agenttesla | ab409eb4fbf6ed4db06f0e3b89d0001869ec46daa85b85b1237f72e6cfaadb6c

Analysis

Target
DHL_FORM-986753029PDF.exe
Size 778KB
Sample200706-mgw4nl22x2
SHA256 ab409eb4fbf6ed4db06f0e3b89d0001869ec46daa85b85b1237f72e6cfaadb6c
MD5 3d73e72f80d7846d02d3a81355cc6230
SHA1 b495bc49fe4b16d78cbe95b87a8ee07cd7e25a07
SHA512 fbfdd7b4b24341cd83fef8beb2edab0cbbed4dc0ac5ef20c62a3eba4d28afe607e3893d686a7cf0bac29a1baddd8cf6dc65b2db9684c163726d820de8de021af
MD5 SHA1 SHA512

Score

10^/10

Family

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 2 IoCs

resource	yara_rule
behavioral2/memory/1652-0-0x0000000000400000-0x0000000000452000-memory.dmp	family_agenttesla
behavioral2/memory/1652-1-0x000000000044C48E-mapping.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1300 set thread context of 1652	1300	DHL_FORM-986753029PDF.exe	69

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1652	RegAsm.exe
1652	RegAsm.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
1300	DHL_FORM-986753029PDF.exe
1300	DHL_FORM-986753029PDF.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1652	RegAsm.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1652	RegAsm.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1300 wrote to memory of 1592	1300	DHL_FORM-986753029PDF.exe	68
PID 1300 wrote to memory of 1592	1300	DHL_FORM-986753029PDF.exe	68
PID 1300 wrote to memory of 1592	1300	DHL_FORM-986753029PDF.exe	68
PID 1300 wrote to memory of 1652	1300	DHL_FORM-986753029PDF.exe	69
PID 1300 wrote to memory of 1652	1300	DHL_FORM-986753029PDF.exe	69
PID 1300 wrote to memory of 1652	1300	DHL_FORM-986753029PDF.exe	69
PID 1300 wrote to memory of 1652	1300	DHL_FORM-986753029PDF.exe	69
PID 1652 wrote to memory of 3960	1652	RegAsm.exe	75
PID 1652 wrote to memory of 3960	1652	RegAsm.exe	75
PID 1652 wrote to memory of 3960	1652	RegAsm.exe	75

C:\Users\Admin\AppData\Local\Temp\DHL_FORM-986753029PDF.exe
"C:\Users\Admin\AppData\Local\Temp\DHL_FORM-986753029PDF.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1300
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:1592
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1652
- - C:\Windows\SysWOW64\netsh.exe
    "netsh" wlan show profile
    3⤵
    PID:3960

memory/1652-0-0x0000000000400000-0x0000000000452000-memory.dmp

Download