agenttesla | 67309e579deeb9fae0f90ce0e40e40318ef25c6c32b88e247863f13aa6678a55

General

Target
PI#203498.exe
Size 499KB
Sample200816-ejej9x22ps
SHA256 67309e579deeb9fae0f90ce0e40e40318ef25c6c32b88e247863f13aa6678a55
MD5 73782309d2673290ba3a36e5488f36cd
SHA1 7924368a1460956d08d98db9c82ff2810c99c3d4
SHA512 1f654a525bb6b4df115886451d5bed9050216ab69724d9dc468a72f49d9c4fca233e35f27f48d8692ea55bb8af546602ec672f575d7c7fd1e4fd3c8a255db445
MD5 SHA1 SHA512

Score

10^/10

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 3 IoCs

keylogger stealer

resource	yara_rule
behavioral2/memory/3912-2-0x0000000000400000-0x000000000044C000-memory.dmp	agent_tesla
behavioral2/memory/3912-2-0x0000000000400000-0x000000000044C000-memory.dmp	agent_tesla
behavioral2/memory/3912-3-0x0000000000446F2E-mapping.dmp	agent_tesla

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3588 set thread context of 3912	3588	PI#203498.exe	69

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
3820	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3588	PI#203498.exe
Token: SeDebugPrivilege	3912	PI#203498.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3588 wrote to memory of 3820	3588	PI#203498.exe	67
PID 3588 wrote to memory of 3820	3588	PI#203498.exe	67
PID 3588 wrote to memory of 3820	3588	PI#203498.exe	67
PID 3588 wrote to memory of 3912	3588	PI#203498.exe	69
PID 3588 wrote to memory of 3912	3588	PI#203498.exe	69
PID 3588 wrote to memory of 3912	3588	PI#203498.exe	69
PID 3588 wrote to memory of 3912	3588	PI#203498.exe	69
PID 3588 wrote to memory of 3912	3588	PI#203498.exe	69
PID 3588 wrote to memory of 3912	3588	PI#203498.exe	69
PID 3588 wrote to memory of 3912	3588	PI#203498.exe	69
PID 3588 wrote to memory of 3912	3588	PI#203498.exe	69

C:\Users\Admin\AppData\Local\Temp\PI#203498.exe
"C:\Users\Admin\AppData\Local\Temp\PI#203498.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3588
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eEoSEguexVGqw" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC0E9.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:3820
- C:\Users\Admin\AppData\Local\Temp\PI#203498.exe
  "{path}"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3912