agenttesla | d18bcd6d166abe550a2633e07b2225dfaa97a7428eb1d3449b3d6b6db74e348a

Analysis

Target
2020 Repeat Order.PDF File.exe
Size 479KB
Sample200624-9s2bsxkhte
SHA256 d18bcd6d166abe550a2633e07b2225dfaa97a7428eb1d3449b3d6b6db74e348a
MD5 70a7859e9318d54b838234c0b213144c
SHA1 901e543592fa35d6f779976f4560564e4fbbda61
SHA512 74613b2c2acc307c16df80a5d7c790a51a96963e33f112e77183e60999b21daf56f680781958ef737099873a2c04bacb254545275224e33b466ab54e723c49dc
MD5 SHA1 SHA512

Score

10^/10

Family

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 2 IoCs

resource	yara_rule
behavioral2/memory/3896-0-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla
behavioral2/memory/3896-1-0x000000000044790E-mapping.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3932 set thread context of 3896	3932	2020 Repeat Order.PDF File.exe	68

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3896	RegAsm.exe
3896	RegAsm.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
3932	2020 Repeat Order.PDF File.exe
3932	2020 Repeat Order.PDF File.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3896	RegAsm.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3896	RegAsm.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3932 wrote to memory of 3184	3932	2020 Repeat Order.PDF File.exe	67
PID 3932 wrote to memory of 3184	3932	2020 Repeat Order.PDF File.exe	67
PID 3932 wrote to memory of 3184	3932	2020 Repeat Order.PDF File.exe	67
PID 3932 wrote to memory of 3896	3932	2020 Repeat Order.PDF File.exe	68
PID 3932 wrote to memory of 3896	3932	2020 Repeat Order.PDF File.exe	68
PID 3932 wrote to memory of 3896	3932	2020 Repeat Order.PDF File.exe	68
PID 3932 wrote to memory of 3896	3932	2020 Repeat Order.PDF File.exe	68

C:\Users\Admin\AppData\Local\Temp\2020 Repeat Order.PDF File.exe
"C:\Users\Admin\AppData\Local\Temp\2020 Repeat Order.PDF File.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3932
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:3184
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:3896

memory/3896-0-0x0000000000400000-0x000000000044C000-memory.dmp

Download