agenttesla | ccb65f79de018225e7ca824cc70f81726e771019e53785d7a2a3772548fcfa23

General

Target
Purchase Order 4589012.exe
Size 593KB
Sample200716-r75fsddlnn
SHA256 ccb65f79de018225e7ca824cc70f81726e771019e53785d7a2a3772548fcfa23
MD5 c14996b07681c32bfffc365b67b85be5
SHA1 3eef1730c800fb66ddcfdf03dff1a430886694d1
SHA512 2a1dce34ab3163da645dc94e5695805b5d3485c0095504625c5b56a51c135eae2a2a326aa978c77fa46521ab6f6b41bac2332c52883745b0eb07821aa6b0b6b7
MD5 SHA1 SHA512

Score

10^/10

Credentials

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1612 wrote to memory of 3612	1612	Purchase Order 4589012.exe	72
PID 1612 wrote to memory of 3612	1612	Purchase Order 4589012.exe	72
PID 1612 wrote to memory of 3612	1612	Purchase Order 4589012.exe	72
PID 1612 wrote to memory of 3044	1612	Purchase Order 4589012.exe	74
PID 1612 wrote to memory of 3044	1612	Purchase Order 4589012.exe	74
PID 1612 wrote to memory of 3044	1612	Purchase Order 4589012.exe	74
PID 1612 wrote to memory of 3044	1612	Purchase Order 4589012.exe	74
PID 1612 wrote to memory of 3044	1612	Purchase Order 4589012.exe	74
PID 1612 wrote to memory of 3044	1612	Purchase Order 4589012.exe	74
PID 1612 wrote to memory of 3044	1612	Purchase Order 4589012.exe	74
PID 1612 wrote to memory of 3044	1612	Purchase Order 4589012.exe	74

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1612 set thread context of 3044	1612	Purchase Order 4589012.exe	74

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3044	Purchase Order 4589012.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3044	Purchase Order 4589012.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
3612	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3044	Purchase Order 4589012.exe
3044	Purchase Order 4589012.exe

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware

Data from Local System
T1005

Credentials in Files
T1081

C:\Users\Admin\AppData\Local\Temp\Purchase Order 4589012.exe
"C:\Users\Admin\AppData\Local\Temp\Purchase Order 4589012.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:1612
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\fbyfck" /XML "C:\Users\Admin\AppData\Local\Temp\tmpBA5D.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:3612
- C:\Users\Admin\AppData\Local\Temp\Purchase Order 4589012.exe
  "{path}"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious behavior: EnumeratesProcesses
  PID:3044