agenttesla | 973eafd7f0c78c4ba4e0c692881d82feb75679e7704cc4e077c0d48851032c55

Analysis

Target
Order.exe
Size 550KB
Sample200707-t8b8mehetx
SHA256 973eafd7f0c78c4ba4e0c692881d82feb75679e7704cc4e077c0d48851032c55
MD5 3badfd574a87a4131b77a702be0dd919
SHA1 48ca2366912f4d461b71228efac1cdf3fae2b8e3
SHA512 397239b5cd59a37cf540feca76c9938068b7e8db85e26ec7626ec53dd4e0901faaecdbe1eb52d33e21ee8514d8e810338aa92f275b16c3e9d29e66114f5050df
MD5 SHA1 SHA512

Score

10^/10

Family

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 2 IoCs

resource	yara_rule
behavioral2/memory/3816-0-0x0000000000400000-0x0000000000450000-memory.dmp	family_agenttesla
behavioral2/memory/3816-1-0x000000000044A73E-mapping.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3496 set thread context of 3816	3496	Order.exe	67

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3816	MSBuild.exe
3816	MSBuild.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3816	MSBuild.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3496 wrote to memory of 3816	3496	Order.exe	67
PID 3496 wrote to memory of 3816	3496	Order.exe	67
PID 3496 wrote to memory of 3816	3496	Order.exe	67
PID 3496 wrote to memory of 3816	3496	Order.exe	67
PID 3496 wrote to memory of 3816	3496	Order.exe	67
PID 3496 wrote to memory of 3816	3496	Order.exe	67
PID 3496 wrote to memory of 3816	3496	Order.exe	67
PID 3496 wrote to memory of 3816	3496	Order.exe	67

memory/3816-0-0x0000000000400000-0x0000000000450000-memory.dmp

Download