agenttesla | d4a486d6eb6ff402162a440e49cb53777c2a3a0e98abb04016e189cd445676a2

General

Target
ENQUIRY 050420217274.exe
Size 1.2MB
Sample210504-ffnjnbgrsx
SHA256 d4a486d6eb6ff402162a440e49cb53777c2a3a0e98abb04016e189cd445676a2
MD5 cf4fbd7fa545026f738a9b49730010e0
SHA1 93aaa89acdda9b49c501d901e29b17e8e8d56c75
SHA512 f94c246ef1745d1f3d67c4b468497eba7f551a00d3a797ef9ad12b2f10af81b0071ab6d1dc44d026ea23e5bc2c148b273e8c478e7cb3b7bdd186531e1981d496
MD5 SHA1 SHA512

Score

10^/10

Family

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 3 IoCs

resource	yara_rule
behavioral1/memory/428-68-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/428-69-0x00000000004375AE-mapping.dmp	family_agenttesla
behavioral1/memory/428-70-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\jNnIJrO = "C:\\Users\\Admin\\AppData\\Roaming\\jNnIJrO\\jNnIJrO.exe"	ENQUIRY 050420217274.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 452 set thread context of 428	452	ENQUIRY 050420217274.exe	31

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
912	schtasks.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
428	ENQUIRY 050420217274.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	452	ENQUIRY 050420217274.exe
Token: SeDebugPrivilege	428	ENQUIRY 050420217274.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
428	ENQUIRY 050420217274.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 452 wrote to memory of 912	452	ENQUIRY 050420217274.exe	29
PID 452 wrote to memory of 912	452	ENQUIRY 050420217274.exe	29
PID 452 wrote to memory of 912	452	ENQUIRY 050420217274.exe	29
PID 452 wrote to memory of 912	452	ENQUIRY 050420217274.exe	29
PID 452 wrote to memory of 428	452	ENQUIRY 050420217274.exe	31
PID 452 wrote to memory of 428	452	ENQUIRY 050420217274.exe	31
PID 452 wrote to memory of 428	452	ENQUIRY 050420217274.exe	31
PID 452 wrote to memory of 428	452	ENQUIRY 050420217274.exe	31
PID 452 wrote to memory of 428	452	ENQUIRY 050420217274.exe	31
PID 452 wrote to memory of 428	452	ENQUIRY 050420217274.exe	31
PID 452 wrote to memory of 428	452	ENQUIRY 050420217274.exe	31
PID 452 wrote to memory of 428	452	ENQUIRY 050420217274.exe	31
PID 452 wrote to memory of 428	452	ENQUIRY 050420217274.exe	31

C:\Users\Admin\AppData\Local\Temp\ENQUIRY 050420217274.exe
"C:\Users\Admin\AppData\Local\Temp\ENQUIRY 050420217274.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:452
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\cZltdo" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB9CD.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:912
- C:\Users\Admin\AppData\Local\Temp\ENQUIRY 050420217274.exe
  "{path}"
  2⤵
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: RenamesItself
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:428