agenttesla | d00a0836ea91458d1521ee4ebeaab0746a45b10901497a215b0bd0ebdf045e61

General

Target
IAhYP4OuQ52pglH.exe
Size 620KB
Sample200804-exgncwgbhs
SHA256 d00a0836ea91458d1521ee4ebeaab0746a45b10901497a215b0bd0ebdf045e61
MD5 33b370e37c963a7e3051a98a63429e4f
SHA1 92baae7d4da34c18807942cfb6c9f11906450d49
SHA512 898ae92ed64d30661a3884c8a4550ad7aee4515a2f9d0c3ee3d4404ac627f50ef888a4ba9d8c61df85c176faae014410e92f4f6c72679f69516eecfdc7664774
MD5 SHA1 SHA512

Score

10^/10

Credentials

AgentTesla Payload 3 IoCs

keylogger stealer

resource	yara_rule
behavioral2/memory/3852-2-0x0000000000400000-0x0000000000452000-memory.dmp	agent_tesla
behavioral2/memory/3852-2-0x0000000000400000-0x0000000000452000-memory.dmp	agent_tesla
behavioral2/memory/3852-3-0x000000000044CC3E-mapping.dmp	agent_tesla

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
3880	schtasks.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 748 wrote to memory of 3880	748	IAhYP4OuQ52pglH.exe	66
PID 748 wrote to memory of 3880	748	IAhYP4OuQ52pglH.exe	66
PID 748 wrote to memory of 3880	748	IAhYP4OuQ52pglH.exe	66
PID 748 wrote to memory of 3852	748	IAhYP4OuQ52pglH.exe	68
PID 748 wrote to memory of 3852	748	IAhYP4OuQ52pglH.exe	68
PID 748 wrote to memory of 3852	748	IAhYP4OuQ52pglH.exe	68
PID 748 wrote to memory of 3852	748	IAhYP4OuQ52pglH.exe	68
PID 748 wrote to memory of 3852	748	IAhYP4OuQ52pglH.exe	68
PID 748 wrote to memory of 3852	748	IAhYP4OuQ52pglH.exe	68
PID 748 wrote to memory of 3852	748	IAhYP4OuQ52pglH.exe	68
PID 748 wrote to memory of 3852	748	IAhYP4OuQ52pglH.exe	68
PID 3852 wrote to memory of 428	3852	IAhYP4OuQ52pglH.exe	76
PID 3852 wrote to memory of 428	3852	IAhYP4OuQ52pglH.exe	76
PID 3852 wrote to memory of 428	3852	IAhYP4OuQ52pglH.exe	76

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 748 set thread context of 3852	748	IAhYP4OuQ52pglH.exe	68

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	748	IAhYP4OuQ52pglH.exe
Token: SeDebugPrivilege	3852	IAhYP4OuQ52pglH.exe

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3852	IAhYP4OuQ52pglH.exe

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\uEtmoKl = "C:\\Users\\Admin\\AppData\\Roaming\\uEtmoKl\\uEtmoKl.exe"	IAhYP4OuQ52pglH.exe

C:\Users\Admin\AppData\Local\Temp\IAhYP4OuQ52pglH.exe
"C:\Users\Admin\AppData\Local\Temp\IAhYP4OuQ52pglH.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:748
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\&startupname&" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC60A.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:3880
- C:\Users\Admin\AppData\Local\Temp\IAhYP4OuQ52pglH.exe
  "C:\Users\Admin\AppData\Local\Temp\IAhYP4OuQ52pglH.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Adds Run key to start application
  PID:3852
- - C:\Windows\SysWOW64\netsh.exe
    "netsh" wlan show profile
    3⤵
    PID:428