agenttesla | 0f79f1474853b064ba7a5b967965ada4dc58c593bf82da850959f6eb7bd8f9ca

Analysis

Target
remittance copy.exe
Size 1.5MB
Sample201109-vbfdz8gn5n
SHA256 0f79f1474853b064ba7a5b967965ada4dc58c593bf82da850959f6eb7bd8f9ca
MD5 8f26c626244fa00091032000105e2128
SHA1 7c484c43c873cd6a90fe9eb5d0fb45c28d1e0f7c
SHA512 f0d8acdf206209fb4982b93859649bc09a37f8349d0cd1c0475874422b9cf7b75d71e89aeb2ebe380e5374e2c76803e09255b8257917365c78fb9f284fef73d3
MD5 SHA1 SHA512

Score

10^/10

Family

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 2 IoCs

resource	yara_rule
behavioral2/memory/3584-0-0x0000000000500000-0x000000000054C000-memory.dmp	family_agenttesla
behavioral2/memory/3584-1-0x000000000054793E-mapping.dmp	family_agenttesla

Drops startup file 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LegacyNetUXHost.url	remittance copy.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3372 set thread context of 3584	3372	remittance copy.exe	75

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3584	MSBuild.exe
3584	MSBuild.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3584	MSBuild.exe

Suspicious use of FindShellTrayWindow 3 IoCs

Suspicious use of SendNotifyMessage 3 IoCs

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3372 wrote to memory of 3584	3372	remittance copy.exe	75
PID 3372 wrote to memory of 3584	3372	remittance copy.exe	75
PID 3372 wrote to memory of 3584	3372	remittance copy.exe	75
PID 3372 wrote to memory of 3584	3372	remittance copy.exe	75
PID 3372 wrote to memory of 3584	3372	remittance copy.exe	75

memory/3584-0-0x0000000000500000-0x000000000054C000-memory.dmp

Download