agenttesla | d8525b2302c08306f63aa470ca7e081dbf35669af349cd1224d1485ecff71d43

General

Target
PO-37566324756834756_XLS.exe
Size 714KB
Sample201109-tmpywtgene
SHA256 d8525b2302c08306f63aa470ca7e081dbf35669af349cd1224d1485ecff71d43
MD5 b56b7bea3cd94a84afa1024aea59ac6d
SHA1 4d95aee7d7ad2463e0c5a47687057bd390df6430
SHA512 c5791e1a79e8ca31a5ddc14d7ed7c071bfcc518d5e2a5bed8c6c1ec5d08962a3d3bf83833024d6de819d90b173eff0ad06ab0b89415990c24e17926c40f4105f
MD5 SHA1 SHA512

Score

10^/10

Family

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 2 IoCs

resource	yara_rule
behavioral2/memory/1888-6-0x000000000044C9FE-mapping.dmp	family_agenttesla
behavioral2/memory/1888-5-0x0000000000400000-0x0000000000452000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1028 set thread context of 1888	1028	PO-37566324756834756_XLS.exe	78

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
1504	schtasks.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

pid	Process
1344	REG.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1888	RegSvcs.exe
1888	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1028	PO-37566324756834756_XLS.exe
Token: SeDebugPrivilege	1888	RegSvcs.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1028	PO-37566324756834756_XLS.exe
1028	PO-37566324756834756_XLS.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 1028 wrote to memory of 1504	1028	PO-37566324756834756_XLS.exe	76
PID 1028 wrote to memory of 1504	1028	PO-37566324756834756_XLS.exe	76
PID 1028 wrote to memory of 1504	1028	PO-37566324756834756_XLS.exe	76
PID 1028 wrote to memory of 1888	1028	PO-37566324756834756_XLS.exe	78
PID 1028 wrote to memory of 1888	1028	PO-37566324756834756_XLS.exe	78
PID 1028 wrote to memory of 1888	1028	PO-37566324756834756_XLS.exe	78
PID 1028 wrote to memory of 1888	1028	PO-37566324756834756_XLS.exe	78
PID 1028 wrote to memory of 1888	1028	PO-37566324756834756_XLS.exe	78
PID 1028 wrote to memory of 1888	1028	PO-37566324756834756_XLS.exe	78
PID 1028 wrote to memory of 1888	1028	PO-37566324756834756_XLS.exe	78
PID 1028 wrote to memory of 1888	1028	PO-37566324756834756_XLS.exe	78
PID 1888 wrote to memory of 1344	1888	RegSvcs.exe	83
PID 1888 wrote to memory of 1344	1888	RegSvcs.exe	83
PID 1888 wrote to memory of 1344	1888	RegSvcs.exe	83
PID 1888 wrote to memory of 3728	1888	RegSvcs.exe	85
PID 1888 wrote to memory of 3728	1888	RegSvcs.exe	85
PID 1888 wrote to memory of 3728	1888	RegSvcs.exe	85

C:\Users\Admin\AppData\Local\Temp\PO-37566324756834756_XLS.exe
"C:\Users\Admin\AppData\Local\Temp\PO-37566324756834756_XLS.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1028
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\BNbKBooAq" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5F3C.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1504
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
  "{path}"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1888
- - C:\Windows\SysWOW64\REG.exe
    REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoRun /t REG_DWORD /d 1 /f
    3⤵
    - Modifies registry key
    PID:1344
- - C:\Windows\SysWOW64\netsh.exe
    "netsh" wlan show profile
    3⤵
    PID:3728