agenttesla | 4e655c620ed90cdbcd62d7c884c807cf82c8fff069da38d293dc746839597399

General

Target
proforma invoice.exe
Size 564KB
Sample201002-xyz3ypfsqa
SHA256 4e655c620ed90cdbcd62d7c884c807cf82c8fff069da38d293dc746839597399
MD5 2d8e0bc091145d53891022531fd421cf
SHA1 0f2aa8d15e30927460d3b4ca47d9d6c5315f714e
SHA512 31169c14831fa776d630f0fac4933dcd36d85b8301202ccaf6b5e7bf91d2d1bc9eb4d0bddf584ecd6ffd3b978140ec3f5a05048762fa771391d5b9b341c8183c
MD5 SHA1 SHA512

Score

10^/10

Family

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 2 IoCs

resource	yara_rule
behavioral2/memory/3012-12-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral2/memory/3012-13-0x00000000004374BE-mapping.dmp	family_agenttesla

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	proforma invoice.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Software\Microsoft\Windows\CurrentVersion\Run\WCPCe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\WCPCe\\WCPCe.exe"	proforma invoice.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3288 set thread context of 3012	3288	proforma invoice.exe	77

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
4000	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3288	proforma invoice.exe
Token: SeDebugPrivilege	3012	proforma invoice.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3288 wrote to memory of 4000	3288	proforma invoice.exe	75
PID 3288 wrote to memory of 4000	3288	proforma invoice.exe	75
PID 3288 wrote to memory of 4000	3288	proforma invoice.exe	75
PID 3288 wrote to memory of 3012	3288	proforma invoice.exe	77
PID 3288 wrote to memory of 3012	3288	proforma invoice.exe	77
PID 3288 wrote to memory of 3012	3288	proforma invoice.exe	77
PID 3288 wrote to memory of 3012	3288	proforma invoice.exe	77
PID 3288 wrote to memory of 3012	3288	proforma invoice.exe	77
PID 3288 wrote to memory of 3012	3288	proforma invoice.exe	77
PID 3288 wrote to memory of 3012	3288	proforma invoice.exe	77
PID 3288 wrote to memory of 3012	3288	proforma invoice.exe	77

C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe
"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3288
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\RNKmffEDzXEQY" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD16A.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:4000
- C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe
  "{path}"
  2⤵
  - Drops file in Drivers directory
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3012