MALICIOUS — e1c92a856c4f67c3054113642ab5be15f5766b8e335798d55b66fbc9ad5892ab
MALICIOUS — e1c92a856c4f67c3054113642ab5be15f5766b8e335798d55b66fbc9ad5892ab is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the AgentTesla family. 4 of 56 detection engines flagged it, exhibiting 6 ATT&CK techniques.
Identification
- SHA-256:
e1c92a856c4f67c3054113642ab5be15f5766b8e335798d55b66fbc9ad5892ab - SHA-1:
8b4e72f43e078085f3fab29153e0768fe3bbff42 - MD5:
ada13c57b2095a67a164f43f99d902b1 - imphash:
f34d5f2d4577ed6d9ceec516c1f5a744 - ssdeep:
12288:7LuNd2XAL4kXwI6ktD00ymX7EbvD7nyOgMaOgsPXpsRh+4I6/JJ:7LGC0fWvqOg2psXTI6RJ - TLSH:
T1354E07444208953BD9739BA39B6073CF9AF326C82FDE573523172E266462DCF4806768 - Submitted as: e1c92a856c4f67c3054113642ab5be15f5766b8e335798d55b66fbc9ad5892ab
- File type: pe · Size: 656896 bytes
- Verdict: malicious (100/100) · Family: AgentTesla
Detections (4 of 56 engines)
- Microsoft Defender: Trojan:MSIL/AgentTesla.SM!MTB
- Emsisoft (Emergency Kit): Gen:Trojan.Olock.1
- Trellix Stinger (McAfee): AgentTesla-FDBQ!ADA13C57B209
- Kaspersky (KVRT): HEUR:Trojan-PSW.MSIL.Agensla.gen
MITRE ATT&CK
Why this verdict
The malicious score of 100/100 is the fusion of 11 weighted signals:
- 4 behavioral detection(s) across 4 rule(s): Registry Run Key Persistence [high] (rule
tl-run-key) - dynamic signal, weight 0.69, confidence 0.90 - Microsoft Defender flagged Trojan:MSIL/AgentTesla.SM!MTB (rule
Trojan:MSIL/AgentTesla.SM!MTB) - engine signal, weight 0.55, confidence 0.85 - Emsisoft (Emergency Kit) flagged Gen:Trojan.Olock.1 (rule
Gen:Trojan.Olock.1) - engine signal, weight 0.55, confidence 0.85 - Trellix Stinger (McAfee) flagged AgentTesla-FDBQ!ADA13C57B209 (rule
AgentTesla-FDBQ!ADA13C57B209) - engine signal, weight 0.55, confidence 0.85 - Kaspersky (KVRT) flagged HEUR:Trojan-PSW.MSIL.Agensla.gen (rule
HEUR:Trojan-PSW.MSIL.Agensla.gen) - engine signal, weight 0.55, confidence 0.85 - Observed at runtime: Registry Run Key Persistence (T1547.001) (rule
Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90 - Observed at runtime: Windows Service (T1543.003) (rule
Windows Service) - dynamic signal, weight 0.40, confidence 0.90 - Contacted 2 external host(s) and 7 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
- Anti-analysis: T1497, T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
- Extracted AgentTesla config (0 C2) - engine signal, weight 0.45, confidence 0.60
- Observed at runtime: Modify Registry (T1112) (rule
Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Dynamic analysis (windows)
18411 behavior events · 3 ATT&CK techniques · 19 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- ctldl.windowsupdate.com
- update.googleapis.com
- login.live.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- config.edge.skype.com
- windows.msn.com
- www.msn.com
- officeclient.microsoft.com
- odc.officeapps.live.com
- settings-win.data.microsoft.com
- assets.msn.com
- www.bing.com
- fe3cr.delivery.mp.microsoft.com
- v10.events.data.microsoft.com
- slscr.update.microsoft.com
Dropped files
- C:\Users\analyst\AppData\Local\Temp\tmp59D3.tmp -
cb11fb1488a3ba08e3a70dec4f4e9fcb27a3da298b3a710800076a3d86a0df0b - C:\Windows\System32\Drivers\etc\hosts -
9b13a3ea948a1071a81787aac1930b89e30df22ce13f8ff751f31b5d83e79ffb - bbcc9b1f4443dc26a4083015ad1cfec6188117fdcec1b67f4c720b58c57e9d60 -
bbcc9b1f4443dc26a4083015ad1cfec6188117fdcec1b67f4c720b58c57e9d60 - 8fda27d6202a2a1cdca1c2e1c4f2461acc86f207b7ed5f3b9cb1fea39091d9f9 -
8fda27d6202a2a1cdca1c2e1c4f2461acc86f207b7ed5f3b9cb1fea39091d9f9 - b39cfa611dfd2e4ef6c5e08a060e022802855e9729d18fba59640bcc82a89bdf -
b39cfa611dfd2e4ef6c5e08a060e022802855e9729d18fba59640bcc82a89bdf - ff02dce74e78a9340a16f1e02b57ebd7c3dc199edd10764c264aecacad53c913 -
ff02dce74e78a9340a16f1e02b57ebd7c3dc199edd10764c264aecacad53c913 - 1b3e1d58df05642849d06733f6034b5811908ef913d90d3834488294ce5733d9 -
1b3e1d58df05642849d06733f6034b5811908ef913d90d3834488294ce5733d9 - 7148761820fd00668428c1c7b3170d0df6d9e20f098aaa6e83a268bddc8b378b -
7148761820fd00668428c1c7b3170d0df6d9e20f098aaa6e83a268bddc8b378b - 81e933b8fdef96be419a09498009b93234c26ae5a6830ee33e039097358097d7 -
81e933b8fdef96be419a09498009b93234c26ae5a6830ee33e039097358097d7 - 43e38f251dbca9aa20f3470167e5427a7e7a7cdcd25f0b6b045ae8577cd3e345 -
43e38f251dbca9aa20f3470167e5427a7e7a7cdcd25f0b6b045ae8577cd3e345 - c6323694416bbec2ed0440ed601cbcfe8a6fa71204672c93b337de6f02dd8501 -
c6323694416bbec2ed0440ed601cbcfe8a6fa71204672c93b337de6f02dd8501 - 04600a8d25aab4a373712a076b3aacc64baa1f83e36f6564376750d5f098d131 -
04600a8d25aab4a373712a076b3aacc64baa1f83e36f6564376750d5f098d131 - d6e10cbadfe0396c19b86894e016b328805b7c3092236ad20b0f060e73f09c80 -
d6e10cbadfe0396c19b86894e016b328805b7c3092236ad20b0f060e73f09c80 - 58ad6d8b22bf1451f944b20a12265b45f80abc70fe575389e3f574a8b665bed1 -
58ad6d8b22bf1451f944b20a12265b45f80abc70fe575389e3f574a8b665bed1 - db19fa09efa3cf6c874514d42786aaaf5d595391565d49b5a63cfe4e92d5e9c7 -
db19fa09efa3cf6c874514d42786aaaf5d595391565d49b5a63cfe4e92d5e9c7
Embedded URLs
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
Embedded IP addresses
- 4.150.223.98
- 4.230.171.124
- 85.210.196.11
- 74.178.240.51
- 135.232.92.137
- 51.116.253.169
- 52.230.60.54
- 4.150.223.113
- 52.110.12.16
- 52.110.12.28
- 135.234.160.245
- 4.247.188.224
- 72.145.35.108
- 52.148.114.188
- 52.110.12.30
- 52.110.12.54
More AgentTesla samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report