agenttesla | 55d2fe466aeeb92b6f8b45ac8a3961da32e03211f9d006347d946d072cba3848

General

Target
IMG2007.exe
Size 806KB
Sample200720-jymaxmrrkn
SHA256 55d2fe466aeeb92b6f8b45ac8a3961da32e03211f9d006347d946d072cba3848
MD5 8328f50a0624bcbfb73c4f5e312cb8e1
SHA1 1f903f1f96004fa83de577fd46a6134bc0b0414a
SHA512 ab7a7426c5fdfa98b5bbb0c774fb261a7ec668f9ab51fdd2616267b60df1ccbb36f01a08e249b4afeed519fb0101f55a54688b962b22b4f2ed7a016d05cf96f8
MD5 SHA1 SHA512

Score

10^/10

Family

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 4 IoCs

resource	yara_rule
behavioral1/memory/1884-4-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla
behavioral1/memory/1884-5-0x0000000000446B9E-mapping.dmp	family_agenttesla
behavioral1/memory/1884-6-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla
behavioral1/memory/1884-7-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Windows\CurrentVersion\Run\CFMBUF = "C:\\Users\\Admin\\AppData\\Roaming\\CFMBUF\\CFMBUF.exe"	RegSvcs.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1388 set thread context of 1884	1388	IMG2007.exe	28

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
1864	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1884	RegSvcs.exe
1884	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1884	RegSvcs.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1388 wrote to memory of 1864	1388	IMG2007.exe	26
PID 1388 wrote to memory of 1864	1388	IMG2007.exe	26
PID 1388 wrote to memory of 1864	1388	IMG2007.exe	26
PID 1388 wrote to memory of 1864	1388	IMG2007.exe	26
PID 1388 wrote to memory of 1884	1388	IMG2007.exe	28
PID 1388 wrote to memory of 1884	1388	IMG2007.exe	28
PID 1388 wrote to memory of 1884	1388	IMG2007.exe	28
PID 1388 wrote to memory of 1884	1388	IMG2007.exe	28
PID 1388 wrote to memory of 1884	1388	IMG2007.exe	28
PID 1388 wrote to memory of 1884	1388	IMG2007.exe	28
PID 1388 wrote to memory of 1884	1388	IMG2007.exe	28
PID 1388 wrote to memory of 1884	1388	IMG2007.exe	28
PID 1388 wrote to memory of 1884	1388	IMG2007.exe	28
PID 1388 wrote to memory of 1884	1388	IMG2007.exe	28
PID 1388 wrote to memory of 1884	1388	IMG2007.exe	28
PID 1388 wrote to memory of 1884	1388	IMG2007.exe	28

C:\Users\Admin\AppData\Local\Temp\IMG2007.exe
"C:\Users\Admin\AppData\Local\Temp\IMG2007.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1388
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\hhAXueKwav" /XML "C:\Users\Admin\AppData\Local\Temp\tmp7E72.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1864
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "{path}"
  2⤵
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1884