agenttesla | 0698cbff335f16544c0a97a71df4f0e52ee4dbddf3cadad2ee0ac52103ea8ed2

General

Target
Confirm Bank Details.exe
Size 962KB
Sample200720-7pn56c17ws
SHA256 0698cbff335f16544c0a97a71df4f0e52ee4dbddf3cadad2ee0ac52103ea8ed2
MD5 d5ad62869bb6e2d5b2e54c9d6f57e938
SHA1 cf7f1f99dd74d8bf27e6ba0b0b8c01712ee04d51
SHA512 e16cabf0d0052690ffd554fb4a9e0f044393be4ecf87fbb5a9f221b707c657776fac6b52e03bb8f372b9bd702832a4fcf185f24cbbe0cc78347e768e44520d33
MD5 SHA1 SHA512

Score

10^/10

Family

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 4 IoCs

resource	yara_rule
behavioral1/memory/1108-4-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla
behavioral1/memory/1108-5-0x000000000044712E-mapping.dmp	family_agenttesla
behavioral1/memory/1108-6-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla
behavioral1/memory/1108-7-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	RegSvcs.exe

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\CpSnJ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\CpSnJ\\CpSnJ.exe"	RegSvcs.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1448 set thread context of 1108	1448	Confirm Bank Details.exe	26

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
1044	schtasks.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

pid	Process
1988	REG.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1108	RegSvcs.exe
1108	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1108	RegSvcs.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1448 wrote to memory of 1044	1448	Confirm Bank Details.exe	24
PID 1448 wrote to memory of 1044	1448	Confirm Bank Details.exe	24
PID 1448 wrote to memory of 1044	1448	Confirm Bank Details.exe	24
PID 1448 wrote to memory of 1044	1448	Confirm Bank Details.exe	24
PID 1448 wrote to memory of 1108	1448	Confirm Bank Details.exe	26
PID 1448 wrote to memory of 1108	1448	Confirm Bank Details.exe	26
PID 1448 wrote to memory of 1108	1448	Confirm Bank Details.exe	26
PID 1448 wrote to memory of 1108	1448	Confirm Bank Details.exe	26
PID 1448 wrote to memory of 1108	1448	Confirm Bank Details.exe	26
PID 1448 wrote to memory of 1108	1448	Confirm Bank Details.exe	26
PID 1448 wrote to memory of 1108	1448	Confirm Bank Details.exe	26
PID 1448 wrote to memory of 1108	1448	Confirm Bank Details.exe	26
PID 1448 wrote to memory of 1108	1448	Confirm Bank Details.exe	26
PID 1448 wrote to memory of 1108	1448	Confirm Bank Details.exe	26
PID 1448 wrote to memory of 1108	1448	Confirm Bank Details.exe	26
PID 1448 wrote to memory of 1108	1448	Confirm Bank Details.exe	26
PID 1108 wrote to memory of 1988	1108	RegSvcs.exe	30
PID 1108 wrote to memory of 1988	1108	RegSvcs.exe	30
PID 1108 wrote to memory of 1988	1108	RegSvcs.exe	30
PID 1108 wrote to memory of 1988	1108	RegSvcs.exe	30

C:\Users\Admin\AppData\Local\Temp\Confirm Bank Details.exe
"C:\Users\Admin\AppData\Local\Temp\Confirm Bank Details.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1448
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\inqSxJ" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC87C.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1044
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "{path}"
  2⤵
  - Drops file in Drivers directory
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1108
- - C:\Windows\SysWOW64\REG.exe
    REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System / v DisableTaskMgr / t REG_DWORD / d 1 / f
    3⤵
    - Modifies registry key
    PID:1988