agenttesla | e740917e01b79ee21d8d94164db1ab5e8fc4b82b50cb09d4c1e3bf24a0046cf3

General

Target

PURCHASE ORDER.exe
Size

886KB
MD5

fe2b0b6fc7dd1efa4432dd9fe80526e3
SHA1

9e31d2f57c9fd074ede505f7611531940f38f475
SHA256

e740917e01b79ee21d8d94164db1ab5e8fc4b82b50cb09d4c1e3bf24a0046cf3
SHA512

120371d93576fc92e87294357450c4b628fc53c89d2cfb3b864ca1bb218267bd6ac9e81b7e672a88b04aacd1b53b291b8094aa2490b9c87405b0bee9271ee5c3

Score

10^/10

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 3100 wrote to memory of 3368	3100	PURCHASE ORDER.exe	68
PID 3100 wrote to memory of 3368	3100	PURCHASE ORDER.exe	68
PID 3100 wrote to memory of 3368	3100	PURCHASE ORDER.exe	68
PID 3100 wrote to memory of 3188	3100	PURCHASE ORDER.exe	70
PID 3100 wrote to memory of 3188	3100	PURCHASE ORDER.exe	70
PID 3100 wrote to memory of 3188	3100	PURCHASE ORDER.exe	70
PID 3100 wrote to memory of 3364	3100	PURCHASE ORDER.exe	71
PID 3100 wrote to memory of 3364	3100	PURCHASE ORDER.exe	71
PID 3100 wrote to memory of 3364	3100	PURCHASE ORDER.exe	71
PID 3100 wrote to memory of 3364	3100	PURCHASE ORDER.exe	71
PID 3100 wrote to memory of 3364	3100	PURCHASE ORDER.exe	71
PID 3100 wrote to memory of 3364	3100	PURCHASE ORDER.exe	71
PID 3100 wrote to memory of 3364	3100	PURCHASE ORDER.exe	71
PID 3100 wrote to memory of 3364	3100	PURCHASE ORDER.exe	71

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3100	PURCHASE ORDER.exe
Token: SeDebugPrivilege	3364	PURCHASE ORDER.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3100 set thread context of 3364	3100	PURCHASE ORDER.exe	71

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
3368	schtasks.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware

Data from Local System
T1005

Credentials in Files
T1081

C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDER.exe
"C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDER.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetThreadContext
PID:3100
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\nGhwttSfF" /XML "C:\Users\Admin\AppData\Local\Temp\tmp873C.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:3368
- C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDER.exe
  "{path}"
  2⤵
  PID:3188
- C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDER.exe
  "{path}"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  PID:3364

C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
1⤵
PID:4044