Edit tour

Windows Analysis Report
ORDER (6256 OS)#391 PI.exe

Overview

General Information

Sample Name:	ORDER (6256 OS)#391 PI.exe
Analysis ID:	764027
MD5:	19081ef2a08f678a3203b29124043c41
SHA1:	e86acea06a600f170402a0c1020c25ac2550ffa0
SHA256:	2f356283c209400c6385a24450f266b59477e035e9389c8d1af4843cd1ad2374
Tags:	agentteslaexe
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Yara detected Telegram RAT

Yara detected AgentTesla

Yara detected AntiVM3

Sigma detected: Scheduled temp file as task from temp location

Multi AV Scanner detection for dropped file

Snort IDS alert for network traffic

Installs a global keyboard hook

Tries to steal Mail credentials (via file / registry access)

Initial sample is a PE file and has a suspicious name

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Uses the Telegram API (likely for C&C communication)

Contains functionality to register a low level keyboard hook

Machine Learning detection for sample

May check the online IP address of the machine

Injects a PE file into a foreign processes

.NET source code contains very large array initializations

Machine Learning detection for dropped file

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Uses schtasks.exe or at.exe to add and modify task schedules

Tries to harvest and steal browser information (history, passwords, etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

Yara detected Credential Stealer

JA3 SSL client fingerprint seen in connection with other malware

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Contains long sleeps (>= 3 min)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Sample file is different than original file name gathered from version info

Drops PE files

Uses a known web browser user agent for HTTP communication

Creates a window with clipboard capturing capabilities

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64

ORDER (6256 OS)#391 PI.exe (PID: 1688 cmdline: C:\Users\user\Desktop\ORDER (6256 OS)#391 PI.exe MD5: 19081EF2A08F678A3203B29124043C41)

schtasks.exe (PID: 5964 cmdline: C:\Windows\System32\schtasks.exe" /Create /TN "Updates\WsdnBq" /XML "C:\Users\user\AppData\Local\Temp\tmpF47D.tmp MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 2236 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

ORDER (6256 OS)#391 PI.exe (PID: 5052 cmdline: {path} MD5: 19081EF2A08F678A3203B29124043C41)

ORDER (6256 OS)#391 PI.exe (PID: 1948 cmdline: {path} MD5: 19081EF2A08F678A3203B29124043C41)

WsdnBq.exe (PID: 6004 cmdline: C:\Users\user\AppData\Roaming\WsdnBq.exe MD5: 19081EF2A08F678A3203B29124043C41)

schtasks.exe (PID: 2224 cmdline: C:\Windows\System32\schtasks.exe" /Create /TN "Updates\WsdnBq" /XML "C:\Users\user\AppData\Local\Temp\tmp645E.tmp MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 1496 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

WsdnBq.exe (PID: 1328 cmdline: {path} MD5: 19081EF2A08F678A3203B29124043C41)

cleanup

Malware Configuration

Threatname: Telegram RAT

{"C2 url": "https://api.telegram.org/bot5962712783:AAFVWYP7zptQlynX_9COtuxYcx3Dl7EnfUQ/sendMessage"}

