agenttesla | 2adc69f66c9ac282f200d7c46fe662ec89f113abd5b4bc77f5094c2b3dbddb47

General

Target

SWIFT COPY.exe
Size

486KB
MD5

cff428da8480fae5a9715be28a7a2d26
SHA1

df5ebf17af3c084a6b760bedcf9631671251aff2
SHA256

2adc69f66c9ac282f200d7c46fe662ec89f113abd5b4bc77f5094c2b3dbddb47
SHA512

2ed52511dba9de589525ef23e08234b2b607985ad7708a03489ae3e21c1183fd75b866899f677b630c281932b24a77117eb700a868b70ceea5ad7c2e6d845e6e

Score

10^/10

Family

agenttesla

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1200-4-0x0000000000400000-0x0000000000452000-memory.dmp	family_agenttesla
behavioral1/memory/1200-5-0x000000000044C52E-mapping.dmp	family_agenttesla
behavioral1/memory/1200-6-0x0000000000400000-0x0000000000452000-memory.dmp	family_agenttesla
behavioral1/memory/1200-7-0x0000000000400000-0x0000000000452000-memory.dmp	family_agenttesla

Drops startup file 1 IoCs

Processes:

SWIFT COPY.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HJdyTuap.exe SWIFT COPY.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

SWIFT COPY.exe

description pid process target process

PID 288 set thread context of 1200 288 SWIFT COPY.exe RegAsm.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

RegAsm.exe

pid process

1200 RegAsm.exe
1200 RegAsm.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

SWIFT COPY.exe

pid process

288 SWIFT COPY.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RegAsm.exe

description pid process

Token: SeDebugPrivilege 1200 RegAsm.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HJdyTuap.exe	SWIFT COPY.exe

description	pid	process	target process
PID 288 set thread context of 1200	288	SWIFT COPY.exe	RegAsm.exe

pid	process
1200	RegAsm.exe
1200	RegAsm.exe

pid	process
288	SWIFT COPY.exe

description	pid	process
Token: SeDebugPrivilege	1200	RegAsm.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

SWIFT COPY.exeRegAsm.exe

description	pid	process	target process
PID 288 wrote to memory of 1200	288	SWIFT COPY.exe	RegAsm.exe
PID 288 wrote to memory of 1200	288	SWIFT COPY.exe	RegAsm.exe
PID 288 wrote to memory of 1200	288	SWIFT COPY.exe	RegAsm.exe
PID 288 wrote to memory of 1200	288	SWIFT COPY.exe	RegAsm.exe
PID 288 wrote to memory of 1200	288	SWIFT COPY.exe	RegAsm.exe
PID 288 wrote to memory of 1200	288	SWIFT COPY.exe	RegAsm.exe
PID 288 wrote to memory of 1200	288	SWIFT COPY.exe	RegAsm.exe
PID 288 wrote to memory of 1200	288	SWIFT COPY.exe	RegAsm.exe
PID 1200 wrote to memory of 1640	1200	RegAsm.exe	netsh.exe
PID 1200 wrote to memory of 1640	1200	RegAsm.exe	netsh.exe
PID 1200 wrote to memory of 1640	1200	RegAsm.exe	netsh.exe
PID 1200 wrote to memory of 1640	1200	RegAsm.exe	netsh.exe

memory/288-0-0x00000000740B0000-0x000000007479E000-memory.dmp

Filesize
6.9MB

Download
memory/288-1-0x0000000000FA0000-0x0000000000FA1000-memory.dmp

Filesize
4KB

Download
memory/288-3-0x0000000000310000-0x0000000000364000-memory.dmp

Filesize
336KB

Download
memory/1200-4-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/1200-5-0x000000000044C52E-mapping.dmp

Download
memory/1200-6-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/1200-7-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/1200-8-0x00000000737F0000-0x0000000073EDE000-memory.dmp

Filesize
6.9MB

Download
memory/1640-11-0x0000000000000000-mapping.dmp

Download