agenttesla | 0fbf94a719f66bcd7d5d5a8fe06d509bd4bf09ccc7610d6b08a6eb97136bc84a

General

Target
DOC.PDF.exe
Size 401KB
Sample201109-2g4pbf9d2s
SHA256 0fbf94a719f66bcd7d5d5a8fe06d509bd4bf09ccc7610d6b08a6eb97136bc84a
MD5 0a9ede2f77583a6f5851822e0e9fa547
SHA1 2158339ce24bf1df97bab8018a693de764159dd4
SHA512 547f7c4b9dffa8cb2ce03210a3d1d79b5f339644c75df1825b9ce84adefaccd36be6cdc793c90ce0afaf8ee0c24ca71840653e2f3f0333a4da4d1e956d304a23
MD5 SHA1 SHA512

Score

10^/10

Family

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 2 IoCs

resource	yara_rule
behavioral2/memory/580-2-0x0000000000400000-0x0000000000452000-memory.dmp	family_agenttesla
behavioral2/memory/580-3-0x000000000044CDCE-mapping.dmp	family_agenttesla

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 648 set thread context of 580	648	DOC.PDF.exe	80

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
4076	schtasks.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	648	DOC.PDF.exe
Token: SeDebugPrivilege	580	DOC.PDF.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 648 wrote to memory of 4076	648	DOC.PDF.exe	78
PID 648 wrote to memory of 4076	648	DOC.PDF.exe	78
PID 648 wrote to memory of 4076	648	DOC.PDF.exe	78
PID 648 wrote to memory of 580	648	DOC.PDF.exe	80
PID 648 wrote to memory of 580	648	DOC.PDF.exe	80
PID 648 wrote to memory of 580	648	DOC.PDF.exe	80
PID 648 wrote to memory of 580	648	DOC.PDF.exe	80
PID 648 wrote to memory of 580	648	DOC.PDF.exe	80
PID 648 wrote to memory of 580	648	DOC.PDF.exe	80
PID 648 wrote to memory of 580	648	DOC.PDF.exe	80
PID 648 wrote to memory of 580	648	DOC.PDF.exe	80
PID 580 wrote to memory of 1248	580	DOC.PDF.exe	82
PID 580 wrote to memory of 1248	580	DOC.PDF.exe	82
PID 580 wrote to memory of 1248	580	DOC.PDF.exe	82

C:\Users\Admin\AppData\Local\Temp\DOC.PDF.exe
"C:\Users\Admin\AppData\Local\Temp\DOC.PDF.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:648
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\lQcYcdKa" /XML "C:\Users\Admin\AppData\Local\Temp\tmp29A1.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:4076
- C:\Users\Admin\AppData\Local\Temp\DOC.PDF.exe
  "{path}"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:580
- - C:\Windows\SysWOW64\netsh.exe
    "netsh" wlan show profile
    3⤵
    PID:1248