PID: 3968	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 13 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.NEW ORDER.exe.376bf08.4.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.NEW ORDER.exe.376bf08.4.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.NEW ORDER.exe.376bf08.4.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x30bd9:$s10: logins 0x30646:$s11: credential 0x2ccac:$g1: get_Clipboard 0x2ccba:$g2: get_Keyboard 0x2ccc7:$g3: get_Password 0x2df77:$g4: get_CtrlKeyDown 0x2df87:$g5: get_ShiftKeyDown 0x2df98:$g6: get_AltKeyDown
3.0.NEW ORDER.exe.400000.4.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
3.0.NEW ORDER.exe.400000.4.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
3.0.NEW ORDER.exe.400000.4.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x329d9:$s10: logins 0x32446:$s11: credential 0x2eaac:$g1: get_Clipboard 0x2eaba:$g2: get_Keyboard 0x2eac7:$g3: get_Password 0x2fd77:$g4: get_CtrlKeyDown 0x2fd87:$g5: get_ShiftKeyDown 0x2fd98:$g6: get_AltKeyDown
3.0.NEW ORDER.exe.400000.8.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
3.0.NEW ORDER.exe.400000.8.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
3.0.NEW ORDER.exe.400000.8.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x329d9:$s10: logins 0x32446:$s11: credential 0x2eaac:$g1: get_Clipboard 0x2eaba:$g2: get_Keyboard 0x2eac7:$g3: get_Password 0x2fd77:$g4: get_CtrlKeyDown 0x2fd87:$g5: get_ShiftKeyDown 0x2fd98:$g6: get_AltKeyDown
3.0.NEW ORDER.exe.400000.6.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
3.0.NEW ORDER.exe.400000.6.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
3.0.NEW ORDER.exe.400000.6.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x329d9:$s10: logins 0x32446:$s11: credential 0x2eaac:$g1: get_Clipboard 0x2eaba:$g2: get_Keyboard 0x2eac7:$g3: get_Password 0x2fd77:$g4: get_CtrlKeyDown 0x2fd87:$g5: get_ShiftKeyDown 0x2fd98:$g6: get_AltKeyDown
3.2.NEW ORDER.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
3.2.NEW ORDER.exe.400000.0.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
3.2.NEW ORDER.exe.400000.0.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x329d9:$s10: logins 0x32446:$s11: credential 0x2eaac:$g1: get_Clipboard 0x2eaba:$g2: get_Keyboard 0x2eac7:$g3: get_Password 0x2fd77:$g4: get_CtrlKeyDown 0x2fd87:$g5: get_ShiftKeyDown 0x2fd98:$g6: get_AltKeyDown
0.2.NEW ORDER.exe.2654f00.1.raw.unpack	INDICATOR_SUSPICIOUS_DisableWinDefender	Detects executables containing artifcats associated with disabling Widnows Defender	ditekSHen	0x8520:$reg1: SOFTWARE\Microsoft\Windows Defender\Features 0x8564:$reg2: SOFTWARE\Policies\Microsoft\Windows Defender 0x85ac:$reg2: SOFTWARE\Policies\Microsoft\Windows Defender 0x8838:$s1: Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine $true 0x889c:$s2: Set-MpPreference -DisableArchiveScanning $true 0x88f4:$s3: Set-MpPreference -DisableIntrusionPreventionSystem $true 0x894c:$s4: Set-MpPreference -DisableScriptScanning $true 0x8998:$s5: Set-MpPreference -SubmitSamplesConsent 2 0x89d8:$s6: Set-MpPreference -MAPSReporting 0 0x8a24:$s7: Set-MpPreference -HighThreatDefaultAction 6 0x8a7c:$s8: Set-MpPreference -ModerateThreatDefaultAction 6 0x8acc:$s9: Set-MpPreference -LowThreatDefaultAction 6 0x8b1c:$s10: Set-MpPreference -SevereThreatDefaultAction 6
3.0.NEW ORDER.exe.400000.10.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
3.0.NEW ORDER.exe.400000.10.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
3.0.NEW ORDER.exe.400000.10.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x329d9:$s10: logins 0x32446:$s11: credential 0x2eaac:$g1: get_Clipboard 0x2eaba:$g2: get_Keyboard 0x2eac7:$g3: get_Password 0x2fd77:$g4: get_CtrlKeyDown 0x2fd87:$g5: get_ShiftKeyDown 0x2fd98:$g6: get_AltKeyDown
3.0.NEW ORDER.exe.400000.12.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
3.0.NEW ORDER.exe.400000.12.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
3.0.NEW ORDER.exe.400000.12.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x329d9:$s10: logins 0x32446:$s11: credential 0x2eaac:$g1: get_Clipboard 0x2eaba:$g2: get_Keyboard 0x2eac7:$g3: get_Password 0x2fd77:$g4: get_CtrlKeyDown 0x2fd87:$g5: get_ShiftKeyDown 0x2fd98:$g6: get_AltKeyDown
0.2.NEW ORDER.exe.376bf08.4.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.NEW ORDER.exe.376bf08.4.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.NEW ORDER.exe.376bf08.4.raw.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x329d9:$s10: logins 0x66bf9:$s10: logins 0x32446:$s11: credential 0x66666:$s11: credential 0x2eaac:$g1: get_Clipboard 0x62ccc:$g1: get_Clipboard 0x2eaba:$g2: get_Keyboard 0x62cda:$g2: get_Keyboard 0x2eac7:$g3: get_Password 0x62ce7:$g3: get_Password 0x2fd77:$g4: get_CtrlKeyDown 0x63f97:$g4: get_CtrlKeyDown 0x2fd87:$g5: get_ShiftKeyDown 0x63fa7:$g5: get_ShiftKeyDown 0x2fd98:$g6: get_AltKeyDown 0x63fb8:$g6: get_AltKeyDown
Click to see the 20 entries

