agenttesla | 973eafd7f0c78c4ba4e0c692881d82feb75679e7704cc4e077c0d48851032c55

Analysis

Target

Order.exe
Size

550KB
MD5

3badfd574a87a4131b77a702be0dd919
SHA1

48ca2366912f4d461b71228efac1cdf3fae2b8e3
SHA256

973eafd7f0c78c4ba4e0c692881d82feb75679e7704cc4e077c0d48851032c55
SHA512

397239b5cd59a37cf540feca76c9938068b7e8db85e26ec7626ec53dd4e0901faaecdbe1eb52d33e21ee8514d8e810338aa92f275b16c3e9d29e66114f5050df

Score

10^/10

Family

agenttesla

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 4 IoCs

resource	yara_rule
behavioral1/memory/836-0-0x0000000000400000-0x0000000000450000-memory.dmp	family_agenttesla
behavioral1/memory/836-1-0x000000000044A73E-mapping.dmp	family_agenttesla
behavioral1/memory/836-2-0x0000000000400000-0x0000000000450000-memory.dmp	family_agenttesla
behavioral1/memory/836-3-0x0000000000400000-0x0000000000450000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1388 set thread context of 836	1388	Order.exe	24

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
836	MSBuild.exe
836	MSBuild.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	836	MSBuild.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1388 wrote to memory of 836	1388	Order.exe	24
PID 1388 wrote to memory of 836	1388	Order.exe	24
PID 1388 wrote to memory of 836	1388	Order.exe	24
PID 1388 wrote to memory of 836	1388	Order.exe	24
PID 1388 wrote to memory of 836	1388	Order.exe	24
PID 1388 wrote to memory of 836	1388	Order.exe	24
PID 1388 wrote to memory of 836	1388	Order.exe	24
PID 1388 wrote to memory of 836	1388	Order.exe	24
PID 1388 wrote to memory of 836	1388	Order.exe	24

memory/836-0-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/836-2-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/836-3-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download