agenttesla | 3f0bb6576f8d4ca423a9e4fab5901c9e590e07106171045b6c8b548cb01b1017

General

Target
AWB CUSTOM TAX.exe
Size 560KB
Sample200716-v6pfndra5s
SHA256 3f0bb6576f8d4ca423a9e4fab5901c9e590e07106171045b6c8b548cb01b1017
MD5 d3a6d966b8569599c24bddf95feb519f
SHA1 6696fe5fdde968e93f61fe51f850ab699ee05270
SHA512 403911a9c4c105b17b03471a3e4cf9576bb049f7c8b251230895728ec86bdd5b90e5373a021d08687f3e50a455a70e4a618409c466ef45c6043488ee7e753ae0
MD5 SHA1 SHA512

Score

10^/10

Credentials

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3532	AWB CUSTOM TAX.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware

Data from Local System
T1005

Credentials in Files
T1081
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 2800	2416	AWB CUSTOM TAX.exe	68
PID 2416 wrote to memory of 2800	2416	AWB CUSTOM TAX.exe	68
PID 2416 wrote to memory of 2800	2416	AWB CUSTOM TAX.exe	68
PID 2416 wrote to memory of 3532	2416	AWB CUSTOM TAX.exe	70
PID 2416 wrote to memory of 3532	2416	AWB CUSTOM TAX.exe	70
PID 2416 wrote to memory of 3532	2416	AWB CUSTOM TAX.exe	70
PID 2416 wrote to memory of 3532	2416	AWB CUSTOM TAX.exe	70
PID 2416 wrote to memory of 3532	2416	AWB CUSTOM TAX.exe	70
PID 2416 wrote to memory of 3532	2416	AWB CUSTOM TAX.exe	70
PID 2416 wrote to memory of 3532	2416	AWB CUSTOM TAX.exe	70
PID 2416 wrote to memory of 3532	2416	AWB CUSTOM TAX.exe	70

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2416 set thread context of 3532	2416	AWB CUSTOM TAX.exe	70

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3532	AWB CUSTOM TAX.exe
3532	AWB CUSTOM TAX.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
2800	schtasks.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

C:\Users\Admin\AppData\Local\Temp\AWB CUSTOM TAX.exe
"C:\Users\Admin\AppData\Local\Temp\AWB CUSTOM TAX.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:2416
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\IEossxWkvBpo" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD7A9.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:2800
- C:\Users\Admin\AppData\Local\Temp\AWB CUSTOM TAX.exe
  "{path}"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  PID:3532