agenttesla | 55ea2e51d9c4756b46b1be35647d5be13ebc2951cb2dbd63e7d7ab6dce940e53

General

Target
Purchase Order.exe
Size 518KB
Sample200701-qqfbntvy52
SHA256 55ea2e51d9c4756b46b1be35647d5be13ebc2951cb2dbd63e7d7ab6dce940e53
MD5 03e93411468ca08c78c6fd3c0515c3bc
SHA1 e9fb498213b33669a071f3f02ef9a7e59785fd8c
SHA512 d1e74655f41effe08e6547cb79532869196b48d0a651744b0b673d574078dc927a158ad41cb9eeba3afc78c1e27b391a16f2d3165e4088974d0d6ac4aeb57b2e
MD5 SHA1 SHA512

Score

10^/10

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware

Data from Local System
T1005

Credentials in Files
T1081
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1500 set thread context of 1868	1500	Purchase Order.exe	28

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1500	Purchase Order.exe
Token: SeDebugPrivilege	1868	Purchase Order.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1868	Purchase Order.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
1812	schtasks.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1500 wrote to memory of 1812	1500	Purchase Order.exe	26
PID 1500 wrote to memory of 1812	1500	Purchase Order.exe	26
PID 1500 wrote to memory of 1812	1500	Purchase Order.exe	26
PID 1500 wrote to memory of 1812	1500	Purchase Order.exe	26
PID 1500 wrote to memory of 1868	1500	Purchase Order.exe	28
PID 1500 wrote to memory of 1868	1500	Purchase Order.exe	28
PID 1500 wrote to memory of 1868	1500	Purchase Order.exe	28
PID 1500 wrote to memory of 1868	1500	Purchase Order.exe	28
PID 1500 wrote to memory of 1868	1500	Purchase Order.exe	28
PID 1500 wrote to memory of 1868	1500	Purchase Order.exe	28
PID 1500 wrote to memory of 1868	1500	Purchase Order.exe	28
PID 1500 wrote to memory of 1868	1500	Purchase Order.exe	28
PID 1500 wrote to memory of 1868	1500	Purchase Order.exe	28

Suspicious behavior: EnumeratesProcesses 3 IoCs

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware

Data from Local System
T1005

Credentials in Files
T1081

C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe
"C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
PID:1500
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\wNPCCRxwaKSdRU" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4EF.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1812
- C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe
  "{path}"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious behavior: EnumeratesProcesses
  PID:1868