agenttesla | 6a1315d55a66812deddffd96c7f113289b3f21b085f830d8332844b4c9d5e4bc

General

Target
Neworder20091836pdf.exe
Size 335KB
Sample200713-2xzh68th6a
SHA256 6a1315d55a66812deddffd96c7f113289b3f21b085f830d8332844b4c9d5e4bc
MD5 8348644813539dd2c4d0a126fe5fd4d6
SHA1 6796854dbdb4ac32d19f097e82b7694f2462af47
SHA512 a7a46ef7182314249454f5b62ad10478014b1b8e0424b5716a44e8c212039e53e9cdc7475bb0f92d1459058db2d562bf28da6b04002ddbcb43337db7f59a0591
MD5 SHA1 SHA512

Score

10^/10

Credentials

Family

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 2 IoCs

resource	yara_rule
behavioral2/memory/408-2-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla
behavioral2/memory/408-3-0x00000000004471FE-mapping.dmp	family_agenttesla

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 344 set thread context of 408	344	Neworder20091836pdf.exe	76

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
640	schtasks.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	344	Neworder20091836pdf.exe
Token: SeDebugPrivilege	408	Neworder20091836pdf.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
408	Neworder20091836pdf.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 344 wrote to memory of 640	344	Neworder20091836pdf.exe	74
PID 344 wrote to memory of 640	344	Neworder20091836pdf.exe	74
PID 344 wrote to memory of 640	344	Neworder20091836pdf.exe	74
PID 344 wrote to memory of 408	344	Neworder20091836pdf.exe	76
PID 344 wrote to memory of 408	344	Neworder20091836pdf.exe	76
PID 344 wrote to memory of 408	344	Neworder20091836pdf.exe	76
PID 344 wrote to memory of 408	344	Neworder20091836pdf.exe	76
PID 344 wrote to memory of 408	344	Neworder20091836pdf.exe	76
PID 344 wrote to memory of 408	344	Neworder20091836pdf.exe	76
PID 344 wrote to memory of 408	344	Neworder20091836pdf.exe	76
PID 344 wrote to memory of 408	344	Neworder20091836pdf.exe	76

C:\Users\Admin\AppData\Local\Temp\Neworder20091836pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Neworder20091836pdf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:344
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\DdhwUfQ" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1DEE.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:640
- C:\Users\Admin\AppData\Local\Temp\Neworder20091836pdf.exe
  "{path}"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:408

C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
1⤵
PID:3884