agenttesla | 404d422ffb09a4f24ad333ccdd211d0eb2ea84b650f095baadf3443fb6deb7b1

General

Target
PO.exe
Size 435KB
Sample200629-fe3h25h8ce
SHA256 404d422ffb09a4f24ad333ccdd211d0eb2ea84b650f095baadf3443fb6deb7b1
MD5 28159c2ff019251165e9d2ada70be08e
SHA1 94cbca8d04f668b0a3d71053077ebfe30b713530
SHA512 ba0f192b535a992f609028e34d2764245827a28f02f19f0ef43b6c37152b4d177353b04e372d3c48257f44fa864b25954a25b8d560e22392ba3edb610361c35f
MD5 SHA1 SHA512

Score

10^/10

Credentials

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 3384 wrote to memory of 540	3384	PO.exe	72
PID 3384 wrote to memory of 540	3384	PO.exe	72
PID 3384 wrote to memory of 540	3384	PO.exe	72
PID 3384 wrote to memory of 648	3384	PO.exe	74
PID 3384 wrote to memory of 648	3384	PO.exe	74
PID 3384 wrote to memory of 648	3384	PO.exe	74
PID 3384 wrote to memory of 648	3384	PO.exe	74
PID 3384 wrote to memory of 648	3384	PO.exe	74
PID 3384 wrote to memory of 648	3384	PO.exe	74
PID 3384 wrote to memory of 648	3384	PO.exe	74
PID 3384 wrote to memory of 648	3384	PO.exe	74
PID 648 wrote to memory of 1908	648	RegSvcs.exe	77
PID 648 wrote to memory of 1908	648	RegSvcs.exe	77
PID 648 wrote to memory of 1908	648	RegSvcs.exe	77

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3384 set thread context of 648	3384	PO.exe	74

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	648	RegSvcs.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
648	RegSvcs.exe
648	RegSvcs.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware

Data from Local System
T1005

Credentials in Files
T1081
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

pid	Process
1908	REG.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
540	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\PO.exe
"C:\Users\Admin\AppData\Local\Temp\PO.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:3384
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\YchbTZZKkVZKFJ" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF085.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:540
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
  "{path}"
  2⤵
  - Suspicious use of WriteProcessMemory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  PID:648
- - C:\Windows\SysWOW64\REG.exe
    REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer / v NoRun / t REG_DWORD / d 1 / f
    3⤵
    - Modifies registry key
    PID:1908