Threatname: Agenttesla

{"Exfil Mode": "Telegram", "Telegram Url": "https://api.telegram.org/bot5962712783:AAFVWYP7zptQlynX_9COtuxYcx3Dl7EnfUQ/sendMessage?chat_id=1644584536"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000004.00000002.565934222.0000000002C20000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000008.00000002.566251641.00000000032BF000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000004.00000000.334155357.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_AgentTesla_d3ac2b2f	unknown	unknown	0x22d8b:$a20: get_LastAccessed 0x24dde:$a30: set_GuidMasterKey 0x22e59:$a33: get_Clipboard 0x22e67:$a34: get_Keyboard 0x23f96:$a35: get_ShiftKeyDown 0x23fa7:$a36: get_AltKeyDown 0x22e74:$a37: get_Password 0x23882:$a38: get_PasswordHash 0x246a9:$a39: get_DefaultCredentials
00000000.00000002.343033622.0000000003FC9000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_AgentTesla_d3ac2b2f	unknown	unknown	0xfb66b:$a20: get_LastAccessed 0x12368b:$a20: get_LastAccessed 0xfd6be:$a30: set_GuidMasterKey 0x1256de:$a30: set_GuidMasterKey 0xfb739:$a33: get_Clipboard 0x123759:$a33: get_Clipboard 0xfb747:$a34: get_Keyboard 0x123767:$a34: get_Keyboard 0xfc876:$a35: get_ShiftKeyDown 0x124896:$a35: get_ShiftKeyDown 0xfc887:$a36: get_AltKeyDown 0x1248a7:$a36: get_AltKeyDown 0xfb754:$a37: get_Password 0x123774:$a37: get_Password 0xfc162:$a38: get_PasswordHash 0x124182:$a38: get_PasswordHash 0xfcf89:$a39: get_DefaultCredentials 0x124fa9:$a39: get_DefaultCredentials
Process Memory Space: ORDER (6256 OS)#391 PI.exe PID: 1688	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: ORDER (6256 OS)#391 PI.exe PID: 1688	Windows_Trojan_AgentTesla_d3ac2b2f	unknown	unknown	0x1931e9:$a20: get_LastAccessed 0x194f4d:$a30: set_GuidMasterKey 0x1932b0:$a33: get_Clipboard 0x1932be:$a34: get_Keyboard 0x19427b:$a35: get_ShiftKeyDown 0x19428c:$a36: get_AltKeyDown 0x1932cb:$a37: get_Password 0x193c4a:$a38: get_PasswordHash 0x1948de:$a39: get_DefaultCredentials
Process Memory Space: ORDER (6256 OS)#391 PI.exe PID: 1948	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: ORDER (6256 OS)#391 PI.exe PID: 1948	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: ORDER (6256 OS)#391 PI.exe PID: 1948	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: ORDER (6256 OS)#391 PI.exe PID: 1948	Windows_Trojan_AgentTesla_d3ac2b2f	unknown	unknown	0x91dc:$a20: get_LastAccessed 0xaf40:$a30: set_GuidMasterKey 0x92a3:$a33: get_Clipboard 0x92b1:$a34: get_Keyboard 0xa26e:$a35: get_ShiftKeyDown 0xa27f:$a36: get_AltKeyDown 0x92be:$a37: get_Password 0x9c3d:$a38: get_PasswordHash 0xa8d1:$a39: get_DefaultCredentials
Process Memory Space: WsdnBq.exe PID: 6004	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: WsdnBq.exe PID: 1328	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: WsdnBq.exe PID: 1328	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: WsdnBq.exe PID: 1328	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 9 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.ORDER (6256 OS)#391 PI.exe.40a16e0.1.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x24777:$s10: logins 0x242b0:$s11: credential 0x21259:$g1: get_Clipboard 0x21267:$g2: get_Keyboard 0x21274:$g3: get_Password 0x22386:$g4: get_CtrlKeyDown 0x22396:$g5: get_ShiftKeyDown 0x223a7:$g6: get_AltKeyDown
0.2.ORDER (6256 OS)#391 PI.exe.40a16e0.1.unpack	Windows_Trojan_AgentTesla_d3ac2b2f	unknown	unknown	0x2118b:$a20: get_LastAccessed 0x231de:$a30: set_GuidMasterKey 0x21259:$a33: get_Clipboard 0x21267:$a34: get_Keyboard 0x22396:$a35: get_ShiftKeyDown 0x223a7:$a36: get_AltKeyDown 0x21274:$a37: get_Password 0x21c82:$a38: get_PasswordHash 0x22aa9:$a39: get_DefaultCredentials
