agenttesla | 6ba493ea1e159994234cd97a74f73df015437fecb04bf65c350d3d55f7940949

General

Target
SWIFT COPY.exe
Size 416KB
Sample200627-aaxndd357a
SHA256 6ba493ea1e159994234cd97a74f73df015437fecb04bf65c350d3d55f7940949
MD5 2b506cfd99e66483f273f28d46d96809
SHA1 0bbefb890d82e1f77f05facd69171b4613d71d0c
SHA512 30b64e4a8c788ecb202632b76881a81311a966a372370bd7df366d9d83ce233adb901c2a57b07b51a3183c8f4960b7b7b163bc5127da421ea0137f94a4eacea7
MD5 SHA1 SHA512

Score

10^/10

Credentials

Family

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 2 IoCs

resource	yara_rule
behavioral2/memory/3832-2-0x0000000000400000-0x000000000044E000-memory.dmp	family_agenttesla
behavioral2/memory/3832-3-0x000000000044763E-mapping.dmp	family_agenttesla

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	SWIFT COPY.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\Run\CpSnJ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\CpSnJ\\CpSnJ.exe"	SWIFT COPY.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 640 set thread context of 3832	640	SWIFT COPY.exe	74

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
2724	schtasks.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

pid	Process
3756	REG.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	640	SWIFT COPY.exe
Token: SeDebugPrivilege	3832	SWIFT COPY.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 640 wrote to memory of 2724	640	SWIFT COPY.exe	72
PID 640 wrote to memory of 2724	640	SWIFT COPY.exe	72
PID 640 wrote to memory of 2724	640	SWIFT COPY.exe	72
PID 640 wrote to memory of 3832	640	SWIFT COPY.exe	74
PID 640 wrote to memory of 3832	640	SWIFT COPY.exe	74
PID 640 wrote to memory of 3832	640	SWIFT COPY.exe	74
PID 640 wrote to memory of 3832	640	SWIFT COPY.exe	74
PID 640 wrote to memory of 3832	640	SWIFT COPY.exe	74
PID 640 wrote to memory of 3832	640	SWIFT COPY.exe	74
PID 640 wrote to memory of 3832	640	SWIFT COPY.exe	74
PID 640 wrote to memory of 3832	640	SWIFT COPY.exe	74
PID 3832 wrote to memory of 3756	3832	SWIFT COPY.exe	76
PID 3832 wrote to memory of 3756	3832	SWIFT COPY.exe	76
PID 3832 wrote to memory of 3756	3832	SWIFT COPY.exe	76

C:\Users\Admin\AppData\Local\Temp\SWIFT COPY.exe
"C:\Users\Admin\AppData\Local\Temp\SWIFT COPY.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:640
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GjbvhIqrtWfVi" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5087.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:2724
- C:\Users\Admin\AppData\Local\Temp\SWIFT COPY.exe
  "{path}"
  2⤵
  - Drops file in Drivers directory
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3832
- - C:\Windows\SysWOW64\REG.exe
    REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System / v DisableTaskMgr / t REG_DWORD / d 1 / f
    3⤵
    - Modifies registry key
    PID:3756