agenttesla | 1e52eae0d858b4fcdd21d5ffcc013da8706adda92afbb791e704556362b8f19c

Analysis

Target
gunzipped.exe
Size 2.0MB
Sample201109-6mda5mb3ca
SHA256 1e52eae0d858b4fcdd21d5ffcc013da8706adda92afbb791e704556362b8f19c
MD5 f1f7dc383acfd74d4db8a7fcb8a244ea
SHA1 dd367a419d891ee337e610a6a64cbd7cd54862b3
SHA512 74c8ce86f12caf64960df1189b1183552f2bb55c1f33f87aed29ff52fdd90e4b9cf35efa1fc31407d01ec95e5ea80eeba804ceb6d56654027000b1deb5eaf236
MD5 SHA1 SHA512

Score

10^/10

Credentials

Family

Credentials

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 2 IoCs

resource	yara_rule
behavioral2/memory/4204-1-0x0000000000400000-0x0000000000452000-memory.dmp	family_agenttesla
behavioral2/memory/4204-2-0x000000000044CC5E-mapping.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4768 set thread context of 4204	4768	gunzipped.exe	79

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4204	MSBuild.exe
4204	MSBuild.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
4768	gunzipped.exe
4768	gunzipped.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4204	MSBuild.exe

Suspicious use of FindShellTrayWindow 3 IoCs

Suspicious use of SendNotifyMessage 3 IoCs

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4768 wrote to memory of 4188	4768	gunzipped.exe	78
PID 4768 wrote to memory of 4188	4768	gunzipped.exe	78
PID 4768 wrote to memory of 4188	4768	gunzipped.exe	78
PID 4768 wrote to memory of 4204	4768	gunzipped.exe	79
PID 4768 wrote to memory of 4204	4768	gunzipped.exe	79
PID 4768 wrote to memory of 4204	4768	gunzipped.exe	79
PID 4768 wrote to memory of 4204	4768	gunzipped.exe	79
PID 4204 wrote to memory of 808	4204	MSBuild.exe	80
PID 4204 wrote to memory of 808	4204	MSBuild.exe	80
PID 4204 wrote to memory of 808	4204	MSBuild.exe	80

C:\Users\Admin\AppData\Local\Temp\gunzipped.exe
"C:\Users\Admin\AppData\Local\Temp\gunzipped.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4768
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
  "C:\\\\Windows\\\\Microsoft.NET\\\\Framework\\\\v2.0.50727\\\\MSBuild.exe"
  2⤵
  PID:4188
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
  "C:\\\\Windows\\\\Microsoft.NET\\\\Framework\\\\v2.0.50727\\\\MSBuild.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4204
- - C:\Windows\SysWOW64\netsh.exe
    "netsh" wlan show profile
    3⤵
    PID:808

memory/4204-1-0x0000000000400000-0x0000000000452000-memory.dmp

Download