agenttesla | 576ad625aa5f0da23353269fd85938a85d0e1a723c2cbe4d05b8a43ba301930e

Analysis

Target
Maxim Contract-PO20200313.exe
Size 533KB
Sample200624-c81m57mpks
SHA256 576ad625aa5f0da23353269fd85938a85d0e1a723c2cbe4d05b8a43ba301930e
MD5 44583d81b074cf767f0d8cce2d29d718
SHA1 7848b1dd279c9c758e749b94dfd1ab7a10eec46a
SHA512 f7feeadf97167efd5258178da3d7f6cfd63490129cdd7b463b3d19ffb2f9e4c53e71d3c79b071965f1d1f8b34eb74627e801b4ef1442fea392489f64f9c96569
MD5 SHA1 SHA512

Score

10^/10

Credentials

Family

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 2 IoCs

resource	yara_rule
behavioral2/memory/2600-0-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla
behavioral2/memory/2600-1-0x000000000044692E-mapping.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 428 set thread context of 2600	428	Maxim Contract-PO20200313.exe	72

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2600	MSBuild.exe
2600	MSBuild.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2600	MSBuild.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 428 wrote to memory of 2600	428	Maxim Contract-PO20200313.exe	72
PID 428 wrote to memory of 2600	428	Maxim Contract-PO20200313.exe	72
PID 428 wrote to memory of 2600	428	Maxim Contract-PO20200313.exe	72
PID 428 wrote to memory of 2600	428	Maxim Contract-PO20200313.exe	72
PID 428 wrote to memory of 2600	428	Maxim Contract-PO20200313.exe	72
PID 428 wrote to memory of 2600	428	Maxim Contract-PO20200313.exe	72
PID 428 wrote to memory of 2600	428	Maxim Contract-PO20200313.exe	72
PID 428 wrote to memory of 2600	428	Maxim Contract-PO20200313.exe	72

memory/2600-0-0x0000000000400000-0x000000000044C000-memory.dmp

Download