Edit tour

Windows Analysis Report
statement of account.exe

Overview

General Information

Sample Name:	statement of account.exe
Analysis ID:	756035
MD5:	808f76963a9f42ad7310a3b7d65c7983
SHA1:	f748a841b2ec35bc40ed0bacbe953c28bc11a8a6
SHA256:	9f04b0b059e331845f8c3f9f4f83c785b07766529bb24dbbfb02fbab9e414938
Tags:	exe
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Yara detected AgentTesla

Yara detected AntiVM3

Sigma detected: Scheduled temp file as task from temp location

Multi AV Scanner detection for dropped file

Snort IDS alert for network traffic

Installs a global keyboard hook

Tries to steal Mail credentials (via file / registry access)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal ftp login credentials

Modifies the hosts file

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Machine Learning detection for sample

.NET source code contains potential unpacker

Injects a PE file into a foreign processes

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains very large array initializations

Machine Learning detection for dropped file

Hides that the sample has been downloaded from the Internet (zone.identifier)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Uses schtasks.exe or at.exe to add and modify task schedules

Tries to harvest and steal browser information (history, passwords, etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

Antivirus or Machine Learning detection for unpacked file

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Internet Provider seen in connection with other malware

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

Yara detected Credential Stealer

IP address seen in connection with other malware

Contains long sleeps (>= 3 min)

Enables debug privileges

Creates a DirectInput object (often for capturing keystrokes)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Sample file is different than original file name gathered from version info

Drops PE files

Detected TCP or UDP traffic on non-standard ports

Uses SMTP (mail sending)

Creates a window with clipboard capturing capabilities

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64

statement of account.exe (PID: 3184 cmdline: C:\Users\user\Desktop\statement of account.exe MD5: 808F76963A9F42AD7310A3B7D65C7983)

schtasks.exe (PID: 5144 cmdline: C:\Windows\System32\schtasks.exe" /Create /TN "Updates\LtdekfbHULJt" /XML "C:\Users\user\AppData\Local\Temp\tmp86BD.tmp MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 5304 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

statement of account.exe (PID: 1568 cmdline: {path} MD5: 808F76963A9F42AD7310A3B7D65C7983)

LtdekfbHULJt.exe (PID: 1172 cmdline: C:\Users\user\AppData\Roaming\LtdekfbHULJt.exe MD5: 808F76963A9F42AD7310A3B7D65C7983)

schtasks.exe (PID: 4080 cmdline: C:\Windows\System32\schtasks.exe" /Create /TN "Updates\LtdekfbHULJt" /XML "C:\Users\user\AppData\Local\Temp\tmp4337.tmp MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 408 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

LtdekfbHULJt.exe (PID: 4984 cmdline: {path} MD5: 808F76963A9F42AD7310A3B7D65C7983)

LIhMQ.exe (PID: 5448 cmdline: "C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe" MD5: 808F76963A9F42AD7310A3B7D65C7983)

schtasks.exe (PID: 5380 cmdline: C:\Windows\System32\schtasks.exe" /Create /TN "Updates\LtdekfbHULJt" /XML "C:\Users\user\AppData\Local\Temp\tmp26F5.tmp MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 5244 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

LIhMQ.exe (PID: 5332 cmdline: {path} MD5: 808F76963A9F42AD7310A3B7D65C7983)

LIhMQ.exe (PID: 2888 cmdline: {path} MD5: 808F76963A9F42AD7310A3B7D65C7983)

