agenttesla | dc9ad489e9749a09227c79e5818fb5f3df9eb460bdc4c17e6d1efbe964b8b12f

General

Target

OFERTA DE LICENÃ‡A DE COTAÃ‡ÃƒO - OAED_____.exe
Size

630KB
MD5

1b128e56a7f0c731b94894be1b3862ef
SHA1

2ba2776b681a476038d354635f71c5799306ae2a
SHA256

dc9ad489e9749a09227c79e5818fb5f3df9eb460bdc4c17e6d1efbe964b8b12f
SHA512

00d66e8554d99a776c28b203f536156994855a52914261b4cfd83348be2e2af217c536de6161a931be8b176e21881c090a6fdf728c0a134f53aa6b64ef46ec33

Score

10^/10

spyware keylogger trojan stealer agenttesla

Malware Config

Signatures

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware

Data from Local System
T1005

Credentials in Files
T1081
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

OFERTA DE LICENÃ‡A DE COTAÃ‡ÃƒO - OAED_____.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

336 schtasks.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

OFERTA DE LICENÃ‡A DE COTAÃ‡ÃƒO - OAED_____.exe

pid process

1500 OFERTA DE LICENÃ‡A DE COTAÃ‡ÃƒO - OAED_____.exe
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware

Data from Local System
T1005

Credentials in Files
T1081

pid	process
336	schtasks.exe

pid	process
1500	OFERTA DE LICENÃ‡A DE COTAÃ‡ÃƒO - OAED_____.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

OFERTA DE LICENÃ‡A DE COTAÃ‡ÃƒO - OAED_____.exeOFERTA DE LICENÃ‡A DE COTAÃ‡ÃƒO - OAED_____.exe

description	pid	process
Token: SeDebugPrivilege	1492	OFERTA DE LICENÃ‡A DE COTAÃ‡ÃƒO - OAED_____.exe
Token: SeDebugPrivilege	1500	OFERTA DE LICENÃ‡A DE COTAÃ‡ÃƒO - OAED_____.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

OFERTA DE LICENÃ‡A DE COTAÃ‡ÃƒO - OAED_____.exeOFERTA DE LICENÃ‡A DE COTAÃ‡ÃƒO - OAED_____.exe

pid	process
1492	OFERTA DE LICENÃ‡A DE COTAÃ‡ÃƒO - OAED_____.exe
1492	OFERTA DE LICENÃ‡A DE COTAÃ‡ÃƒO - OAED_____.exe
1492	OFERTA DE LICENÃ‡A DE COTAÃ‡ÃƒO - OAED_____.exe
1500	OFERTA DE LICENÃ‡A DE COTAÃ‡ÃƒO - OAED_____.exe
1500	OFERTA DE LICENÃ‡A DE COTAÃ‡ÃƒO - OAED_____.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

OFERTA DE LICENÃ‡A DE COTAÃ‡ÃƒO - OAED_____.exe

description	pid	process	target process
PID 1492 set thread context of 1500	1492	OFERTA DE LICENÃ‡A DE COTAÃ‡ÃƒO - OAED_____.exe	OFERTA DE LICENÃ‡A DE COTAÃ‡ÃƒO - OAED_____.exe

C:\Users\Admin\AppData\Local\Temp\OFERTA DE LICENÃ‡A DE COTAÃ‡ÃƒO - OAED_____.exe
"C:\Users\Admin\AppData\Local\Temp\OFERTA DE LICENÃ‡A DE COTAÃ‡ÃƒO - OAED_____.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetThreadContext
PID:1492

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\WmampRVV" /XML "C:\Users\Admin\AppData\Local\Temp\tmp867D.tmp"
2⤵
- Creates scheduled task(s)
PID:336

C:\Users\Admin\AppData\Local\Temp\OFERTA DE LICENÃ‡A DE COTAÃ‡ÃƒO - OAED_____.exe
"{path}"
2⤵
PID:928

C:\Users\Admin\AppData\Local\Temp\OFERTA DE LICENÃ‡A DE COTAÃ‡ÃƒO - OAED_____.exe
"{path}"
2⤵
PID:1516

C:\Users\Admin\AppData\Local\Temp\OFERTA DE LICENÃ‡A DE COTAÃ‡ÃƒO - OAED_____.exe
"{path}"
2⤵
PID:1512

C:\Users\Admin\AppData\Local\Temp\OFERTA DE LICENÃ‡A DE COTAÃ‡ÃƒO - OAED_____.exe
"{path}"
2⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:1500

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

Lateral Movement

Collection

Data from Local System

3

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp867D.tmp

Download Submit
memory/336-0-0x0000000000000000-mapping.dmp

Download
memory/1500-3-0x0000000000446D3E-mapping.dmp

Download
memory/1500-2-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1500-4-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1500-5-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download

