agenttesla | 4d3921886e9f29681da48f378e792b39d307a1c3e39730993e60375b1007d87e

Analysis

Target
PI 2020721233.exe
Size 1.0MB
Sample200715-j2794qs68s
SHA256 4d3921886e9f29681da48f378e792b39d307a1c3e39730993e60375b1007d87e
MD5 6dd53f259450823e6b2831a7bf79189b
SHA1 3a1e709ac316535dc1cb65cd85925d8c22be6970
SHA512 eb8402d01cad05e06114e33b34d86c3a86c42d197b120ccdf370ff04cf046ab34c76d0fdc72a43f0e25e459218c36312973555d6a29f0e4c18ac835822b4865c
MD5 SHA1 SHA512

Score

10^/10

Family

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 2 IoCs

resource	yara_rule
behavioral2/memory/3700-1-0x00000000004479BE-mapping.dmp	family_agenttesla
behavioral2/memory/3700-0-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1628 set thread context of 3700	1628	PI 2020721233.exe	72

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3700	RegSvcs.exe
3700	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3700	RegSvcs.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1628 wrote to memory of 3700	1628	PI 2020721233.exe	72
PID 1628 wrote to memory of 3700	1628	PI 2020721233.exe	72
PID 1628 wrote to memory of 3700	1628	PI 2020721233.exe	72
PID 1628 wrote to memory of 3700	1628	PI 2020721233.exe	72
PID 1628 wrote to memory of 3700	1628	PI 2020721233.exe	72
PID 1628 wrote to memory of 3700	1628	PI 2020721233.exe	72
PID 1628 wrote to memory of 3700	1628	PI 2020721233.exe	72
PID 1628 wrote to memory of 3700	1628	PI 2020721233.exe	72

memory/3700-0-0x0000000000400000-0x000000000044C000-memory.dmp

Download