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

ET TROJAN AgentTesla Exfil Via SMTP - Source IP: 192.168.2.5 - Destination IP: 166.62.10.145

Timestamp:	192.168.2.5166.62.10.145497835872030171 05/13/22-21:33:25.240893
SID:	2030171
Source Port:	49783
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 - Source IP: 192.168.2.5 - Destination IP: 166.62.10.145

Timestamp:	192.168.2.5166.62.10.145497835872840032 05/13/22-21:33:25.240991
SID:	2840032
Source Port:	49783
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Win32/Agent Tesla SMTP Activity - Source IP: 192.168.2.5 - Destination IP: 166.62.10.145

Timestamp:	192.168.2.5166.62.10.145497835872839723 05/13/22-21:33:25.240893
SID:	2839723
Source Port:	49783
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 3.0.NEW ORDER.exe.400000.6.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Username": "whford@focuzauto.com", "Password": "Gdn4ford@2016", "Host": "mail.focuzauto.com"}

Multi AV Scanner detection for submitted file

Source: NEW ORDER.exe	Virustotal: Detection: 37%			Perma Link
Source: NEW ORDER.exe	ReversingLabs: Detection: 41%

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\IrUpgWwdRBJK.exe

ReversingLabs: Detection: 41%

Machine Learning detection for sample

Source: NEW ORDER.exe

Joe Sandbox ML: detected

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\IrUpgWwdRBJK.exe

Joe Sandbox ML: detected

Source: 3.0.NEW ORDER.exe.400000.6.unpack	Avira: Label: TR/Spy.Gen8
Source: 3.0.NEW ORDER.exe.400000.8.unpack	Avira: Label: TR/Spy.Gen8
Source: 3.0.NEW ORDER.exe.400000.12.unpack	Avira: Label: TR/Spy.Gen8
Source: 3.2.NEW ORDER.exe.400000.0.unpack	Avira: Label: TR/Spy.Gen8
Source: 3.0.NEW ORDER.exe.400000.4.unpack	Avira: Label: TR/Spy.Gen8
Source: 3.0.NEW ORDER.exe.400000.10.unpack	Avira: Label: TR/Spy.Gen8

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report
NEW ORDER.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report NEW ORDER.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Windows Analysis Report
NEW ORDER.exe