agenttesla | d9351ce503256f14f917a5cb7adfcdcf07a9364973fc324dc9517d407c6bdd0a

General

Target

shipment documents.exe
Size

370KB
MD5

4f267c8f0648a52ff6b06816e724949a
SHA1

5f127ece1dcc7fa1d94dd3328bb8e368bd470628
SHA256

d9351ce503256f14f917a5cb7adfcdcf07a9364973fc324dc9517d407c6bdd0a
SHA512

fd528d37848a1fdff3a92aa44441b3445fc1b7f12ad41dc01f4d4c74dd2bb21d5bfa2f03377d9942918cf3f2bf1ca7421beb7e2557a8f5fbc21836cb9a99ece1

Score

10^/10

Credentials

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
3880	schtasks.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 792 wrote to memory of 3880	792	shipment documents.exe	66
PID 792 wrote to memory of 3880	792	shipment documents.exe	66
PID 792 wrote to memory of 3880	792	shipment documents.exe	66
PID 792 wrote to memory of 3852	792	shipment documents.exe	68
PID 792 wrote to memory of 3852	792	shipment documents.exe	68
PID 792 wrote to memory of 3852	792	shipment documents.exe	68
PID 792 wrote to memory of 3852	792	shipment documents.exe	68
PID 792 wrote to memory of 3852	792	shipment documents.exe	68
PID 792 wrote to memory of 3852	792	shipment documents.exe	68
PID 792 wrote to memory of 3852	792	shipment documents.exe	68
PID 792 wrote to memory of 3852	792	shipment documents.exe	68

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 792 set thread context of 3852	792	shipment documents.exe	68

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware

Data from Local System
T1005

Credentials in Files
T1081
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	792	shipment documents.exe
Token: SeDebugPrivilege	3852	shipment documents.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

C:\Users\Admin\AppData\Local\Temp\shipment documents.exe
"C:\Users\Admin\AppData\Local\Temp\shipment documents.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:792
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\tYIAcvUEttPVt" /XML "C:\Users\Admin\AppData\Local\Temp\tmp7922.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:3880
- C:\Users\Admin\AppData\Local\Temp\shipment documents.exe
  "C:\Users\Admin\AppData\Local\Temp\shipment documents.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  PID:3852