agenttesla | 9f0ff834836defa680e364c7318932aa13074bed115f6ef52b3c08e856df6b33

General

Target
202025987721.exe
Size 433KB
Sample201109-e8639lta2a
SHA256 9f0ff834836defa680e364c7318932aa13074bed115f6ef52b3c08e856df6b33
MD5 7c5df8b629ca1700b5c8486774769bab
SHA1 066d2434b35882c137e7eebf02e35ff6c7e71dcd
SHA512 5e2515ebf598f1119ed60f3fba90adc775ddd43f2a4e6f54c52165f3186c3b480e8a48a0a5474a12aa79cfddbe271539050177ad11e3370da34cdcdc93b741f6
MD5 SHA1 SHA512

Score

10^/10

Family

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 4 IoCs

resource	yara_rule
behavioral1/memory/784-2-0x0000000000400000-0x0000000000452000-memory.dmp	family_agenttesla
behavioral1/memory/784-3-0x000000000044CFCE-mapping.dmp	family_agenttesla
behavioral1/memory/784-4-0x0000000000400000-0x0000000000452000-memory.dmp	family_agenttesla
behavioral1/memory/784-5-0x0000000000400000-0x0000000000452000-memory.dmp	family_agenttesla

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	202025987721.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1660 set thread context of 784	1660	202025987721.exe	31

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
1556	schtasks.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1660	202025987721.exe
Token: SeDebugPrivilege	784	202025987721.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
784	202025987721.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 1660 wrote to memory of 1556	1660	202025987721.exe	29
PID 1660 wrote to memory of 1556	1660	202025987721.exe	29
PID 1660 wrote to memory of 1556	1660	202025987721.exe	29
PID 1660 wrote to memory of 1556	1660	202025987721.exe	29
PID 1660 wrote to memory of 784	1660	202025987721.exe	31
PID 1660 wrote to memory of 784	1660	202025987721.exe	31
PID 1660 wrote to memory of 784	1660	202025987721.exe	31
PID 1660 wrote to memory of 784	1660	202025987721.exe	31
PID 1660 wrote to memory of 784	1660	202025987721.exe	31
PID 1660 wrote to memory of 784	1660	202025987721.exe	31
PID 1660 wrote to memory of 784	1660	202025987721.exe	31
PID 1660 wrote to memory of 784	1660	202025987721.exe	31
PID 1660 wrote to memory of 784	1660	202025987721.exe	31
PID 784 wrote to memory of 692	784	202025987721.exe	33
PID 784 wrote to memory of 692	784	202025987721.exe	33
PID 784 wrote to memory of 692	784	202025987721.exe	33
PID 784 wrote to memory of 692	784	202025987721.exe	33

C:\Users\Admin\AppData\Local\Temp\202025987721.exe
"C:\Users\Admin\AppData\Local\Temp\202025987721.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1660
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\EvDzoZVDJn" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA2E4.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1556
- C:\Users\Admin\AppData\Local\Temp\202025987721.exe
  "{path}"
  2⤵
  - Drops file in Drivers directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:784
- - C:\Windows\SysWOW64\netsh.exe
    "netsh" wlan show profile
    3⤵
    PID:692