agenttesla | 1e1ab4806b8ce5ef71655a751bbc490751cd43da6c06ac95f40da79ea4dc4534

General

Target
orders.exe
Size 494KB
Sample210118-k7jpptlp52
SHA256 1e1ab4806b8ce5ef71655a751bbc490751cd43da6c06ac95f40da79ea4dc4534
MD5 41a5c07a9ee894fca2f0f95bf51d1899
SHA1 9b473863b9e06468d358cc7f3b8ce41637a075fb
SHA512 e3e27b13365fd826f37282f9621109327dd4da8269f7b984aab2ef06c336dd36fb3b73beae7df5280a171166cce23b294a695babcc7032652dc3d0fb3f04c68c
MD5 SHA1 SHA512

Score

10^/10

Family

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 2 IoCs

resource	yara_rule
behavioral2/memory/3676-8-0x0000000004F90000-0x0000000004FC7000-memory.dmp	family_agenttesla
behavioral2/memory/3676-10-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	orders.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\System file 64 bit = "C:\\Users\\Admin\\AppData\\Roaming\\System file 64 bit\\System file 64 bit.exe"	orders.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 580 set thread context of 3676	580	orders.exe	80

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
4040	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3676	orders.exe
3676	orders.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
580	orders.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3676	orders.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 580 wrote to memory of 3020	580	orders.exe	76
PID 580 wrote to memory of 3020	580	orders.exe	76
PID 580 wrote to memory of 3020	580	orders.exe	76
PID 580 wrote to memory of 3680	580	orders.exe	77
PID 580 wrote to memory of 3680	580	orders.exe	77
PID 580 wrote to memory of 3680	580	orders.exe	77
PID 580 wrote to memory of 3168	580	orders.exe	78
PID 580 wrote to memory of 3168	580	orders.exe	78
PID 580 wrote to memory of 3168	580	orders.exe	78
PID 580 wrote to memory of 3676	580	orders.exe	80
PID 580 wrote to memory of 3676	580	orders.exe	80
PID 580 wrote to memory of 3676	580	orders.exe	80
PID 580 wrote to memory of 3676	580	orders.exe	80
PID 3168 wrote to memory of 4040	3168	cmd.exe	81
PID 3168 wrote to memory of 4040	3168	cmd.exe	81
PID 3168 wrote to memory of 4040	3168	cmd.exe	81

C:\Users\Admin\AppData\Local\Temp\orders.exe
"C:\Users\Admin\AppData\Local\Temp\orders.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:580
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:3020
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:3680
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /Create /TN system files /XML "C:\Users\Admin\AppData\Local\Temp\15891f6965ff4d15a61497cf1cb7fcde.xml"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3168
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Create /TN system files /XML "C:\Users\Admin\AppData\Local\Temp\15891f6965ff4d15a61497cf1cb7fcde.xml"
    3⤵
    - Creates scheduled task(s)
    PID:4040
- C:\Users\Admin\AppData\Local\Temp\orders.exe
  "C:\Users\Admin\AppData\Local\Temp\orders.exe"
  2⤵
  - Drops file in Drivers directory
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3676