Edit tour

Windows Analysis Report
SecuriteInfo.com.Win32.CrypterX-gen.16043.3621.exe

Overview

General Information

Sample Name:	SecuriteInfo.com.Win32.CrypterX-gen.16043.3621.exe
Analysis ID:	756116
MD5:	fe1aa7fa995970ebb34465d5dc0d8ce1
SHA1:	7505b261cc9df8c6ab8f10e035cf8d8319043cdb
SHA256:	655b12a219d0f0e39a84fe44483e25411be852ce2bb0d451a1cb1a9a670f70b8
Tags:	AgentTeslaexe
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Yara detected AgentTesla

Yara detected AntiVM3

Sigma detected: Scheduled temp file as task from temp location

Multi AV Scanner detection for dropped file

Snort IDS alert for network traffic

Installs a global keyboard hook

Tries to steal Mail credentials (via file / registry access)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal ftp login credentials

.NET source code references suspicious native API functions

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Machine Learning detection for sample

May check the online IP address of the machine

.NET source code contains potential unpacker

Injects a PE file into a foreign processes

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains very large array initializations

Machine Learning detection for dropped file

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Uses schtasks.exe or at.exe to add and modify task schedules

Tries to harvest and steal browser information (history, passwords, etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

Antivirus or Machine Learning detection for unpacked file

May sleep (evasive loops) to hinder dynamic analysis

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

Yara detected Credential Stealer

JA3 SSL client fingerprint seen in connection with other malware

IP address seen in connection with other malware

Contains long sleeps (>= 3 min)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Sample file is different than original file name gathered from version info

Drops PE files

Uses a known web browser user agent for HTTP communication

Detected TCP or UDP traffic on non-standard ports

Uses SMTP (mail sending)

Creates a window with clipboard capturing capabilities

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Creates a process in suspended mode (likely to inject code)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

System is w10x64

SecuriteInfo.com.Win32.CrypterX-gen.16043.3621.exe (PID: 4580 cmdline: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16043.3621.exe MD5: FE1AA7FA995970EBB34465D5DC0D8CE1)

schtasks.exe (PID: 5756 cmdline: C:\Windows\System32\schtasks.exe" /Create /TN "Updates\nrQtAokXKaSn" /XML "C:\Users\user\AppData\Local\Temp\tmp152E.tmp MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 5452 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

SecuriteInfo.com.Win32.CrypterX-gen.16043.3621.exe (PID: 5688 cmdline: {path} MD5: FE1AA7FA995970EBB34465D5DC0D8CE1)

SecuriteInfo.com.Win32.CrypterX-gen.16043.3621.exe (PID: 5900 cmdline: {path} MD5: FE1AA7FA995970EBB34465D5DC0D8CE1)

nrQtAokXKaSn.exe (PID: 5976 cmdline: C:\Users\user\AppData\Roaming\nrQtAokXKaSn.exe MD5: FE1AA7FA995970EBB34465D5DC0D8CE1)

schtasks.exe (PID: 1372 cmdline: C:\Windows\System32\schtasks.exe" /Create /TN "Updates\nrQtAokXKaSn" /XML "C:\Users\user\AppData\Local\Temp\tmpCC0B.tmp MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 3408 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

nrQtAokXKaSn.exe (PID: 2744 cmdline: {path} MD5: FE1AA7FA995970EBB34465D5DC0D8CE1)

nrQtAokXKaSn.exe (PID: 1008 cmdline: {path} MD5: FE1AA7FA995970EBB34465D5DC0D8CE1)

