agenttesla | 232fa5792839dc677b0211b3694954e9660b174aa0f9bedcab772ac1e86d3843

General

Target
MV_SPIDER_CAPRI_VESSEL_MAIN_PARTICULARS.exe
Size 1.5MB
Sample260504-lc2yvsft61
SHA256 232fa5792839dc677b0211b3694954e9660b174aa0f9bedcab772ac1e86d3843
MD5 e31770026101eaccb1b5de7cffd52033
SHA1 235beed3a3c2ecb6415eff789d2f4deb2cd28c3b
SHA512 c65068629659f5e11e0580e57f10f14e685b4e7fe26e30e2447bc5c74fddaf8c233d095bb96df4b982b2695048a5e4f7c7d5bc138613fbc69db86a05dde6e9cc
SSDEEP 24576:WdpUGxARynhYYI6dwnHL3b5qbDCLTTG/Zl1kngqi6Qj92dgysZI:Z/RynhYYlEbb5Q4TT05hxY
TLSH
T1B9758C13F29902E8D06ED2B9CB568132EA61BC060B35B6DF069073552F77BE46B3E750
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Family

Credentials

Family: AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	ip-api.com

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2684 set thread context of 2644	2684	MV_SPIDER_CAPRI_VESSEL_MAIN_PARTICULARS.exe	85
PID 4380 set thread context of 1992	4380	MV_SPIDER_CAPRI_VESSEL_MAIN_PARTICULARS.exe	91

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jsc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jsc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
4940	schtasks.exe
2132	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2644	jsc.exe
Token: SeDebugPrivilege	1992	jsc.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2684 wrote to memory of 2644	2684	MV_SPIDER_CAPRI_VESSEL_MAIN_PARTICULARS.exe	85
PID 2684 wrote to memory of 2644	2684	MV_SPIDER_CAPRI_VESSEL_MAIN_PARTICULARS.exe	85
PID 2684 wrote to memory of 2644	2684	MV_SPIDER_CAPRI_VESSEL_MAIN_PARTICULARS.exe	85
PID 2684 wrote to memory of 2644	2684	MV_SPIDER_CAPRI_VESSEL_MAIN_PARTICULARS.exe	85
PID 2684 wrote to memory of 2644	2684	MV_SPIDER_CAPRI_VESSEL_MAIN_PARTICULARS.exe	85
PID 2684 wrote to memory of 4940	2684	MV_SPIDER_CAPRI_VESSEL_MAIN_PARTICULARS.exe	86
PID 4380 wrote to memory of 1992	4380	MV_SPIDER_CAPRI_VESSEL_MAIN_PARTICULARS.exe	91
PID 4380 wrote to memory of 1992	4380	MV_SPIDER_CAPRI_VESSEL_MAIN_PARTICULARS.exe	91
PID 4380 wrote to memory of 1992	4380	MV_SPIDER_CAPRI_VESSEL_MAIN_PARTICULARS.exe	91
PID 4380 wrote to memory of 1992	4380	MV_SPIDER_CAPRI_VESSEL_MAIN_PARTICULARS.exe	91
PID 4380 wrote to memory of 1992	4380	MV_SPIDER_CAPRI_VESSEL_MAIN_PARTICULARS.exe	91
PID 4380 wrote to memory of 2132	4380	MV_SPIDER_CAPRI_VESSEL_MAIN_PARTICULARS.exe	92

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\MV_SPIDER_CAPRI_VESSEL_MAIN_PARTICULARS.exe
"C:\Users\Admin\AppData\Local\Temp\MV_SPIDER_CAPRI_VESSEL_MAIN_PARTICULARS.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2684
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2644
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Create /SC ONLOGON /TN RasManagement /TR "C:\Users\Admin\AppData\Local\Temp\MV_SPIDER_CAPRI_VESSEL_MAIN_PARTICULARS.exe" /RU "" /RL HIGHEST /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4940

C:\Users\Admin\AppData\Local\Temp\MV_SPIDER_CAPRI_VESSEL_MAIN_PARTICULARS.exe
C:\Users\Admin\AppData\Local\Temp\MV_SPIDER_CAPRI_VESSEL_MAIN_PARTICULARS.exe
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4380
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1992
- C:\Windows\system32\schtasks.exe
  "schtasks.exe" /Create /SC ONLOGON /TN RasManagement /TR "C:\Users\Admin\AppData\Local\Temp\MV_SPIDER_CAPRI_VESSEL_MAIN_PARTICULARS.exe" /RU "" /RL HIGHEST /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2132