agenttesla | 55ea2e51d9c4756b46b1be35647d5be13ebc2951cb2dbd63e7d7ab6dce940e53

General

Target
Purchase Order.exe
Size 518KB
Sample200701-qqfbntvy52
SHA256 55ea2e51d9c4756b46b1be35647d5be13ebc2951cb2dbd63e7d7ab6dce940e53
MD5 03e93411468ca08c78c6fd3c0515c3bc
SHA1 e9fb498213b33669a071f3f02ef9a7e59785fd8c
SHA512 d1e74655f41effe08e6547cb79532869196b48d0a651744b0b673d574078dc927a158ad41cb9eeba3afc78c1e27b391a16f2d3165e4088974d0d6ac4aeb57b2e
MD5 SHA1 SHA512

Score

10^/10

Credentials

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
3660	schtasks.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 3024 wrote to memory of 3660	3024	Purchase Order.exe	67
PID 3024 wrote to memory of 3660	3024	Purchase Order.exe	67
PID 3024 wrote to memory of 3660	3024	Purchase Order.exe	67
PID 3024 wrote to memory of 3872	3024	Purchase Order.exe	69
PID 3024 wrote to memory of 3872	3024	Purchase Order.exe	69
PID 3024 wrote to memory of 3872	3024	Purchase Order.exe	69
PID 3024 wrote to memory of 3776	3024	Purchase Order.exe	70
PID 3024 wrote to memory of 3776	3024	Purchase Order.exe	70
PID 3024 wrote to memory of 3776	3024	Purchase Order.exe	70
PID 3024 wrote to memory of 3776	3024	Purchase Order.exe	70
PID 3024 wrote to memory of 3776	3024	Purchase Order.exe	70
PID 3024 wrote to memory of 3776	3024	Purchase Order.exe	70
PID 3024 wrote to memory of 3776	3024	Purchase Order.exe	70
PID 3024 wrote to memory of 3776	3024	Purchase Order.exe	70

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3024	Purchase Order.exe
Token: SeDebugPrivilege	3776	Purchase Order.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3024 set thread context of 3776	3024	Purchase Order.exe	70

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3776	Purchase Order.exe

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe
"C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetThreadContext
PID:3024
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\wNPCCRxwaKSdRU" /XML "C:\Users\Admin\AppData\Local\Temp\tmp770F.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:3660
- C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe
  "{path}"
  2⤵
  PID:3872
- C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe
  "{path}"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:3776