agenttesla | 970db37b1b904855cd21d80818893f3b1d739dd9ecaaf8a38237c07e0d455d8c

General

Target

RFQ SC0054852_PDF.exe
Size

409KB
MD5

93458cfe349ae4b59a0703d3a62160b9
SHA1

37e01a736df3d2cab4a51412e92df46e7aa18bfa
SHA256

970db37b1b904855cd21d80818893f3b1d739dd9ecaaf8a38237c07e0d455d8c
SHA512

61ae9ba6e4858095b284947831011a4246909e33f6730dab6b9c441c13bcc086389e82e7d8a9e0bce4d9358864f0b12a2b3daaabe3fe4a7e7d42bf6ff5950cf2

Score

10^/10

Family

agenttesla

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1448-3-0x0000000000446F7E-mapping.dmp	family_agenttesla
behavioral1/memory/1448-2-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla
behavioral1/memory/1448-4-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla
behavioral1/memory/1448-5-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

Processes:

RFQ SC0054852_PDF.exe

description pid process target process

PID 1124 set thread context of 1448 1124 RFQ SC0054852_PDF.exe RegSvcs.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

RegSvcs.exe

pid process

1448 RegSvcs.exe
1448 RegSvcs.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RegSvcs.exe

description pid process

Token: SeDebugPrivilege 1448 RegSvcs.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

RegSvcs.exe

pid process

1448 RegSvcs.exe

description	pid	process	target process
PID 1124 set thread context of 1448	1124	RFQ SC0054852_PDF.exe	RegSvcs.exe

pid	process
1448	RegSvcs.exe
1448	RegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	1448	RegSvcs.exe

pid	process
1448	RegSvcs.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

RFQ SC0054852_PDF.exe

description	pid	process	target process
PID 1124 wrote to memory of 1448	1124	RFQ SC0054852_PDF.exe	RegSvcs.exe
PID 1124 wrote to memory of 1448	1124	RFQ SC0054852_PDF.exe	RegSvcs.exe
PID 1124 wrote to memory of 1448	1124	RFQ SC0054852_PDF.exe	RegSvcs.exe
PID 1124 wrote to memory of 1448	1124	RFQ SC0054852_PDF.exe	RegSvcs.exe
PID 1124 wrote to memory of 1448	1124	RFQ SC0054852_PDF.exe	RegSvcs.exe
PID 1124 wrote to memory of 1448	1124	RFQ SC0054852_PDF.exe	RegSvcs.exe
PID 1124 wrote to memory of 1448	1124	RFQ SC0054852_PDF.exe	RegSvcs.exe
PID 1124 wrote to memory of 1448	1124	RFQ SC0054852_PDF.exe	RegSvcs.exe
PID 1124 wrote to memory of 1448	1124	RFQ SC0054852_PDF.exe	RegSvcs.exe
PID 1124 wrote to memory of 1448	1124	RFQ SC0054852_PDF.exe	RegSvcs.exe
PID 1124 wrote to memory of 1448	1124	RFQ SC0054852_PDF.exe	RegSvcs.exe
PID 1124 wrote to memory of 1448	1124	RFQ SC0054852_PDF.exe	RegSvcs.exe

memory/1124-1-0x0000000000000000-0x0000000000000000-disk.dmp

Download
memory/1448-3-0x0000000000446F7E-mapping.dmp

Download
memory/1448-2-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1448-4-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1448-5-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download