agenttesla | dc9ad489e9749a09227c79e5818fb5f3df9eb460bdc4c17e6d1efbe964b8b12f

General

Target
OFERTA DE LICENÃ‡A DE COTAÃ‡ÃƒO - OAED_____.exe
Size 630KB
Sample200710-dvm4gxnkl6
SHA256 dc9ad489e9749a09227c79e5818fb5f3df9eb460bdc4c17e6d1efbe964b8b12f
MD5 1b128e56a7f0c731b94894be1b3862ef
SHA1 2ba2776b681a476038d354635f71c5799306ae2a
SHA512 00d66e8554d99a776c28b203f536156994855a52914261b4cfd83348be2e2af217c536de6161a931be8b176e21881c090a6fdf728c0a134f53aa6b64ef46ec33
MD5 SHA1 SHA512

Score

10^/10

Credentials

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3768	OFERTA DE LICENÃ‡A DE COTAÃ‡ÃƒO - OAED_____.exe
3768	OFERTA DE LICENÃ‡A DE COTAÃ‡ÃƒO - OAED_____.exe
2684	OFERTA DE LICENÃ‡A DE COTAÃ‡ÃƒO - OAED_____.exe
2684	OFERTA DE LICENÃ‡A DE COTAÃ‡ÃƒO - OAED_____.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3768 set thread context of 2684	3768	OFERTA DE LICENÃ‡A DE COTAÃ‡ÃƒO - OAED_____.exe	75

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 3768 wrote to memory of 2220	3768	OFERTA DE LICENÃ‡A DE COTAÃ‡ÃƒO - OAED_____.exe	72
PID 3768 wrote to memory of 2220	3768	OFERTA DE LICENÃ‡A DE COTAÃ‡ÃƒO - OAED_____.exe	72
PID 3768 wrote to memory of 2220	3768	OFERTA DE LICENÃ‡A DE COTAÃ‡ÃƒO - OAED_____.exe	72
PID 3768 wrote to memory of 2592	3768	OFERTA DE LICENÃ‡A DE COTAÃ‡ÃƒO - OAED_____.exe	74
PID 3768 wrote to memory of 2592	3768	OFERTA DE LICENÃ‡A DE COTAÃ‡ÃƒO - OAED_____.exe	74
PID 3768 wrote to memory of 2592	3768	OFERTA DE LICENÃ‡A DE COTAÃ‡ÃƒO - OAED_____.exe	74
PID 3768 wrote to memory of 2684	3768	OFERTA DE LICENÃ‡A DE COTAÃ‡ÃƒO - OAED_____.exe	75
PID 3768 wrote to memory of 2684	3768	OFERTA DE LICENÃ‡A DE COTAÃ‡ÃƒO - OAED_____.exe	75
PID 3768 wrote to memory of 2684	3768	OFERTA DE LICENÃ‡A DE COTAÃ‡ÃƒO - OAED_____.exe	75
PID 3768 wrote to memory of 2684	3768	OFERTA DE LICENÃ‡A DE COTAÃ‡ÃƒO - OAED_____.exe	75
PID 3768 wrote to memory of 2684	3768	OFERTA DE LICENÃ‡A DE COTAÃ‡ÃƒO - OAED_____.exe	75
PID 3768 wrote to memory of 2684	3768	OFERTA DE LICENÃ‡A DE COTAÃ‡ÃƒO - OAED_____.exe	75
PID 3768 wrote to memory of 2684	3768	OFERTA DE LICENÃ‡A DE COTAÃ‡ÃƒO - OAED_____.exe	75
PID 3768 wrote to memory of 2684	3768	OFERTA DE LICENÃ‡A DE COTAÃ‡ÃƒO - OAED_____.exe	75

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3768	OFERTA DE LICENÃ‡A DE COTAÃ‡ÃƒO - OAED_____.exe
Token: SeDebugPrivilege	2684	OFERTA DE LICENÃ‡A DE COTAÃ‡ÃƒO - OAED_____.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2684	OFERTA DE LICENÃ‡A DE COTAÃ‡ÃƒO - OAED_____.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
2220	schtasks.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware

Data from Local System
T1005

Credentials in Files
T1081

C:\Users\Admin\AppData\Local\Temp\OFERTA DE LICENÃ‡A DE COTAÃ‡ÃƒO - OAED_____.exe
"C:\Users\Admin\AppData\Local\Temp\OFERTA DE LICENÃ‡A DE COTAÃ‡ÃƒO - OAED_____.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
PID:3768
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\WmampRVV" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1459.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:2220
- C:\Users\Admin\AppData\Local\Temp\OFERTA DE LICENÃ‡A DE COTAÃ‡ÃƒO - OAED_____.exe
  "{path}"
  2⤵
  PID:2592
- C:\Users\Admin\AppData\Local\Temp\OFERTA DE LICENÃ‡A DE COTAÃ‡ÃƒO - OAED_____.exe
  "{path}"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2684