4.0.ORDER (6256 OS)#391 PI.exe.400000.0.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x26577:$s10: logins 0x260b0:$s11: credential 0x23059:$g1: get_Clipboard 0x23067:$g2: get_Keyboard 0x23074:$g3: get_Password 0x24186:$g4: get_CtrlKeyDown 0x24196:$g5: get_ShiftKeyDown 0x241a7:$g6: get_AltKeyDown
4.0.ORDER (6256 OS)#391 PI.exe.400000.0.unpack	Windows_Trojan_AgentTesla_d3ac2b2f	unknown	unknown	0x22f8b:$a20: get_LastAccessed 0x24fde:$a30: set_GuidMasterKey 0x23059:$a33: get_Clipboard 0x23067:$a34: get_Keyboard 0x24196:$a35: get_ShiftKeyDown 0x241a7:$a36: get_AltKeyDown 0x23074:$a37: get_Password 0x23a82:$a38: get_PasswordHash 0x248a9:$a39: get_DefaultCredentials
0.2.ORDER (6256 OS)#391 PI.exe.40a16e0.1.raw.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x26577:$s10: logins 0x4e597:$s10: logins 0x260b0:$s11: credential 0x4e0d0:$s11: credential 0x23059:$g1: get_Clipboard 0x4b079:$g1: get_Clipboard 0x23067:$g2: get_Keyboard 0x4b087:$g2: get_Keyboard 0x23074:$g3: get_Password 0x4b094:$g3: get_Password 0x24186:$g4: get_CtrlKeyDown 0x4c1a6:$g4: get_CtrlKeyDown 0x24196:$g5: get_ShiftKeyDown 0x4c1b6:$g5: get_ShiftKeyDown 0x241a7:$g6: get_AltKeyDown 0x4c1c7:$g6: get_AltKeyDown
0.2.ORDER (6256 OS)#391 PI.exe.40a16e0.1.raw.unpack	Windows_Trojan_AgentTesla_d3ac2b2f	unknown	unknown	0x22f8b:$a20: get_LastAccessed 0x4afab:$a20: get_LastAccessed 0x24fde:$a30: set_GuidMasterKey 0x4cffe:$a30: set_GuidMasterKey 0x23059:$a33: get_Clipboard 0x4b079:$a33: get_Clipboard 0x23067:$a34: get_Keyboard 0x4b087:$a34: get_Keyboard 0x24196:$a35: get_ShiftKeyDown 0x4c1b6:$a35: get_ShiftKeyDown 0x241a7:$a36: get_AltKeyDown 0x4c1c7:$a36: get_AltKeyDown 0x23074:$a37: get_Password 0x4b094:$a37: get_Password 0x23a82:$a38: get_PasswordHash 0x4baa2:$a38: get_PasswordHash 0x248a9:$a39: get_DefaultCredentials 0x4c8c9:$a39: get_DefaultCredentials
5.2.WsdnBq.exe.2e72288.0.raw.unpack	INDICATOR_SUSPICIOUS_DisableWinDefender	Detects executables containing artifcats associated with disabling Widnows Defender	ditekSHen	0x32ec0:$reg1: SOFTWARE\Microsoft\Windows Defender\Features 0x32f04:$reg2: SOFTWARE\Policies\Microsoft\Windows Defender 0x32f4c:$reg2: SOFTWARE\Policies\Microsoft\Windows Defender 0x331d8:$s1: Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine $true 0x3323c:$s2: Set-MpPreference -DisableArchiveScanning $true 0x33294:$s3: Set-MpPreference -DisableIntrusionPreventionSystem $true 0x332ec:$s4: Set-MpPreference -DisableScriptScanning $true 0x33338:$s5: Set-MpPreference -SubmitSamplesConsent 2 0x33378:$s6: Set-MpPreference -MAPSReporting 0 0x333c4:$s7: Set-MpPreference -HighThreatDefaultAction 6 0x3341c:$s8: Set-MpPreference -ModerateThreatDefaultAction 6 0x3346c:$s9: Set-MpPreference -LowThreatDefaultAction 6 0x334bc:$s10: Set-MpPreference -SevereThreatDefaultAction 6
0.2.ORDER (6256 OS)#391 PI.exe.30f22b8.0.raw.unpack	INDICATOR_SUSPICIOUS_DisableWinDefender	Detects executables containing artifcats associated with disabling Widnows Defender	ditekSHen	0x32ec0:$reg1: SOFTWARE\Microsoft\Windows Defender\Features 0x32f04:$reg2: SOFTWARE\Policies\Microsoft\Windows Defender 0x32f4c:$reg2: SOFTWARE\Policies\Microsoft\Windows Defender 0x331d8:$s1: Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine $true 0x3323c:$s2: Set-MpPreference -DisableArchiveScanning $true 0x33294:$s3: Set-MpPreference -DisableIntrusionPreventionSystem $true 0x332ec:$s4: Set-MpPreference -DisableScriptScanning $true 0x33338:$s5: Set-MpPreference -SubmitSamplesConsent 2 0x33378:$s6: Set-MpPreference -MAPSReporting 0 0x333c4:$s7: Set-MpPreference -HighThreatDefaultAction 6 0x3341c:$s8: Set-MpPreference -ModerateThreatDefaultAction 6 0x3346c:$s9: Set-MpPreference -LowThreatDefaultAction 6 0x334bc:$s10: Set-MpPreference -SevereThreatDefaultAction 6
Click to see the 3 entries

