agenttesla | 0f26ab1bbfe9ae635cc4c9bf3d463e35d001034282b2e2ca332e3ae39810832e

General

Target
USD TT SWIFT _679388 190617_2019-NLCIV000003576_ES146009_30309679.exe
Size 422KB
Sample200712-mlnxe56dsn
SHA256 0f26ab1bbfe9ae635cc4c9bf3d463e35d001034282b2e2ca332e3ae39810832e
MD5 e7a7bb922d5be4368c8797458d72fc59
SHA1 f185cacea108376a9eebf558e1a7adef686e7534
SHA512 a123a1e66be237c10ed1b2194e983693113e90525da496c51926d1bac1157a381a78f2c2ab5d1e9c22726d9bfed806d7bd6db470cb66d1ce5437c4f71c9a6e0b
MD5 SHA1 SHA512

Score

10^/10

Adds Run entry to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\IYLZX5 = "C:\\Users\\Admin\\AppData\\Roaming\\IYLZX5\\IYLZX5.exe"	USD TT SWIFT _679388 190617_2019-NLCIV000003576_ES146009_30309679.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1492 set thread context of 388	1492	USD TT SWIFT _679388 190617_2019-NLCIV000003576_ES146009_30309679.exe	24

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	388	USD TT SWIFT _679388 190617_2019-NLCIV000003576_ES146009_30309679.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
388	USD TT SWIFT _679388 190617_2019-NLCIV000003576_ES146009_30309679.exe

Modifies service 2 TTPs 5 IoCs

persistence

Modify Registry

Modify Existing Service

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\LocalConfig	netsh.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\napagent\LocalConfig\Enroll\HcsGroups	netsh.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Shas	netsh.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Qecs	netsh.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\napagent\LocalConfig\UI	netsh.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware

Data from Local System
T1005

Credentials in Files
T1081
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1492 wrote to memory of 388	1492	USD TT SWIFT _679388 190617_2019-NLCIV000003576_ES146009_30309679.exe	24
PID 1492 wrote to memory of 388	1492	USD TT SWIFT _679388 190617_2019-NLCIV000003576_ES146009_30309679.exe	24
PID 1492 wrote to memory of 388	1492	USD TT SWIFT _679388 190617_2019-NLCIV000003576_ES146009_30309679.exe	24
PID 1492 wrote to memory of 388	1492	USD TT SWIFT _679388 190617_2019-NLCIV000003576_ES146009_30309679.exe	24
PID 1492 wrote to memory of 388	1492	USD TT SWIFT _679388 190617_2019-NLCIV000003576_ES146009_30309679.exe	24
PID 1492 wrote to memory of 388	1492	USD TT SWIFT _679388 190617_2019-NLCIV000003576_ES146009_30309679.exe	24
PID 1492 wrote to memory of 388	1492	USD TT SWIFT _679388 190617_2019-NLCIV000003576_ES146009_30309679.exe	24
PID 1492 wrote to memory of 388	1492	USD TT SWIFT _679388 190617_2019-NLCIV000003576_ES146009_30309679.exe	24
PID 1492 wrote to memory of 388	1492	USD TT SWIFT _679388 190617_2019-NLCIV000003576_ES146009_30309679.exe	24
PID 388 wrote to memory of 1640	388	USD TT SWIFT _679388 190617_2019-NLCIV000003576_ES146009_30309679.exe	28
PID 388 wrote to memory of 1640	388	USD TT SWIFT _679388 190617_2019-NLCIV000003576_ES146009_30309679.exe	28
PID 388 wrote to memory of 1640	388	USD TT SWIFT _679388 190617_2019-NLCIV000003576_ES146009_30309679.exe	28
PID 388 wrote to memory of 1640	388	USD TT SWIFT _679388 190617_2019-NLCIV000003576_ES146009_30309679.exe	28

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
388	USD TT SWIFT _679388 190617_2019-NLCIV000003576_ES146009_30309679.exe
388	USD TT SWIFT _679388 190617_2019-NLCIV000003576_ES146009_30309679.exe