MALICIOUS — Request_ISO_003820_1000517_03131.exe
MALICIOUS — Request_ISO_003820_1000517_03131.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the AgentTesla family. 8 of 55 detection engines flagged it, exhibiting 3 ATT&CK techniques.
Identification
- SHA-256:
1aa449f87f49e3d7408b081f0bcd4d212e66ba1dd2a60ee116af6b6673bf0e1c - SHA-1:
edb69dc6a2aac5e01ad2be8b7d621a526e2d0b18 - MD5:
e74e2312eba536b859344285fa1c5adc - imphash:
f34d5f2d4577ed6d9ceec516c1f5a744 - ssdeep:
6144:9GdLjgFp8omzs9MrzTZ2ibSLBt1nhBWQtDMHX7PXWfJmP5:9GdLjamzsSzTZfSvdh4QtDemxw5 - TLSH:
T1E24A60A1561C4E17EBBD8E062F60350E996A2934F9D4370EF33A133CEB6C44396195B2 - Submitted as: Request_ISO_003820_1000517_03131.exe
- File type: pe · Size: 436224 bytes
- Verdict: malicious (100/100) · Family: AgentTesla
Detections (8 of 55 engines)
- capa (capabilities): capability:execution/powershell
- MalwareAnalyser heuristics (entropy/packer): Microsoft Linker
- ClamAV (daily): Win.Packed.Bladabindi-10017208-0
- YARA: Yara-Rules community: YR_AntiDebug_Checks
- Detect It Easy (packer/type): DIE:Microsoft Linker
- Microsoft Defender: Trojan:MSIL/AgentTesla
- Emsisoft (Emergency Kit): Trojan.Injector
- Kaspersky (KVRT): HEUR:Trojan.MSIL.Agent.gen
MITRE ATT&CK
Why this verdict
The malicious score of 100/100 is the fusion of 12 weighted signals:
- ClamAV (daily) flagged Win.Packed.Bladabindi-10017208-0 (rule
Win.Packed.Bladabindi-10017208-0) - engine signal, weight 0.90, confidence 0.95 - Memory forensics: 3 finding(s), e.g. RWX/private injected region in tsk_23d66060e1 (pid 6308) (rule
windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85 - Observed at runtime: Windows Service (T1543.003) (rule
Windows Service) - dynamic signal, weight 0.40, confidence 0.90 - 1 behavioral detection(s): Windows Service Installation [medium] (rule
tl-service-install) - dynamic signal, weight 0.40, confidence 0.90 - execute via PowerShell (rule
execute via PowerShell) - capa signal, weight 0.40, confidence 0.80 - Contacted 26 external host(s) at runtime (26 HTTP) - network signal, weight 0.40, confidence 0.80
- Anti-analysis: T1082 - dynamic signal, weight 0.40, confidence 0.75
- Extracted Snake config (0 C2) - engine signal, weight 0.45, confidence 0.60
- YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule
YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70 - Detect It Easy (packer/type) flagged DIE:Microsoft Linker (rule
DIE:Microsoft Linker) - engine signal, weight 0.35, confidence 0.70 - Packing/obfuscation: Microsoft Linker - static signal, weight 0.25, confidence 0.55
- Observed at runtime: Modify Registry (T1112) (rule
Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Dynamic analysis (windows)
4771 behavior events · 2 ATT&CK techniques · 15 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- to-do.office.com
- staging.to-do.officeppe.com
- teams.cloud.microsoft
- outlook.office.com
- outlook.office365.com
- outlook.cloud.microsoft
- checkip.dyndns.org
- freegeoip.app
- ipbase.com
- c.pki.goog
- ctldl.windowsupdate.com
- login.live.com
- ocsp.digicert.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- config.edge.skype.com
Dropped files
