agenttesla | e1ff434ecce0bc608bbbb204def5a11548e2b0e9105979d9b6c01486d7768e5c

Analysis

Target
invoice.exe
Size 503KB
Sample201109-4pnsdtleme
SHA256 e1ff434ecce0bc608bbbb204def5a11548e2b0e9105979d9b6c01486d7768e5c
MD5 4ffda8f0413d83e3d3f0f4badbf00656
SHA1 cc655f1bad0b1174beca6fbd672854e1882a8ca6
SHA512 5ef118407813e4a4427474905fb6496d1d3e2d0acd8d63e74acc67afbbe6431753d2b7dff221fcc8f1be5341d328cb1c4543cec4f239c7f720f17762f69eabd9
MD5 SHA1 SHA512

Score

10^/10

Credentials

Family

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 2 IoCs

resource	yara_rule
behavioral2/memory/1892-1-0x000000000044A98E-mapping.dmp	family_agenttesla
behavioral2/memory/1892-0-0x0000000000400000-0x0000000000450000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1036 set thread context of 1892	1036	invoice.exe	76

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1892	RegSvcs.exe
1892	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1892	RegSvcs.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1036 wrote to memory of 1892	1036	invoice.exe	76
PID 1036 wrote to memory of 1892	1036	invoice.exe	76
PID 1036 wrote to memory of 1892	1036	invoice.exe	76
PID 1036 wrote to memory of 1892	1036	invoice.exe	76
PID 1036 wrote to memory of 1892	1036	invoice.exe	76
PID 1036 wrote to memory of 1892	1036	invoice.exe	76
PID 1036 wrote to memory of 1892	1036	invoice.exe	76
PID 1036 wrote to memory of 1892	1036	invoice.exe	76
PID 1892 wrote to memory of 800	1892	RegSvcs.exe	81
PID 1892 wrote to memory of 800	1892	RegSvcs.exe	81
PID 1892 wrote to memory of 800	1892	RegSvcs.exe	81

memory/1892-0-0x0000000000400000-0x0000000000450000-memory.dmp

Download