description	pid	process	target process
PID 1492 wrote to memory of 336	1492	OFERTA DE LICENÃ‡A DE COTAÃ‡ÃƒO - OAED_____.exe	schtasks.exe
PID 1492 wrote to memory of 336	1492	OFERTA DE LICENÃ‡A DE COTAÃ‡ÃƒO - OAED_____.exe	schtasks.exe
PID 1492 wrote to memory of 336	1492	OFERTA DE LICENÃ‡A DE COTAÃ‡ÃƒO - OAED_____.exe	schtasks.exe
PID 1492 wrote to memory of 336	1492	OFERTA DE LICENÃ‡A DE COTAÃ‡ÃƒO - OAED_____.exe	schtasks.exe
PID 1492 wrote to memory of 928	1492	OFERTA DE LICENÃ‡A DE COTAÃ‡ÃƒO - OAED_____.exe	OFERTA DE LICENÃ‡A DE COTAÃ‡ÃƒO - OAED_____.exe
PID 1492 wrote to memory of 928	1492	OFERTA DE LICENÃ‡A DE COTAÃ‡ÃƒO - OAED_____.exe	OFERTA DE LICENÃ‡A DE COTAÃ‡ÃƒO - OAED_____.exe
PID 1492 wrote to memory of 928	1492	OFERTA DE LICENÃ‡A DE COTAÃ‡ÃƒO - OAED_____.exe	OFERTA DE LICENÃ‡A DE COTAÃ‡ÃƒO - OAED_____.exe
PID 1492 wrote to memory of 928	1492	OFERTA DE LICENÃ‡A DE COTAÃ‡ÃƒO - OAED_____.exe	OFERTA DE LICENÃ‡A DE COTAÃ‡ÃƒO - OAED_____.exe
PID 1492 wrote to memory of 1516	1492	OFERTA DE LICENÃ‡A DE COTAÃ‡ÃƒO - OAED_____.exe	OFERTA DE LICENÃ‡A DE COTAÃ‡ÃƒO - OAED_____.exe
PID 1492 wrote to memory of 1516	1492	OFERTA DE LICENÃ‡A DE COTAÃ‡ÃƒO - OAED_____.exe	OFERTA DE LICENÃ‡A DE COTAÃ‡ÃƒO - OAED_____.exe
PID 1492 wrote to memory of 1516	1492	OFERTA DE LICENÃ‡A DE COTAÃ‡ÃƒO - OAED_____.exe	OFERTA DE LICENÃ‡A DE COTAÃ‡ÃƒO - OAED_____.exe
PID 1492 wrote to memory of 1516	1492	OFERTA DE LICENÃ‡A DE COTAÃ‡ÃƒO - OAED_____.exe	OFERTA DE LICENÃ‡A DE COTAÃ‡ÃƒO - OAED_____.exe
PID 1492 wrote to memory of 1512	1492	OFERTA DE LICENÃ‡A DE COTAÃ‡ÃƒO - OAED_____.exe	OFERTA DE LICENÃ‡A DE COTAÃ‡ÃƒO - OAED_____.exe
PID 1492 wrote to memory of 1512	1492	OFERTA DE LICENÃ‡A DE COTAÃ‡ÃƒO - OAED_____.exe	OFERTA DE LICENÃ‡A DE COTAÃ‡ÃƒO - OAED_____.exe
PID 1492 wrote to memory of 1512	1492	OFERTA DE LICENÃ‡A DE COTAÃ‡ÃƒO - OAED_____.exe	OFERTA DE LICENÃ‡A DE COTAÃ‡ÃƒO - OAED_____.exe
PID 1492 wrote to memory of 1512	1492	OFERTA DE LICENÃ‡A DE COTAÃ‡ÃƒO - OAED_____.exe	OFERTA DE LICENÃ‡A DE COTAÃ‡ÃƒO - OAED_____.exe
PID 1492 wrote to memory of 1500	1492	OFERTA DE LICENÃ‡A DE COTAÃ‡ÃƒO - OAED_____.exe	OFERTA DE LICENÃ‡A DE COTAÃ‡ÃƒO - OAED_____.exe
PID 1492 wrote to memory of 1500	1492	OFERTA DE LICENÃ‡A DE COTAÃ‡ÃƒO - OAED_____.exe	OFERTA DE LICENÃ‡A DE COTAÃ‡ÃƒO - OAED_____.exe
PID 1492 wrote to memory of 1500	1492	OFERTA DE LICENÃ‡A DE COTAÃ‡ÃƒO - OAED_____.exe	OFERTA DE LICENÃ‡A DE COTAÃ‡ÃƒO - OAED_____.exe
PID 1492 wrote to memory of 1500	1492	OFERTA DE LICENÃ‡A DE COTAÃ‡ÃƒO - OAED_____.exe	OFERTA DE LICENÃ‡A DE COTAÃ‡ÃƒO - OAED_____.exe
PID 1492 wrote to memory of 1500	1492	OFERTA DE LICENÃ‡A DE COTAÃ‡ÃƒO - OAED_____.exe	OFERTA DE LICENÃ‡A DE COTAÃ‡ÃƒO - OAED_____.exe
PID 1492 wrote to memory of 1500	1492	OFERTA DE LICENÃ‡A DE COTAÃ‡ÃƒO - OAED_____.exe	OFERTA DE LICENÃ‡A DE COTAÃ‡ÃƒO - OAED_____.exe
PID 1492 wrote to memory of 1500	1492	OFERTA DE LICENÃ‡A DE COTAÃ‡ÃƒO - OAED_____.exe	OFERTA DE LICENÃ‡A DE COTAÃ‡ÃƒO - OAED_____.exe
PID 1492 wrote to memory of 1500	1492	OFERTA DE LICENÃ‡A DE COTAÃ‡ÃƒO - OAED_____.exe	OFERTA DE LICENÃ‡A DE COTAÃ‡ÃƒO - OAED_____.exe
PID 1492 wrote to memory of 1500	1492	OFERTA DE LICENÃ‡A DE COTAÃ‡ÃƒO - OAED_____.exe	OFERTA DE LICENÃ‡A DE COTAÃ‡ÃƒO - OAED_____.exe

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads