agenttesla | 0f554bb19749e97d63525c4d964041e8d6fc149cb0aec5c4560cccf09babc39c

General

Target
Lnr6Vr0283QGR6Y.exe
Size 714KB
Sample200904-ejpmnw7tgs
SHA256 0f554bb19749e97d63525c4d964041e8d6fc149cb0aec5c4560cccf09babc39c
MD5 8871dda14245672325929c054ef12de0
SHA1 25b75274e0b564f744ae333c3577a1b42c7b2343
SHA512 400b78dd9e2ce3774a5270d39e8418d9e8dab6a64b0dc5269cbc9c80ed64dc922bd6722d948853d5a7430f440b5d396fdee18dffb324c4327681e4f7b15d911a
MD5 SHA1 SHA512

Score

10^/10

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 3 IoCs

keylogger stealer

resource	yara_rule
behavioral2/memory/1652-2-0x0000000000400000-0x0000000000466000-memory.dmp	agent_tesla
behavioral2/memory/1652-2-0x0000000000400000-0x0000000000466000-memory.dmp	agent_tesla
behavioral2/memory/1652-3-0x0000000000460CBE-mapping.dmp	agent_tesla

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3608 set thread context of 1652	3608	Lnr6Vr0283QGR6Y.exe	78

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\ServiceProfiles\LocalService\winhttp\cachev3.dat	svchost.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
1280	schtasks.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionReason = "1"	svchost.exe
Set value (data)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionTime = b8cebb08cc82d601	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecision = "0"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	svchost.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1508	svchost.exe
Token: SeCreatePagefilePrivilege	1508	svchost.exe
Token: SeDebugPrivilege	3608	Lnr6Vr0283QGR6Y.exe
Token: SeDebugPrivilege	1652	Lnr6Vr0283QGR6Y.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1652	Lnr6Vr0283QGR6Y.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3608 wrote to memory of 1280	3608	Lnr6Vr0283QGR6Y.exe	76
PID 3608 wrote to memory of 1280	3608	Lnr6Vr0283QGR6Y.exe	76
PID 3608 wrote to memory of 1280	3608	Lnr6Vr0283QGR6Y.exe	76
PID 3608 wrote to memory of 1652	3608	Lnr6Vr0283QGR6Y.exe	78
PID 3608 wrote to memory of 1652	3608	Lnr6Vr0283QGR6Y.exe	78
PID 3608 wrote to memory of 1652	3608	Lnr6Vr0283QGR6Y.exe	78
PID 3608 wrote to memory of 1652	3608	Lnr6Vr0283QGR6Y.exe	78
PID 3608 wrote to memory of 1652	3608	Lnr6Vr0283QGR6Y.exe	78
PID 3608 wrote to memory of 1652	3608	Lnr6Vr0283QGR6Y.exe	78
PID 3608 wrote to memory of 1652	3608	Lnr6Vr0283QGR6Y.exe	78
PID 3608 wrote to memory of 1652	3608	Lnr6Vr0283QGR6Y.exe	78

C:\Users\Admin\AppData\Local\Temp\Lnr6Vr0283QGR6Y.exe
"C:\Users\Admin\AppData\Local\Temp\Lnr6Vr0283QGR6Y.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3608
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\CbloGRVdVtjQOz" /XML "C:\Users\Admin\AppData\Local\Temp\tmp29DF.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1280
- C:\Users\Admin\AppData\Local\Temp\Lnr6Vr0283QGR6Y.exe
  "C:\Users\Admin\AppData\Local\Temp\Lnr6Vr0283QGR6Y.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1652