agenttesla | 7e91bd9c26986e7437f8dc154a39978a042f8f1240067c907e8f49b791d3dc07

General

Target

DINTEC Order List 14012021.exe
Size

673KB
MD5

f49113b2bfcd362479248c011aedad15
SHA1

730d2f07cc7f0634b9aa24b0d64f75a57fe1b45e
SHA256

7e91bd9c26986e7437f8dc154a39978a042f8f1240067c907e8f49b791d3dc07
SHA512

daefa7258a37269d14a80493ceed25aeafb74a3fd03b5722dbfdc9ae22d09f691b8599d4d06bd53b0e50edb8ad55796b7640e7c1710297a3e70df62dac48685e

Score

10^/10

Family

agenttesla

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1524-7-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1524-8-0x000000000043752E-mapping.dmp	family_agenttesla
behavioral1/memory/1524-9-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1524-10-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

Processes:

DINTEC Order List 14012021.exe

description pid process target process

PID 476 set thread context of 1524 476 DINTEC Order List 14012021.exe RegSvcs.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

RegSvcs.exe

pid process

1524 RegSvcs.exe
1524 RegSvcs.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RegSvcs.exe

description pid process

Token: SeDebugPrivilege 1524 RegSvcs.exe

description	pid	process	target process
PID 476 set thread context of 1524	476	DINTEC Order List 14012021.exe	RegSvcs.exe

pid	process
1524	RegSvcs.exe
1524	RegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	1524	RegSvcs.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

DINTEC Order List 14012021.exe

description	pid	process	target process
PID 476 wrote to memory of 1524	476	DINTEC Order List 14012021.exe	RegSvcs.exe
PID 476 wrote to memory of 1524	476	DINTEC Order List 14012021.exe	RegSvcs.exe
PID 476 wrote to memory of 1524	476	DINTEC Order List 14012021.exe	RegSvcs.exe
PID 476 wrote to memory of 1524	476	DINTEC Order List 14012021.exe	RegSvcs.exe
PID 476 wrote to memory of 1524	476	DINTEC Order List 14012021.exe	RegSvcs.exe
PID 476 wrote to memory of 1524	476	DINTEC Order List 14012021.exe	RegSvcs.exe
PID 476 wrote to memory of 1524	476	DINTEC Order List 14012021.exe	RegSvcs.exe
PID 476 wrote to memory of 1524	476	DINTEC Order List 14012021.exe	RegSvcs.exe
PID 476 wrote to memory of 1524	476	DINTEC Order List 14012021.exe	RegSvcs.exe
PID 476 wrote to memory of 1524	476	DINTEC Order List 14012021.exe	RegSvcs.exe
PID 476 wrote to memory of 1524	476	DINTEC Order List 14012021.exe	RegSvcs.exe
PID 476 wrote to memory of 1524	476	DINTEC Order List 14012021.exe	RegSvcs.exe

memory/476-2-0x0000000073F20000-0x000000007460E000-memory.dmp

Filesize
6.9MB

Download
memory/476-3-0x0000000000390000-0x0000000000391000-memory.dmp

Filesize
4KB

Download
memory/476-5-0x0000000000310000-0x000000000031E000-memory.dmp

Filesize
56KB

Download
memory/476-6-0x0000000005460000-0x00000000054F9000-memory.dmp

Filesize
612KB

Download
memory/1524-7-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1524-8-0x000000000043752E-mapping.dmp

Download
memory/1524-9-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1524-10-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1524-11-0x0000000073F20000-0x000000007460E000-memory.dmp

Filesize
6.9MB

Download