Sigma Signatures

Persistence and Installation Behavior

Sigma detected: Scheduled temp file as task from temp location

Source: Process started

Author: Joe Security: Data: Command: C:\Windows\System32\schtasks.exe" /Create /TN "Updates\WsdnBq" /XML "C:\Users\user\AppData\Local\Temp\tmpF47D.tmp, CommandLine: C:\Windows\System32\schtasks.exe" /Create /TN "Updates\WsdnBq" /XML "C:\Users\user\AppData\Local\Temp\tmpF47D.tmp, CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: C:\Users\user\Desktop\ORDER (6256 OS)#391 PI.exe, ParentImage: C:\Users\user\Desktop\ORDER (6256 OS)#391 PI.exe, ParentProcessId: 1688, ParentProcessName: ORDER (6256 OS)#391 PI.exe, ProcessCommandLine: C:\Windows\System32\schtasks.exe" /Create /TN "Updates\WsdnBq" /XML "C:\Users\user\AppData\Local\Temp\tmpF47D.tmp, ProcessId: 5964, ProcessName: schtasks.exe

Snort Signatures

ETPRO TROJAN Agent Tesla Telegram Exfil - Source IP: 192.168.2.4 - Destination IP: 149.154.167.220

Timestamp:	192.168.2.4149.154.167.220496964432851779 12/09/22-10:19:40.984166
SID:	2851779
Source Port:	49696
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Agent Tesla Telegram Exfil - Source IP: 192.168.2.4 - Destination IP: 149.154.167.220

Timestamp:	192.168.2.4149.154.167.220496984432851779 12/09/22-10:20:17.013980
SID:	2851779
Source Port:	49698
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: ORDER (6256 OS)#391 PI.exe

ReversingLabs: Detection: 30%

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\WsdnBq.exe

ReversingLabs: Detection: 30%

Machine Learning detection for sample

Source: ORDER (6256 OS)#391 PI.exe

Joe Sandbox ML: detected

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\WsdnBq.exe

Joe Sandbox ML: detected

Source: 0.2.ORDER (6256 OS)#391 PI.exe.40a16e0.1.raw.unpack	Malware Configuration Extractor: Agenttesla {"Exfil Mode": "Telegram", "Telegram Url": "https://api.telegram.org/bot5962712783:AAFVWYP7zptQlynX_9COtuxYcx3Dl7EnfUQ/sendMessage?chat_id=1644584536"}
Source: WsdnBq.exe.1328.8.memstrmin	Malware Configuration Extractor: Telegram RAT {"C2 url": "https://api.telegram.org/bot5962712783:AAFVWYP7zptQlynX_9COtuxYcx3Dl7EnfUQ/sendMessage"}

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report
ORDER (6256 OS)#391 PI.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Telegram RAT

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Persistence and Installation Behavior

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report ORDER (6256 OS)#391 PI.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Telegram RAT

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Persistence and Installation Behavior

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Windows Analysis Report
ORDER (6256 OS)#391 PI.exe