Edit tour

Windows Analysis Report
pdP5Rv9pPW.exe

Overview

General Information

Sample Name:	pdP5Rv9pPW.exe
Analysis ID:	691823
MD5:	18e913ec810a1131c23d6fea7526c4f8
SHA1:	96c426169c87505e950898ad38913cc726bf198d
SHA256:	548a9d790d8d54baf1faf9c67133398a96fad5add7daa35e89aad9d777bd103d
Tags:	AgentTeslaexe
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Yara detected AgentTesla

Antivirus detection for URL or domain

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Snort IDS alert for network traffic

Installs a global keyboard hook

Tries to steal Mail credentials (via file / registry access)

Injects files into Windows application

Writes to foreign memory regions

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal ftp login credentials

Machine Learning detection for sample

Binary or sample is protected by dotNetProtector

Injects a PE file into a foreign processes

.NET source code contains very large array initializations

Machine Learning detection for dropped file

Hides that the sample has been downloaded from the Internet (zone.identifier)

Document exploit detected (process start blacklist hit)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Uses schtasks.exe or at.exe to add and modify task schedules

Tries to harvest and steal browser information (history, passwords, etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

Antivirus or Machine Learning detection for unpacked file

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Internet Provider seen in connection with other malware

Detected potential crypto function

Found potential string decryption / allocating functions

Contains functionality to launch a process as a different user

Sample execution stops while process was sleeping (likely an evasion)

Yara detected Credential Stealer

PE file contains executable resources (Code or Archives)

Contains long sleeps (>= 3 min)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Sample file is different than original file name gathered from version info

PE file contains strange resources

Drops PE files

Uses a known web browser user agent for HTTP communication

Checks if the current process is being debugged

Creates a window with clipboard capturing capabilities

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Dropped file seen in connection with other malware

Creates a process in suspended mode (likely to inject code)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

System is w10x64

pdP5Rv9pPW.exe (PID: 5704 cmdline: "C:\Users\user\Desktop\pdP5Rv9pPW.exe" MD5: 18E913EC810A1131C23D6FEA7526C4F8)

vbc.exe (PID: 5224 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe MD5: B3A917344F5610BEEC562556F11300FA)

cmd.exe (PID: 5020 cmdline: cmd" /c mkdir "C:\Users\user\AppData\Roaming\fghn MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 2188 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cmd.exe (PID: 5076 cmdline: "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Roaming\fghn\fghn.exe'" /f MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 4660 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

schtasks.exe (PID: 6128 cmdline: schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Roaming\fghn\fghn.exe'" /f MD5: 15FF7D8324231381BAD48A052F85DF04)

cmd.exe (PID: 4980 cmdline: cmd" /c copy "C:\Users\user\Desktop\pdP5Rv9pPW.exe" "C:\Users\user\AppData\Roaming\fghn\fghn.exe MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 4224 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

excel.exe (PID: 3980 cmdline: "C:\Users\user\AppData\Roaming\excel\excel.exe" MD5: B3A917344F5610BEEC562556F11300FA)

conhost.exe (PID: 3372 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

excel.exe (PID: 992 cmdline: "C:\Users\user\AppData\Roaming\excel\excel.exe" MD5: B3A917344F5610BEEC562556F11300FA)

conhost.exe (PID: 5728 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

fghn.exe (PID: 5836 cmdline: C:\Users\user\AppData\Roaming\fghn\fghn.exe MD5: 18E913EC810A1131C23D6FEA7526C4F8)

vbc.exe (PID: 1608 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe MD5: B3A917344F5610BEEC562556F11300FA)

cmd.exe (PID: 5436 cmdline: cmd" /c mkdir "C:\Users\user\AppData\Roaming\fghn MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 5336 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cmd.exe (PID: 3372 cmdline: "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Roaming\fghn\fghn.exe'" /f MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 5220 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

schtasks.exe (PID: 5332 cmdline: schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Roaming\fghn\fghn.exe'" /f MD5: 15FF7D8324231381BAD48A052F85DF04)

cmd.exe (PID: 4888 cmdline: cmd" /c copy "C:\Users\user\AppData\Roaming\fghn\fghn.exe" "C:\Users\user\AppData\Roaming\fghn\fghn.exe MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 3524 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cleanup

