agenttesla | e658e882e9edcae046e5229fbf61c435264f57f9a8af9b2cb5fe4419ea4cdb1c

General

Target
Scan - Swift MT103 document 24.06.2020.exe
Size 449KB
Sample200624-p3l5ese5vx
SHA256 e658e882e9edcae046e5229fbf61c435264f57f9a8af9b2cb5fe4419ea4cdb1c
MD5 f85730c10ff56e1382a768aca349bc5f
SHA1 0b0086a04e914996e5b4bae742f8372cf481a302
SHA512 238c6a1d39ea7fddb1d84ab079f2f5a8a41dbcc15289274b36a77aa1b09943159569d3c4257e17e33029a6bfb9d05a0e097be97b90f5ee24ade11c4d568e512b
MD5 SHA1 SHA512

Score

10^/10

Family

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 4 IoCs

resource	yara_rule
behavioral1/memory/520-4-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla
behavioral1/memory/520-5-0x0000000000446BAE-mapping.dmp	family_agenttesla
behavioral1/memory/520-6-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla
behavioral1/memory/520-7-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1016 set thread context of 520	1016	Scan - Swift MT103 document 24.06.2020.exe	28

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
1732	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
520	Scan - Swift MT103 document 24.06.2020.exe
520	Scan - Swift MT103 document 24.06.2020.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	520	Scan - Swift MT103 document 24.06.2020.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1016 wrote to memory of 1732	1016	Scan - Swift MT103 document 24.06.2020.exe	26
PID 1016 wrote to memory of 1732	1016	Scan - Swift MT103 document 24.06.2020.exe	26
PID 1016 wrote to memory of 1732	1016	Scan - Swift MT103 document 24.06.2020.exe	26
PID 1016 wrote to memory of 1732	1016	Scan - Swift MT103 document 24.06.2020.exe	26
PID 1016 wrote to memory of 520	1016	Scan - Swift MT103 document 24.06.2020.exe	28
PID 1016 wrote to memory of 520	1016	Scan - Swift MT103 document 24.06.2020.exe	28
PID 1016 wrote to memory of 520	1016	Scan - Swift MT103 document 24.06.2020.exe	28
PID 1016 wrote to memory of 520	1016	Scan - Swift MT103 document 24.06.2020.exe	28
PID 1016 wrote to memory of 520	1016	Scan - Swift MT103 document 24.06.2020.exe	28
PID 1016 wrote to memory of 520	1016	Scan - Swift MT103 document 24.06.2020.exe	28
PID 1016 wrote to memory of 520	1016	Scan - Swift MT103 document 24.06.2020.exe	28
PID 1016 wrote to memory of 520	1016	Scan - Swift MT103 document 24.06.2020.exe	28
PID 1016 wrote to memory of 520	1016	Scan - Swift MT103 document 24.06.2020.exe	28

C:\Users\Admin\AppData\Local\Temp\Scan - Swift MT103 document 24.06.2020.exe
"C:\Users\Admin\AppData\Local\Temp\Scan - Swift MT103 document 24.06.2020.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1016
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\kUIDCgmKmFDZd" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD77.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1732
- C:\Users\Admin\AppData\Local\Temp\Scan - Swift MT103 document 24.06.2020.exe
  "{path}"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:520