agenttesla | 8184f5c076e0843551942cca6c5f1dbc72ddb32d1fe9d4b415eccca59651060d

General

Target
REV- PI 1696195.exe
Size 392KB
Sample200712-nezmpqszv2
SHA256 8184f5c076e0843551942cca6c5f1dbc72ddb32d1fe9d4b415eccca59651060d
MD5 3c0946462f437b2d9b899bc140bfaff1
SHA1 f89981b931c60a201deae175b6515491e5301716
SHA512 8e8a464017fa68594ad473b7117d3ed128d4ea08bfcdab5b394d7dbd220481b0d67cbbc7fb692796c6653a5780917ce0e0b3da57bb3e0c7d752ac8d0c31cfe4d
MD5 SHA1 SHA512

Score

10^/10

Credentials

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2948 set thread context of 1852	2948	REV- PI 1696195.exe	70

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1852	REV- PI 1696195.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware

Data from Local System
T1005

Credentials in Files
T1081
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
3512	schtasks.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2948 wrote to memory of 3512	2948	REV- PI 1696195.exe	68
PID 2948 wrote to memory of 3512	2948	REV- PI 1696195.exe	68
PID 2948 wrote to memory of 3512	2948	REV- PI 1696195.exe	68
PID 2948 wrote to memory of 1852	2948	REV- PI 1696195.exe	70
PID 2948 wrote to memory of 1852	2948	REV- PI 1696195.exe	70
PID 2948 wrote to memory of 1852	2948	REV- PI 1696195.exe	70
PID 2948 wrote to memory of 1852	2948	REV- PI 1696195.exe	70
PID 2948 wrote to memory of 1852	2948	REV- PI 1696195.exe	70
PID 2948 wrote to memory of 1852	2948	REV- PI 1696195.exe	70
PID 2948 wrote to memory of 1852	2948	REV- PI 1696195.exe	70
PID 2948 wrote to memory of 1852	2948	REV- PI 1696195.exe	70

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1852	REV- PI 1696195.exe
1852	REV- PI 1696195.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

C:\Users\Admin\AppData\Local\Temp\REV- PI 1696195.exe
"C:\Users\Admin\AppData\Local\Temp\REV- PI 1696195.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2948
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\cyvKiQyyTFW" /XML "C:\Users\Admin\AppData\Local\Temp\tmp91CB.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:3512
- C:\Users\Admin\AppData\Local\Temp\REV- PI 1696195.exe
  "{path}"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  PID:1852

C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
1⤵
PID:3224