cleanup

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Host": "mail.strictfacilityservices.com", "Username": "accounts@strictfacilityservices.com", "Password": "SFS!@#321"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
0000000B.00000000.315331976.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000B.00000000.315331976.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0000000B.00000000.315331976.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_AgentTesla_d3ac2b2f	unknown	unknown	0x31cca:$a13: get_DnsResolver 0x303f4:$a20: get_LastAccessed 0x326d7:$a27: set_InternalServerPort 0x32a20:$a30: set_GuidMasterKey 0x30506:$a33: get_Clipboard 0x30514:$a34: get_Keyboard 0x318b5:$a35: get_ShiftKeyDown 0x318c6:$a36: get_AltKeyDown 0x30521:$a37: get_Password 0x31010:$a38: get_PasswordHash 0x3210b:$a39: get_DefaultCredentials
0000000B.00000002.532293061.0000000002CF4000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000010.00000002.533369231.00000000028E4000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000B.00000002.531415625.0000000002CA1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.325021706.0000000003D0C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.325021706.0000000003D0C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000000.00000002.325021706.0000000003D0C000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_AgentTesla_d3ac2b2f	unknown	unknown	0x159b5a:$a13: get_DnsResolver 0x18fd7a:$a13: get_DnsResolver 0x158284:$a20: get_LastAccessed 0x18e4a4:$a20: get_LastAccessed 0x15a567:$a27: set_InternalServerPort 0x190787:$a27: set_InternalServerPort 0x15a8b0:$a30: set_GuidMasterKey 0x190ad0:$a30: set_GuidMasterKey 0x158396:$a33: get_Clipboard 0x18e5b6:$a33: get_Clipboard 0x1583a4:$a34: get_Keyboard 0x18e5c4:$a34: get_Keyboard 0x159745:$a35: get_ShiftKeyDown 0x18f965:$a35: get_ShiftKeyDown 0x159756:$a36: get_AltKeyDown 0x18f976:$a36: get_AltKeyDown 0x1583b1:$a37: get_Password 0x18e5d1:$a37: get_Password 0x158ea0:$a38: get_PasswordHash 0x18f0c0:$a38: get_PasswordHash 0x159f9b:$a39: get_DefaultCredentials
00000010.00000002.532462363.0000000002891000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: SecuriteInfo.com.Win32.CrypterX-gen.16043.3621.exe PID: 4580	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: SecuriteInfo.com.Win32.CrypterX-gen.16043.3621.exe PID: 4580	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: SecuriteInfo.com.Win32.CrypterX-gen.16043.3621.exe PID: 4580	Windows_Trojan_AgentTesla_d3ac2b2f	unknown	unknown	0x130944:$a13: get_DnsResolver 0x12f730:$a20: get_LastAccessed 0x1310d5:$a27: set_InternalServerPort 0x1312bd:$a30: set_GuidMasterKey 0x12f81d:$a33: get_Clipboard 0x12f82b:$a34: get_Keyboard 0x13067d:$a35: get_ShiftKeyDown 0x13068e:$a36: get_AltKeyDown 0x12f838:$a37: get_Password 0x12ffe4:$a38: get_PasswordHash 0x130c60:$a39: get_DefaultCredentials
Process Memory Space: SecuriteInfo.com.Win32.CrypterX-gen.16043.3621.exe PID: 5900	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: SecuriteInfo.com.Win32.CrypterX-gen.16043.3621.exe PID: 5900	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: SecuriteInfo.com.Win32.CrypterX-gen.16043.3621.exe PID: 5900	Windows_Trojan_AgentTesla_d3ac2b2f	unknown	unknown	0xb377:$a13: get_DnsResolver 0x9d04:$a20: get_LastAccessed 0xbd33:$a27: set_InternalServerPort 0xbfae:$a30: set_GuidMasterKey 0x9dff:$a33: get_Clipboard 0x9e0d:$a34: get_Keyboard 0xaffe:$a35: get_ShiftKeyDown 0xb00f:$a36: get_AltKeyDown 0x9e1a:$a37: get_Password 0xa862:$a38: get_PasswordHash 0xb78c:$a39: get_DefaultCredentials
Process Memory Space: nrQtAokXKaSn.exe PID: 1008	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: nrQtAokXKaSn.exe PID: 1008	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 13 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.SecuriteInfo.com.Win32.CrypterX-gen.16043.3621.exe.3e33c90.1.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.SecuriteInfo.com.Win32.CrypterX-gen.16043.3621.exe.3e33c90.1.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.SecuriteInfo.com.Win32.CrypterX-gen.16043.3621.exe.3e33c90.1.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x32bcc:$s10: logins 0x3264c:$s11: credential 0x2e906:$g1: get_Clipboard 0x2e914:$g2: get_Keyboard 0x2e921:$g3: get_Password 0x2fca5:$g4: get_CtrlKeyDown 0x2fcb5:$g5: get_ShiftKeyDown 0x2fcc6:$g6: get_AltKeyDown
0.2.SecuriteInfo.com.Win32.CrypterX-gen.16043.3621.exe.3e33c90.1.unpack	Windows_Trojan_AgentTesla_d3ac2b2f	unknown	unknown	0x300ca:$a13: get_DnsResolver 0x2e7f4:$a20: get_LastAccessed 0x30ad7:$a27: set_InternalServerPort 0x30e20:$a30: set_GuidMasterKey 0x2e906:$a33: get_Clipboard 0x2e914:$a34: get_Keyboard 0x2fcb5:$a35: get_ShiftKeyDown 0x2fcc6:$a36: get_AltKeyDown 0x2e921:$a37: get_Password 0x2f410:$a38: get_PasswordHash 0x3050b:$a39: get_DefaultCredentials
0.2.SecuriteInfo.com.Win32.CrypterX-gen.16043.3621.exe.2cfbae8.0.raw.unpack	INDICATOR_SUSPICIOUS_DisableWinDefender	Detects executables containing artifcats associated with disabling Widnows Defender	ditekSHen	0x29ecc:$reg1: SOFTWARE\Microsoft\Windows Defender\Features 0x29f10:$reg2: SOFTWARE\Policies\Microsoft\Windows Defender 0x29f58:$reg2: SOFTWARE\Policies\Microsoft\Windows Defender 0x2a1e4:$s1: Set-MpPreference -SignatureDisableUpdateOnStartupWithoutuser $true 0x2a248:$s2: Set-MpPreference -DisableArchiveScanning $true 0x2a2a0:$s3: Set-MpPreference -DisableIntrusionPreventionSystem $true 0x2a2f8:$s4: Set-MpPreference -DisableScriptScanning $true 0x2a344:$s5: Set-MpPreference -SubmitSamplesConsent 2 0x2a384:$s6: Set-MpPreference -MAPSReporting 0 0x2a3d0:$s7: Set-MpPreference -HighThreatDefaultAction 6 0x2a428:$s8: Set-MpPreference -ModerateThreatDefaultAction 6

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report
SecuriteInfo.com.Win32.CrypterX-gen.16043.3621.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.Win32.CrypterX-gen.16043.3621.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Windows Analysis Report
SecuriteInfo.com.Win32.CrypterX-gen.16043.3621.exe