MALWARE ANALYSIS | Agent Tesla from an AutoIT EXE
Analysis of a UPX packed AutoIT binary which injects an Agent Tesla payload into memory, combined with some brief analysis of the Agent Tesla payload itself.
** Find me at **
Twitter/X - / cyberraiju
Blog - https://www.jaiminton.com/
Mastodon - https://infosec.exchange/@CyberRaiju
** Timestamps **
00:00 - Intro
00:24 - Extracting RAR sample
00:36 - Malware at a glance
00:46 - File metadata and properties
00:59 - Examining with Detect-It-Easy
01:10 - Unpacking with UPX
01:34 - Examining unpacked with Detect-It-Easy
01:45 - Examining AutoIT script with AutoIt-Extractor
01:59 - Metadata of system used to make malware
02:32 - Extracting AutoIT payloads
03:10 - Brief look at AutoIT script
03:20 - Examining unpacked capabilities with pestudio
03:30 - Jai does a big derp
03:40 - Examining script entropy levels
03:53 - Examining imports using PE-bear
04:03 - Determining injection capability using PE-bear
04:22 - Filtering Procmon
04:43 - Determining injection capability using pestudio
05:09 - Dynamic analysis of malware
05:32 - Evidence of VNC credential stealing
06:00 - Dumping payload from memory using pe-sieve
06:30 - Process start events in procmon
07:08 - Examining dumped payloads from memory
07:21 - Examining Agent Tesla using Detect-It-Easy
07:36 - Decompile Agent Tesla using DnSpy
08:00 - Jumping to Entry Point
08:17 - High level analysis of classes
08:42 - Evidence of keyboard hooking
08:53 - Evidence of keylogging
09:10 - HTML formatting of keylogger output
10:10 - Telegram exfiltration method
10:38 - Agent Tesla configuration declaration
10:48 - Jai does a level 2 derp
10:58 - Forged User Agent
11:13 - Gaining public IP information
11:23 - Enumerating system information
11:53 - Checking for persistence using Autoruns
12:22 - Browser harvesting capabilities
12:57 - Anti-AV checks
13:13 - Anti-VM checks
13:44 - Anti-Debugging checks
14:01 - Wrap up
14:15 - Outro
** Tools **
https://github.com/hasherezade/pe-sieve
https://github.com/horsicq/Detect-It-...
https://www.winitor.com/download
https://github.com/upx/upx
https://github.com/hasherezade/pe-bea...
https://github.com/dnSpyEx/dnSpy
https://learn.microsoft.com/en-us/sys...
https://github.com/digitalsleuth/auto...
** Sample **
https://bazaar.abuse.ch/sample/e17062...
Credits:
SFX by Pixabay
Music by Pixabay, Playsound, Praz Khanal, Zen_Man, Jonas