agenttesla | d64c548cdf246a19722734b1c94f30252f00873a2e0960dccd05101f05e845d9

General

Target
ORDER 5743000.exe
Size 389KB
Sample201109-e99c2sc1ga
SHA256 d64c548cdf246a19722734b1c94f30252f00873a2e0960dccd05101f05e845d9
MD5 50ce8ba8c2e821aea4eb2bbdf2343c00
SHA1 bf667bb4b01f083f0b46697043ce4ba59ea7a24b
SHA512 4ed856693715da76eeb745007e38e7bca955ff6aab6504808ad02327bc6c4c862f6b92fda725d56084670e5d8fed30619422d840225fa17cd8944f414e2f6756
MD5 SHA1 SHA512

Score

10^/10

Family

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 4 IoCs

resource	yara_rule
behavioral1/memory/1284-3-0x000000000044804E-mapping.dmp	family_agenttesla
behavioral1/memory/1284-2-0x0000000000400000-0x000000000044E000-memory.dmp	family_agenttesla
behavioral1/memory/1284-4-0x0000000000400000-0x000000000044E000-memory.dmp	family_agenttesla
behavioral1/memory/1284-5-0x0000000000400000-0x000000000044E000-memory.dmp	family_agenttesla

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\sHRjOOtA = "C:\\Users\\Admin\\AppData\\Roaming\\MZYBBxZ\\BDEwc.exe"	RegSvcs.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1584 set thread context of 1284	1584	ORDER 5743000.exe	30

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
1308	schtasks.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1584	ORDER 5743000.exe
Token: SeDebugPrivilege	1284	RegSvcs.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1584 wrote to memory of 1308	1584	ORDER 5743000.exe	26
PID 1584 wrote to memory of 1308	1584	ORDER 5743000.exe	26
PID 1584 wrote to memory of 1308	1584	ORDER 5743000.exe	26
PID 1584 wrote to memory of 1308	1584	ORDER 5743000.exe	26
PID 1584 wrote to memory of 1284	1584	ORDER 5743000.exe	30
PID 1584 wrote to memory of 1284	1584	ORDER 5743000.exe	30
PID 1584 wrote to memory of 1284	1584	ORDER 5743000.exe	30
PID 1584 wrote to memory of 1284	1584	ORDER 5743000.exe	30
PID 1584 wrote to memory of 1284	1584	ORDER 5743000.exe	30
PID 1584 wrote to memory of 1284	1584	ORDER 5743000.exe	30
PID 1584 wrote to memory of 1284	1584	ORDER 5743000.exe	30
PID 1584 wrote to memory of 1284	1584	ORDER 5743000.exe	30
PID 1584 wrote to memory of 1284	1584	ORDER 5743000.exe	30
PID 1584 wrote to memory of 1284	1584	ORDER 5743000.exe	30
PID 1584 wrote to memory of 1284	1584	ORDER 5743000.exe	30
PID 1584 wrote to memory of 1284	1584	ORDER 5743000.exe	30

C:\Users\Admin\AppData\Local\Temp\ORDER 5743000.exe
"C:\Users\Admin\AppData\Local\Temp\ORDER 5743000.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1584
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\xeyBubI" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9A0E.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1308
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
  "{path}"
  2⤵
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1284