agenttesla | 75ce329091d54aa2fcf6cd6f58704493e0f4ac878279c49db239140051341931

Analysis

Target

Candidate_list.exe
Size

331KB
MD5

db1cba646f5432bc3e528e9d67f9fc01
SHA1

0f5d941c986623b79484fdde2ce0d8f278163956
SHA256

75ce329091d54aa2fcf6cd6f58704493e0f4ac878279c49db239140051341931
SHA512

9a51cb0c4e1d9803cbc38f816d44a3ddb8d0f74a7d84a27465f94242e1a2cf926abd8b7a8048e9ced176c0a855a770daee6d89c128e88d49626413b866c6ee90

Score

10^/10

Family

agenttesla

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 4 IoCs

resource	yara_rule
behavioral1/memory/1476-2-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla
behavioral1/memory/1476-3-0x000000000044706E-mapping.dmp	family_agenttesla
behavioral1/memory/1476-4-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla
behavioral1/memory/1476-5-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1104 set thread context of 1476	1104	Candidate_list.exe	24

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1476	RegSvcs.exe
1476	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1476	RegSvcs.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1104 wrote to memory of 1476	1104	Candidate_list.exe	24
PID 1104 wrote to memory of 1476	1104	Candidate_list.exe	24
PID 1104 wrote to memory of 1476	1104	Candidate_list.exe	24
PID 1104 wrote to memory of 1476	1104	Candidate_list.exe	24
PID 1104 wrote to memory of 1476	1104	Candidate_list.exe	24
PID 1104 wrote to memory of 1476	1104	Candidate_list.exe	24
PID 1104 wrote to memory of 1476	1104	Candidate_list.exe	24
PID 1104 wrote to memory of 1476	1104	Candidate_list.exe	24
PID 1104 wrote to memory of 1476	1104	Candidate_list.exe	24
PID 1104 wrote to memory of 1476	1104	Candidate_list.exe	24
PID 1104 wrote to memory of 1476	1104	Candidate_list.exe	24
PID 1104 wrote to memory of 1476	1104	Candidate_list.exe	24

memory/1476-2-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1476-4-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1476-5-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download