agenttesla | 9ff16ce8c4c4391af430eedc58a23ea4d004c597a7ee79790896bdff9abe7700

General

Target
CTC Int'l Group ORDER NÂº. 19146.exe
Size 465KB
Sample201109-3resp7kxwe
SHA256 9ff16ce8c4c4391af430eedc58a23ea4d004c597a7ee79790896bdff9abe7700
MD5 9343fa14ad82a71a74e286a159acb84b
SHA1 c516c0f69915548e352bf4716d99e399a9449b5b
SHA512 60d1934d5cc7043fa09f6333e95e2893ae8fd6053b090b4135bbb373e24bfa527ec1ce0d59c9778850397767223494c19584d1dd97b92ad15f4b4487a8300456
MD5 SHA1 SHA512

Score

10^/10

Credentials

Family

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 2 IoCs

resource	yara_rule
behavioral2/memory/1308-2-0x0000000000400000-0x0000000000452000-memory.dmp	family_agenttesla
behavioral2/memory/1308-3-0x000000000044C9DE-mapping.dmp	family_agenttesla

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 416 set thread context of 1308	416	CTC Int'l Group ORDER NÂº. 19146.exe	81

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
188	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	416	CTC Int'l Group ORDER NÂº. 19146.exe
Token: SeDebugPrivilege	1308	CTC Int'l Group ORDER NÂº. 19146.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1308	CTC Int'l Group ORDER NÂº. 19146.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 416 wrote to memory of 188	416	CTC Int'l Group ORDER NÂº. 19146.exe	78
PID 416 wrote to memory of 188	416	CTC Int'l Group ORDER NÂº. 19146.exe	78
PID 416 wrote to memory of 188	416	CTC Int'l Group ORDER NÂº. 19146.exe	78
PID 416 wrote to memory of 936	416	CTC Int'l Group ORDER NÂº. 19146.exe	80
PID 416 wrote to memory of 936	416	CTC Int'l Group ORDER NÂº. 19146.exe	80
PID 416 wrote to memory of 936	416	CTC Int'l Group ORDER NÂº. 19146.exe	80
PID 416 wrote to memory of 1308	416	CTC Int'l Group ORDER NÂº. 19146.exe	81
PID 416 wrote to memory of 1308	416	CTC Int'l Group ORDER NÂº. 19146.exe	81
PID 416 wrote to memory of 1308	416	CTC Int'l Group ORDER NÂº. 19146.exe	81
PID 416 wrote to memory of 1308	416	CTC Int'l Group ORDER NÂº. 19146.exe	81
PID 416 wrote to memory of 1308	416	CTC Int'l Group ORDER NÂº. 19146.exe	81
PID 416 wrote to memory of 1308	416	CTC Int'l Group ORDER NÂº. 19146.exe	81
PID 416 wrote to memory of 1308	416	CTC Int'l Group ORDER NÂº. 19146.exe	81
PID 416 wrote to memory of 1308	416	CTC Int'l Group ORDER NÂº. 19146.exe	81
PID 1308 wrote to memory of 2104	1308	CTC Int'l Group ORDER NÂº. 19146.exe	83
PID 1308 wrote to memory of 2104	1308	CTC Int'l Group ORDER NÂº. 19146.exe	83
PID 1308 wrote to memory of 2104	1308	CTC Int'l Group ORDER NÂº. 19146.exe	83

C:\Users\Admin\AppData\Local\Temp\CTC Int'l Group ORDER NÂº. 19146.exe
"C:\Users\Admin\AppData\Local\Temp\CTC Int'l Group ORDER NÂº. 19146.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:416
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GpYNPPNgNSJJs" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5AE.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:188
- C:\Users\Admin\AppData\Local\Temp\CTC Int'l Group ORDER NÂº. 19146.exe
  "{path}"
  2⤵
  PID:936
- C:\Users\Admin\AppData\Local\Temp\CTC Int'l Group ORDER NÂº. 19146.exe
  "{path}"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1308
- - C:\Windows\SysWOW64\netsh.exe
    "netsh" wlan show profile
    3⤵
    PID:2104