agenttesla | f36bf6872593ea74f1e49facee9f8fead3527e09de2a810ca7f14bfd3f1191d0

General

Target
LOI and the Shippetâ€™s NOC.exe
Size 381KB
Sample200624-plf84ep7te
SHA256 f36bf6872593ea74f1e49facee9f8fead3527e09de2a810ca7f14bfd3f1191d0
MD5 7193fb69c828d4fe7c9995ccc34c645f
SHA1 3457988c7281794e7e97ea6faad81e2ffb3240fa
SHA512 4dc85c7cd2e040f779ac1b9b4b6ea7afdaebc86a6b6f637da2f0183b99996ebbc316fb72b4d94e6ed703384ef0aeb86850474c8346e48248cd742c762cea2824
MD5 SHA1 SHA512

Score

10^/10

Credentials

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3828	LOI and the Shippetâ€™s NOC.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3828	LOI and the Shippetâ€™s NOC.exe
3828	LOI and the Shippetâ€™s NOC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3828	LOI and the Shippetâ€™s NOC.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
4072	schtasks.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2728 wrote to memory of 4072	2728	LOI and the Shippetâ€™s NOC.exe	67
PID 2728 wrote to memory of 4072	2728	LOI and the Shippetâ€™s NOC.exe	67
PID 2728 wrote to memory of 4072	2728	LOI and the Shippetâ€™s NOC.exe	67
PID 2728 wrote to memory of 3828	2728	LOI and the Shippetâ€™s NOC.exe	69
PID 2728 wrote to memory of 3828	2728	LOI and the Shippetâ€™s NOC.exe	69
PID 2728 wrote to memory of 3828	2728	LOI and the Shippetâ€™s NOC.exe	69
PID 2728 wrote to memory of 3828	2728	LOI and the Shippetâ€™s NOC.exe	69
PID 2728 wrote to memory of 3828	2728	LOI and the Shippetâ€™s NOC.exe	69
PID 2728 wrote to memory of 3828	2728	LOI and the Shippetâ€™s NOC.exe	69
PID 2728 wrote to memory of 3828	2728	LOI and the Shippetâ€™s NOC.exe	69
PID 2728 wrote to memory of 3828	2728	LOI and the Shippetâ€™s NOC.exe	69

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2728 set thread context of 3828	2728	LOI and the Shippetâ€™s NOC.exe	69

Adds Run entry to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\Mymp4 = "C:\\Users\\Admin\\AppData\\Roaming\\Mymp4\\Mymp4.exe"	LOI and the Shippetâ€™s NOC.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

C:\Users\Admin\AppData\Local\Temp\LOI and the Shippetâ€™s NOC.exe
"C:\Users\Admin\AppData\Local\Temp\LOI and the Shippetâ€™s NOC.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:2728
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\YyGypa" /XML "C:\Users\Admin\AppData\Local\Temp\tmp76D1.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:4072
- C:\Users\Admin\AppData\Local\Temp\LOI and the Shippetâ€™s NOC.exe
  "{path}"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Adds Run entry to start application
  PID:3828