agenttesla | 03ffe4f20fb755df6d624c00fa8146eb3870b55fa5356d25b50ebfc197f7ade4

General

Target

Scan 0007052020.exe
Size

520KB
MD5

06d49c3d910b149dc1f89341b0209c7e
SHA1

eee501121dd58f5e9e837a346436eedd89719ccf
SHA256

03ffe4f20fb755df6d624c00fa8146eb3870b55fa5356d25b50ebfc197f7ade4
SHA512

e8041f5f462e14e4a004fe353582e90231be9b05a6d6ec7a32ec73602d849db3d1d2f4be1409970144a1dfe1475a16d7b4f2cf9fbe16a86e30754b0675fa92dd

Score

10^/10

Family

agenttesla

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/472-116-0x0000000000449FCE-mapping.dmp	family_agenttesla
behavioral1/memory/472-115-0x0000000000400000-0x000000000044E000-memory.dmp	family_agenttesla
behavioral1/memory/472-118-0x0000000000400000-0x000000000044E000-memory.dmp	family_agenttesla
behavioral1/memory/472-117-0x0000000000400000-0x000000000044E000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

Processes:

Scan 0007052020.exe

description pid process target process

PID 1664 set thread context of 472 1664 Scan 0007052020.exe RegSvcs.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

RegSvcs.exe

pid process

472 RegSvcs.exe
472 RegSvcs.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Scan 0007052020.exeRegSvcs.exe

description pid process

Token: SeDebugPrivilege 1664 Scan 0007052020.exe
Token: SeDebugPrivilege 472 RegSvcs.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

Scan 0007052020.exe

pid process

1664 Scan 0007052020.exe
1664 Scan 0007052020.exe

description	pid	process	target process
PID 1664 set thread context of 472	1664	Scan 0007052020.exe	RegSvcs.exe

pid	process
472	RegSvcs.exe
472	RegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	1664	Scan 0007052020.exe
Token: SeDebugPrivilege	472	RegSvcs.exe

pid	process
1664	Scan 0007052020.exe
1664	Scan 0007052020.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

Scan 0007052020.exe

description	pid	process	target process
PID 1664 wrote to memory of 472	1664	Scan 0007052020.exe	RegSvcs.exe
PID 1664 wrote to memory of 472	1664	Scan 0007052020.exe	RegSvcs.exe
PID 1664 wrote to memory of 472	1664	Scan 0007052020.exe	RegSvcs.exe
PID 1664 wrote to memory of 472	1664	Scan 0007052020.exe	RegSvcs.exe
PID 1664 wrote to memory of 472	1664	Scan 0007052020.exe	RegSvcs.exe
PID 1664 wrote to memory of 472	1664	Scan 0007052020.exe	RegSvcs.exe
PID 1664 wrote to memory of 472	1664	Scan 0007052020.exe	RegSvcs.exe
PID 1664 wrote to memory of 472	1664	Scan 0007052020.exe	RegSvcs.exe
PID 1664 wrote to memory of 472	1664	Scan 0007052020.exe	RegSvcs.exe
PID 1664 wrote to memory of 472	1664	Scan 0007052020.exe	RegSvcs.exe
PID 1664 wrote to memory of 472	1664	Scan 0007052020.exe	RegSvcs.exe
PID 1664 wrote to memory of 472	1664	Scan 0007052020.exe	RegSvcs.exe

memory/472-116-0x0000000000449FCE-mapping.dmp

Download
memory/472-115-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/472-118-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/472-117-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/576-114-0x000007FEF6F80000-0x000007FEF71FA000-memory.dmp

Filesize
2.5MB

Download