- 944c81cd8ef502ef8e445cbc9e6b68e813a489aa11b784e86e3f5fc2ee33ac44 -
944c81cd8ef502ef8e445cbc9e6b68e813a489aa11b784e86e3f5fc2ee33ac44 - a53c7c6fe42500b480a829888c8ba259f13bc7322447086656c3ea624a38f26b -
a53c7c6fe42500b480a829888c8ba259f13bc7322447086656c3ea624a38f26b - 4ea3ac95dd20240da5921de519427aec3df0d1e596277024267492fb4ba65e8a -
4ea3ac95dd20240da5921de519427aec3df0d1e596277024267492fb4ba65e8a - b25ab5af034cb9677ce89f6ecdf6071428887115072847f86f01835d48638268 -
b25ab5af034cb9677ce89f6ecdf6071428887115072847f86f01835d48638268 - e78f6ae400d65e03dc1594e7c044fefd5466cf49faef6dee9496f0d1be1787a2 -
e78f6ae400d65e03dc1594e7c044fefd5466cf49faef6dee9496f0d1be1787a2 - bb723df783275167cda679b6f58af48957b8bbc0c2bd67f2d98b45ca361f093d -
bb723df783275167cda679b6f58af48957b8bbc0c2bd67f2d98b45ca361f093d - cd7e3a29913eb4e7c1efa9c6cbe402a071fe2e346dae68a86e804ab116b8f94e -
cd7e3a29913eb4e7c1efa9c6cbe402a071fe2e346dae68a86e804ab116b8f94e - 49388185008463032571e1a76b83154cbed2d6247f2a516c898d7058d3fb22e4 -
49388185008463032571e1a76b83154cbed2d6247f2a516c898d7058d3fb22e4 - 534a735414d1af7e368fc44120dd2c287d844889c54e33816eb29acfb482b666 -
534a735414d1af7e368fc44120dd2c287d844889c54e33816eb29acfb482b666 - 696915ed49f53c5fb7cb766f7cd151c98dfb3316d0bfc3025c1da1601820028f -
696915ed49f53c5fb7cb766f7cd151c98dfb3316d0bfc3025c1da1601820028f - e20020b950a7e34bab7700acc2e9943ccb0b1f474570348ae82162d4e64a98a3 -
e20020b950a7e34bab7700acc2e9943ccb0b1f474570348ae82162d4e64a98a3 - c02dd54edf0b3411a0d5eca8c27abf9290840270306ec3d98b9f7d2527b61cc1 -
c02dd54edf0b3411a0d5eca8c27abf9290840270306ec3d98b9f7d2527b61cc1 - a59234db30566e4c21bc2be61e2aceb6676378b9ebf7b8fb8e4ce37ce27bea1d -
a59234db30566e4c21bc2be61e2aceb6676378b9ebf7b8fb8e4ce37ce27bea1d - 04dda0c85e7b1f42a8f214d529dfbdb3940c75ec593d7eb7377c444b351f5700 -
04dda0c85e7b1f42a8f214d529dfbdb3940c75ec593d7eb7377c444b351f5700 - 7ca3ff349cf3f99adaeac622820e84d5afe91513cf0b8d9ea9d1c1d755b7f3f3 -
7ca3ff349cf3f99adaeac622820e84d5afe91513cf0b8d9ea9d1c1d755b7f3f3
Embedded URLs
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
- http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787854875&P2=404&P3=2&P4=b0ykVX21BOL3ioo%2fhPtVW3Q%2fRSeQMs5VdxgaEKIaIElu8PymD1MLuvfUwgCKFLTnigLW7Vd3vyHeNXq%2fDGePLw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787854918&P2=404&P3=2&P4=ZnYSA5Udt6xmryCZcOqAOZCsVmt3SL0H6rYnzNh%2fX6%2blMKSKM5HTmQ8%2fNWnyQR4AukiFr0nGCpQJhIjjwAtwIQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
- http://checkip.dyndns.org/
- http://c.pki.goog/r/gsr1.crl
- http://c.pki.goog/r/r4.crl
Embedded domains
- checkip.dyndns.org
- freegeoip.app
- ipbase.com
Embedded IP addresses
- 13.69.109.131
- 4.247.188.233
- 4.230.171.124
- 4.144.132.223
- 20.165.94.63
- 135.232.92.97
- 20.42.73.24
- 20.76.201.171
- 52.123.129.14
- 40.103.64.242
- 52.123.128.14
- 203.26.79.13
- 172.178.240.163
- 20.184.175.14
- 20.184.175.2
- 74.178.232.29
- 52.110.12.16
- 52.110.12.24
- 52.148.114.188
- 135.234.160.244
- 193.122.130.0
- 104.21.73.97
- 172.67.209.71
- 72.153.5.140
- 52.110.12.32
File paths
- N:\=S!
More AgentTesla samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report