agenttesla | 84fbfaff31bef0f0bdb851ab257a25e9b65e10ceaa1b7c93a0e3b9fbafcc8d41

Analysis

Target
sk4Ml.exe
Size 1.4MB
Sample201109-7276f938vx
SHA256 84fbfaff31bef0f0bdb851ab257a25e9b65e10ceaa1b7c93a0e3b9fbafcc8d41
MD5 c78facb28580ecc5a518b8dabec5fc41
SHA1 f95157dfe8964f44d108cd2f1f1f19fea4a2da44
SHA512 09c6c928f469d211a7ee2f769f94709de0ae7df8fbe20f4bf6da645d7a75d08a2672a24c8ea2b29e703f43ec7764387831490195d6225cf35d208f4aa69e982a
MD5 SHA1 SHA512

Score

10^/10

Credentials

Family

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 2 IoCs

resource	yara_rule
behavioral2/memory/1888-1-0x000000000087C3FE-mapping.dmp	family_agenttesla
behavioral2/memory/1888-0-0x0000000000830000-0x0000000000882000-memory.dmp	family_agenttesla

Drops startup file 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HOSTNAME.url	sk4Ml.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1112 set thread context of 1888	1112	sk4Ml.exe	79

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1888	MSBuild.exe
1888	MSBuild.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1888	MSBuild.exe

Suspicious use of FindShellTrayWindow 3 IoCs

Suspicious use of SendNotifyMessage 3 IoCs

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1112 wrote to memory of 1888	1112	sk4Ml.exe	79
PID 1112 wrote to memory of 1888	1112	sk4Ml.exe	79
PID 1112 wrote to memory of 1888	1112	sk4Ml.exe	79
PID 1112 wrote to memory of 1888	1112	sk4Ml.exe	79
PID 1112 wrote to memory of 1888	1112	sk4Ml.exe	79
PID 1888 wrote to memory of 512	1888	MSBuild.exe	82
PID 1888 wrote to memory of 512	1888	MSBuild.exe	82
PID 1888 wrote to memory of 512	1888	MSBuild.exe	82

memory/1888-0-0x0000000000830000-0x0000000000882000-memory.dmp

Download