agenttesla | 36b3044a2e615b0f530f834734bde33e860ca706b0b80e1b73d9c83be186ade2

General

Target
REQUEST ORDER.exe
Size 655KB
Sample200808-h1ysfgbf66
SHA256 36b3044a2e615b0f530f834734bde33e860ca706b0b80e1b73d9c83be186ade2
MD5 fcbc3b4066a601dd4ea75cc4c859dde0
SHA1 bbb6c3ace8f0b21ffb18479bc0f96d5527ec403f
SHA512 04224fde2729fb9d77205885111fc3e1f877d56a8684e8c84f6db2ee8dd6ec2df3113482986cedea01ffb9f0f4335ca69e2e1089d15b9418efa005803755241e
MD5 SHA1 SHA512

Score

10^/10

Family

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
UAC bypass 3 TTPs
evasion trojan

Bypass User Account Control
T1088

Disabling Security Tools
T1089

Modify Registry
T1112

AgentTesla Payload 2 IoCs

resource	yara_rule
behavioral2/memory/3408-13-0x00000000004476AE-mapping.dmp	family_agenttesla
behavioral2/memory/3408-12-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	RegSvcs.exe

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\CJzRAE = "C:\\Users\\Admin\\AppData\\Roaming\\CJzRAE\\CJzRAE.exe"	RegSvcs.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3076 set thread context of 3408	3076	REQUEST ORDER.exe	69

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
3264	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3076	REQUEST ORDER.exe
Token: SeDebugPrivilege	3408	RegSvcs.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3076 wrote to memory of 3264	3076	REQUEST ORDER.exe	67
PID 3076 wrote to memory of 3264	3076	REQUEST ORDER.exe	67
PID 3076 wrote to memory of 3264	3076	REQUEST ORDER.exe	67
PID 3076 wrote to memory of 3408	3076	REQUEST ORDER.exe	69
PID 3076 wrote to memory of 3408	3076	REQUEST ORDER.exe	69
PID 3076 wrote to memory of 3408	3076	REQUEST ORDER.exe	69
PID 3076 wrote to memory of 3408	3076	REQUEST ORDER.exe	69
PID 3076 wrote to memory of 3408	3076	REQUEST ORDER.exe	69
PID 3076 wrote to memory of 3408	3076	REQUEST ORDER.exe	69
PID 3076 wrote to memory of 3408	3076	REQUEST ORDER.exe	69
PID 3076 wrote to memory of 3408	3076	REQUEST ORDER.exe	69

C:\Users\Admin\AppData\Local\Temp\REQUEST ORDER.exe
"C:\Users\Admin\AppData\Local\Temp\REQUEST ORDER.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3076
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\AtqBNvvufyN" /XML "C:\Users\Admin\AppData\Local\Temp\tmpBA42.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:3264
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "{path}"
  2⤵
  - Drops file in Drivers directory
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3408