agenttesla | 112fe86589f5587620a62be8ebeab2ee9898f770762f7be2b92a229c46d52917

General

Target
Payment doc747322.exe
Size 491KB
Sample200713-kfehbtr842
SHA256 112fe86589f5587620a62be8ebeab2ee9898f770762f7be2b92a229c46d52917
MD5 88087279864b6d4db153f6dd9c68f065
SHA1 7e8a69d8aecc43d9449af37efb5fcdaee1cf4166
SHA512 7c9003242e32bbca7890e0393c370686e3a4011e98e6b3c77859d73d6b97ab89752c1da3c2909bee3ee72333117721f63ecdb856317ebde71cb8ed854c786dfd
MD5 SHA1 SHA512

Score

10^/10

Credentials

Family

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 17 IoCs

resource	yara_rule
behavioral2/memory/3896-1-0x000000000046861E-mapping.dmp	family_agenttesla
behavioral2/memory/3896-0-0x0000000000400000-0x000000000046E000-memory.dmp	family_agenttesla
behavioral2/memory/3896-6-0x000000000046861E-mapping.dmp	family_agenttesla
behavioral2/memory/3896-5-0x000000000046861E-mapping.dmp	family_agenttesla
behavioral2/memory/3896-7-0x000000000046861E-mapping.dmp	family_agenttesla
behavioral2/memory/3896-8-0x000000000046861E-mapping.dmp	family_agenttesla
behavioral2/memory/3896-9-0x000000000046861E-mapping.dmp	family_agenttesla
behavioral2/memory/3896-10-0x000000000046861E-mapping.dmp	family_agenttesla
behavioral2/memory/3896-11-0x000000000046861E-mapping.dmp	family_agenttesla
behavioral2/memory/3896-12-0x000000000046861E-mapping.dmp	family_agenttesla
behavioral2/memory/3896-13-0x000000000046861E-mapping.dmp	family_agenttesla
behavioral2/memory/3896-14-0x000000000046861E-mapping.dmp	family_agenttesla
behavioral2/memory/3896-15-0x000000000046861E-mapping.dmp	family_agenttesla
behavioral2/memory/3896-16-0x000000000046861E-mapping.dmp	family_agenttesla
behavioral2/memory/3896-17-0x000000000046861E-mapping.dmp	family_agenttesla
behavioral2/memory/3896-18-0x000000000046861E-mapping.dmp	family_agenttesla
behavioral2/memory/3896-19-0x000000000046861E-mapping.dmp	family_agenttesla

Looks for VirtualBox Guest Additions in registry 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497
Looks for VMWare Tools registry key 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Payment doc747322.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Payment doc747322.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	Payment doc747322.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0	Payment doc747322.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 792 set thread context of 3896	792	Payment doc747322.exe	69

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3896	Payment doc747322.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 792 wrote to memory of 3868	792	Payment doc747322.exe	68
PID 792 wrote to memory of 3868	792	Payment doc747322.exe	68
PID 792 wrote to memory of 3868	792	Payment doc747322.exe	68
PID 792 wrote to memory of 3896	792	Payment doc747322.exe	69
PID 792 wrote to memory of 3896	792	Payment doc747322.exe	69
PID 792 wrote to memory of 3896	792	Payment doc747322.exe	69
PID 792 wrote to memory of 3896	792	Payment doc747322.exe	69
PID 792 wrote to memory of 3896	792	Payment doc747322.exe	69
PID 792 wrote to memory of 3896	792	Payment doc747322.exe	69
PID 792 wrote to memory of 3896	792	Payment doc747322.exe	69
PID 792 wrote to memory of 3896	792	Payment doc747322.exe	69
PID 3896 wrote to memory of 1172	3896	Payment doc747322.exe	76
PID 3896 wrote to memory of 1172	3896	Payment doc747322.exe	76
PID 3896 wrote to memory of 1172	3896	Payment doc747322.exe	76

C:\Users\Admin\AppData\Local\Temp\Payment doc747322.exe
"C:\Users\Admin\AppData\Local\Temp\Payment doc747322.exe"
1⤵
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:792
- C:\Users\Admin\AppData\Local\Temp\Payment doc747322.exe
  "{path}"
  2⤵
  PID:3868
- C:\Users\Admin\AppData\Local\Temp\Payment doc747322.exe
  "{path}"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: RenamesItself
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3896
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
    dw20.exe -x -s 1876
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1172

C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
1⤵
PID:2296