LIhMQ.exe (PID: 1920 cmdline: "C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe" MD5: 808F76963A9F42AD7310A3B7D65C7983)

cleanup

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Host": "mail.clipjoint.co.nz", "Username": "clipjoint@clipjoint.co.nz", "Password": "melandloz64"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000003.00000000.271494220.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000003.00000000.271494220.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000003.00000000.271494220.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_AgentTesla_d3ac2b2f	unknown	unknown	0x2ff7c:$a13: get_DnsResolver 0x2e71d:$a20: get_LastAccessed 0x3090e:$a27: set_InternalServerPort 0x30c2b:$a30: set_GuidMasterKey 0x2e824:$a33: get_Clipboard 0x2e832:$a34: get_Keyboard 0x2fb97:$a35: get_ShiftKeyDown 0x2fba8:$a36: get_AltKeyDown 0x2e83f:$a37: get_Password 0x2f32f:$a38: get_PasswordHash 0x30379:$a39: get_DefaultCredentials
00000000.00000002.290824392.0000000003D9C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.290824392.0000000003D9C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000000.00000002.290824392.0000000003D9C000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_AgentTesla_d3ac2b2f	unknown	unknown	0x15e56c:$a13: get_DnsResolver 0x19298c:$a13: get_DnsResolver 0x15cd0d:$a20: get_LastAccessed 0x19112d:$a20: get_LastAccessed 0x15eefe:$a27: set_InternalServerPort 0x19331e:$a27: set_InternalServerPort 0x15f21b:$a30: set_GuidMasterKey 0x19363b:$a30: set_GuidMasterKey 0x15ce14:$a33: get_Clipboard 0x191234:$a33: get_Clipboard 0x15ce22:$a34: get_Keyboard 0x191242:$a34: get_Keyboard 0x15e187:$a35: get_ShiftKeyDown 0x1925a7:$a35: get_ShiftKeyDown 0x15e198:$a36: get_AltKeyDown 0x1925b8:$a36: get_AltKeyDown 0x15ce2f:$a37: get_Password 0x19124f:$a37: get_Password 0x15d91f:$a38: get_PasswordHash 0x191d3f:$a38: get_PasswordHash 0x15e969:$a39: get_DefaultCredentials
00000013.00000002.522475390.0000000003091000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000013.00000002.522475390.0000000003091000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.524328070.000000000301C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000003.00000002.524328070.000000000301C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000016.00000002.522684815.0000000002991000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000016.00000002.522684815.0000000002991000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: statement of account.exe PID: 3184	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: statement of account.exe PID: 3184	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: statement of account.exe PID: 3184	Windows_Trojan_AgentTesla_d3ac2b2f	unknown	unknown	0x34a74:$a13: get_DnsResolver 0x338af:$a20: get_LastAccessed 0x351da:$a27: set_InternalServerPort 0x353b5:$a30: set_GuidMasterKey 0x33994:$a33: get_Clipboard 0x339a2:$a34: get_Keyboard 0x347ca:$a35: get_ShiftKeyDown 0x347db:$a36: get_AltKeyDown 0x339af:$a37: get_Password 0x3415f:$a38: get_PasswordHash 0x34d6e:$a39: get_DefaultCredentials
Process Memory Space: statement of account.exe PID: 1568	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: statement of account.exe PID: 1568	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: statement of account.exe PID: 1568	Windows_Trojan_AgentTesla_d3ac2b2f	unknown	unknown	0x4422:$a13: get_DnsResolver 0x2e23:$a20: get_LastAccessed 0x4d69:$a27: set_InternalServerPort 0x4fcc:$a30: set_GuidMasterKey 0x2f16:$a33: get_Clipboard 0x2f24:$a34: get_Keyboard 0x40dc:$a35: get_ShiftKeyDown 0x40ed:$a36: get_AltKeyDown 0x2f31:$a37: get_Password 0x397d:$a38: get_PasswordHash 0x47f6:$a39: get_DefaultCredentials
Process Memory Space: LIhMQ.exe PID: 2888	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: LIhMQ.exe PID: 2888	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: LtdekfbHULJt.exe PID: 4984	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: LtdekfbHULJt.exe PID: 4984	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 17 entries

Unpacked PEs

Source	Rule	Description</

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report
statement of account.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report statement of account.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Windows Analysis Report
statement of account.exe