agenttesla | b36bb088a516fe573f9d70983747a1753eccb0236bacd5f00d7cfe0cea99618c

General

Target
Profoma.exe
Size 557KB
Sample200709-ejjd1t2xfn
SHA256 b36bb088a516fe573f9d70983747a1753eccb0236bacd5f00d7cfe0cea99618c
MD5 2dda182af8da0a3176e878200c2ecf00
SHA1 b48551b7ca6bba518a043f75940375cd4f3f927c
SHA512 f30082c98f6392c565e1f559b4b592ab35d8e0bff3adb84912618cf84ee42c93ebcd54348d8ad9b66d884d7506472eac8d919fd618b8f57d70577d6bc30a03cc
MD5 SHA1 SHA512

Score

10^/10

Family

Credentials

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 4 IoCs

resource	yara_rule
behavioral1/memory/1872-4-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla
behavioral1/memory/1872-5-0x000000000044707E-mapping.dmp	family_agenttesla
behavioral1/memory/1872-6-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla
behavioral1/memory/1872-7-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1500 set thread context of 1872	1500	Profoma.exe	28

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
1832	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1872	Profoma.exe
1872	Profoma.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1872	Profoma.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1872	Profoma.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1500 wrote to memory of 1832	1500	Profoma.exe	26
PID 1500 wrote to memory of 1832	1500	Profoma.exe	26
PID 1500 wrote to memory of 1832	1500	Profoma.exe	26
PID 1500 wrote to memory of 1832	1500	Profoma.exe	26
PID 1500 wrote to memory of 1872	1500	Profoma.exe	28
PID 1500 wrote to memory of 1872	1500	Profoma.exe	28
PID 1500 wrote to memory of 1872	1500	Profoma.exe	28
PID 1500 wrote to memory of 1872	1500	Profoma.exe	28
PID 1500 wrote to memory of 1872	1500	Profoma.exe	28
PID 1500 wrote to memory of 1872	1500	Profoma.exe	28
PID 1500 wrote to memory of 1872	1500	Profoma.exe	28
PID 1500 wrote to memory of 1872	1500	Profoma.exe	28
PID 1500 wrote to memory of 1872	1500	Profoma.exe	28

C:\Users\Admin\AppData\Local\Temp\Profoma.exe
"C:\Users\Admin\AppData\Local\Temp\Profoma.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1500
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\peXcpOUqTbe" /XML "C:\Users\Admin\AppData\Local\Temp\tmpFB5E.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1832
- C:\Users\Admin\AppData\Local\Temp\Profoma.exe
  "{path}"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1872