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "Http", "HTTP method": "Post", "Post URL": "http://141.98.6.75/weption/inc/0986372054b5f8.php"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000002.00000000.363305097.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000002.00000000.363305097.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000002.00000000.363305097.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_AgentTesla_d3ac2b2f	unknown	unknown	0x30055:$a13: get_DnsResolver 0x2e849:$a20: get_LastAccessed 0x309e9:$a27: set_InternalServerPort 0x30d02:$a30: set_GuidMasterKey 0x2e950:$a33: get_Clipboard 0x2e95e:$a34: get_Keyboard 0x2fc88:$a35: get_ShiftKeyDown 0x2fc99:$a36: get_AltKeyDown 0x2e96b:$a37: get_Password 0x2f40a:$a38: get_PasswordHash 0x3046b:$a39: get_DefaultCredentials
00000000.00000002.380144248.0000000003991000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.380144248.0000000003991000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000000.00000002.380144248.0000000003991000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_AgentTesla_d3ac2b2f	unknown	unknown	0x353c5:$a13: get_DnsResolver 0x699e5:$a13: get_DnsResolver 0x9de05:$a13: get_DnsResolver 0x33bb9:$a20: get_LastAccessed 0x681d9:$a20: get_LastAccessed 0x9c5f9:$a20: get_LastAccessed 0x35d59:$a27: set_InternalServerPort 0x6a379:$a27: set_InternalServerPort 0x9e799:$a27: set_InternalServerPort 0x36072:$a30: set_GuidMasterKey 0x6a692:$a30: set_GuidMasterKey 0x9eab2:$a30: set_GuidMasterKey 0x33cc0:$a33: get_Clipboard 0x682e0:$a33: get_Clipboard 0x9c700:$a33: get_Clipboard 0x33cce:$a34: get_Keyboard 0x682ee:$a34: get_Keyboard 0x9c70e:$a34: get_Keyboard 0x34ff8:$a35: get_ShiftKeyDown 0x69618:$a35: get_ShiftKeyDown 0x9da38:$a35: get_ShiftKeyDown
00000002.00000002.537927671.0000000006AF1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000002.00000002.537927671.0000000006AF1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000017.00000002.585255160.000000000721C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000017.00000002.585255160.000000000721C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: pdP5Rv9pPW.exe PID: 5704	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: pdP5Rv9pPW.exe PID: 5704	Windows_Trojan_AgentTesla_d3ac2b2f	unknown	unknown	0x336c3:$a13: get_DnsResolver 0x32117:$a20: get_LastAccessed 0x34006:$a27: set_InternalServerPort 0x34262:$a30: set_GuidMasterKey 0x3220a:$a33: get_Clipboard 0x32218:$a34: get_Keyboard 0x33395:$a35: get_ShiftKeyDown 0x333a6:$a36: get_AltKeyDown 0x32225:$a37: get_Password 0x32c20:$a38: get_PasswordHash 0x33aad:$a39: get_DefaultCredentials
Process Memory Space: vbc.exe PID: 5224	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: vbc.exe PID: 5224	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: vbc.exe PID: 5224	Windows_Trojan_AgentTesla_d3ac2b2f	unknown	unknown	0x750da:$a13: get_DnsResolver 0x73b2e:$a20: get_LastAccessed 0x75a1d:$a27: set_InternalServerPort 0x75c79:$a30: set_GuidMasterKey 0x73c21:$a33: get_Clipboard 0x73c2f:$a34: get_Keyboard 0x74dac:$a35: get_ShiftKeyDown 0x74dbd:$a36: get_AltKeyDown 0x73c3c:$a37: get_Password 0x74637:$a38: get_PasswordHash 0x754c4:$a39: get_DefaultCredentials
Process Memory Space: vbc.exe PID: 1608	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: vbc.exe PID: 1608	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 12 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.pdP5Rv9pPW.exe.3996170.1.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
2.0.vbc.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
2.0.vbc.exe.400000.0.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.pdP5Rv9pPW.exe.3996170.1.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
2.0.vbc.exe.400000.0.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x32b1b:$s10: logins 0x32582:$s11: credential 0x2eb50:$g1: get_Clipboard 0x2eb5e:$g2: get_Keyboard 0x2eb6b:$g3: get_Password 0x2fe78:$g4: get_CtrlKeyDown 0x2fe88:$g5: get_ShiftKeyDown 0x2fe99:$g6: get_AltKeyDown
0.2.pdP5Rv9pPW.exe.3996170.1.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x30d1b:$s10: logins 0x30782:$s11: credential 0x2cd50:$g1: get_Clipboard 0x2cd5e:$g2: get_Keyboard 0x2cd6b:$g3: get_Password 0x2e078:$g4: get_CtrlKeyDown 0x2e088:$g5: get_ShiftKeyDown 0x2e099:$g6: get_AltKeyDown
0.2.pdP5Rv9pPW.exe.3996170.1.unpack	Windows_Trojan_AgentTesla_d3ac2b2f	unknown	unknown	0x2e455:$a13: get_DnsResolver 0x2cc49:$a20: get_LastAccessed 0x2ede9:$a27: set_InternalServerPor

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report
pdP5Rv9pPW.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report pdP5Rv9pPW.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Windows Analysis Report
pdP5Rv9pPW.exe