agenttesla | 2211631d24ad36c7dd32602c54da52d1fc5030ff67dc1101b9d14d29e8951e19

General

Target
Gabo-PI-07-07-2020______________________________________uue.zip.exe
Size 832KB
Sample200707-2fha3c9rn2
SHA256 2211631d24ad36c7dd32602c54da52d1fc5030ff67dc1101b9d14d29e8951e19
MD5 a644fe59bdc768266d2bcc7096db3c53
SHA1 0c3f63ae71ab7d2b7a9d4299ce2d49af0091ce77
SHA512 0cf0ff1c1e50e32d1fb9554b4aea4be1e3c007752b64965d027388c0c4999ea43d7b497f99b7c070fd74a1fc2b4b4bc0b582627a7735d4d5910c818b2547e55f
MD5 SHA1 SHA512

Score

10^/10

Credentials

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2248	Gabo-PI-07-07-2020______________________________________uue.zip.exe
2248	Gabo-PI-07-07-2020______________________________________uue.zip.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2248	Gabo-PI-07-07-2020______________________________________uue.zip.exe

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1516 wrote to memory of 2064	1516	Gabo-PI-07-07-2020______________________________________uue.zip.exe	72
PID 1516 wrote to memory of 2064	1516	Gabo-PI-07-07-2020______________________________________uue.zip.exe	72
PID 1516 wrote to memory of 2064	1516	Gabo-PI-07-07-2020______________________________________uue.zip.exe	72
PID 1516 wrote to memory of 2248	1516	Gabo-PI-07-07-2020______________________________________uue.zip.exe	74
PID 1516 wrote to memory of 2248	1516	Gabo-PI-07-07-2020______________________________________uue.zip.exe	74
PID 1516 wrote to memory of 2248	1516	Gabo-PI-07-07-2020______________________________________uue.zip.exe	74
PID 1516 wrote to memory of 2248	1516	Gabo-PI-07-07-2020______________________________________uue.zip.exe	74
PID 1516 wrote to memory of 2248	1516	Gabo-PI-07-07-2020______________________________________uue.zip.exe	74
PID 1516 wrote to memory of 2248	1516	Gabo-PI-07-07-2020______________________________________uue.zip.exe	74
PID 1516 wrote to memory of 2248	1516	Gabo-PI-07-07-2020______________________________________uue.zip.exe	74
PID 1516 wrote to memory of 2248	1516	Gabo-PI-07-07-2020______________________________________uue.zip.exe	74

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2248	Gabo-PI-07-07-2020______________________________________uue.zip.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
2064	schtasks.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1516 set thread context of 2248	1516	Gabo-PI-07-07-2020______________________________________uue.zip.exe	74

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware

Data from Local System
T1005

Credentials in Files
T1081

C:\Users\Admin\AppData\Local\Temp\Gabo-PI-07-07-2020______________________________________uue.zip.exe
"C:\Users\Admin\AppData\Local\Temp\Gabo-PI-07-07-2020______________________________________uue.zip.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:1516
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vfrLRyOSyt" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4675.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:2064
- C:\Users\Admin\AppData\Local\Temp\Gabo-PI-07-07-2020______________________________________uue.zip.exe
  "{path}"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of AdjustPrivilegeToken
  PID:2248