agenttesla | 8e7bbf8a58e3633c72514c11d5a4c161a6d2a2c9fe04111375ec4fa82580baef

General

Target
PO message6112020.exe
Size 615KB
Sample201109-pc4165ytv2
SHA256 8e7bbf8a58e3633c72514c11d5a4c161a6d2a2c9fe04111375ec4fa82580baef
MD5 c8011220f422e0a32de5c4d3dce6ecea
SHA1 c7d88161dea34f6e084b9b8954f91f41dd1693b7
SHA512 b61e81f7fa81a9967b33e57b1ab41b497f45087b6ad41381db140a15e4d7445dbf4db94e0739b6a4aa57d549d0de8b66eff847cda12ade73753b1039a4d4292b
MD5 SHA1 SHA512

Score

10^/10

Credentials

Family

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 2 IoCs

resource	yara_rule
behavioral2/memory/2624-2-0x0000000000400000-0x0000000000452000-memory.dmp	family_agenttesla
behavioral2/memory/2624-3-0x000000000044C47E-mapping.dmp	family_agenttesla

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\Mymp4 = "C:\\Users\\Admin\\AppData\\Roaming\\Mymp4\\Mymp4.exe"	PO message6112020.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 580 set thread context of 2624	580	PO message6112020.exe	80

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
936	schtasks.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	580	PO message6112020.exe
Token: SeDebugPrivilege	2624	PO message6112020.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2624	PO message6112020.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 580 wrote to memory of 936	580	PO message6112020.exe	78
PID 580 wrote to memory of 936	580	PO message6112020.exe	78
PID 580 wrote to memory of 936	580	PO message6112020.exe	78
PID 580 wrote to memory of 2624	580	PO message6112020.exe	80
PID 580 wrote to memory of 2624	580	PO message6112020.exe	80
PID 580 wrote to memory of 2624	580	PO message6112020.exe	80
PID 580 wrote to memory of 2624	580	PO message6112020.exe	80
PID 580 wrote to memory of 2624	580	PO message6112020.exe	80
PID 580 wrote to memory of 2624	580	PO message6112020.exe	80
PID 580 wrote to memory of 2624	580	PO message6112020.exe	80
PID 580 wrote to memory of 2624	580	PO message6112020.exe	80

C:\Users\Admin\AppData\Local\Temp\PO message6112020.exe
"C:\Users\Admin\AppData\Local\Temp\PO message6112020.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:580
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ThwaOqhgyIHY" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE082.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:936
- C:\Users\Admin\AppData\Local\Temp\PO message6112020.exe
  "{path}"
  2⤵
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2624