agenttesla | 9194eb682aa76595baf70a6a39240ddd40e1f0fa81aab34c88a70c356f155663

General

Target

PO.exe
Size

1.5MB
MD5

d2b155d39ab9ac0a58e4318c776483aa
SHA1

b6e0a0e790f7224a1634dc6109c79823236d6e5a
SHA256

9194eb682aa76595baf70a6a39240ddd40e1f0fa81aab34c88a70c356f155663
SHA512

357a8263843f3a5d0f9296de48f5bc338809093085db65f2d6b60f70a114c680133ad2822b24c4ba18ec82cb33421064dcbc5e74f6e46eb585a37399038ee0fa

Score

10^/10

Family

agenttesla

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1424-5-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1424-6-0x00000000004374BE-mapping.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

Processes:

PO.exe

description pid process target process

PID 1812 set thread context of 1424 1812 PO.exe PO.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

PO.exePO.exe

pid process

1812 PO.exe
1812 PO.exe
1424 PO.exe
1424 PO.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

PO.exePO.exe

description pid process

Token: SeDebugPrivilege 1812 PO.exe
Token: SeDebugPrivilege 1424 PO.exe

description	pid	process	target process
PID 1812 set thread context of 1424	1812	PO.exe	PO.exe

description	pid	process
Token: SeDebugPrivilege	1812	PO.exe
Token: SeDebugPrivilege	1424	PO.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

PO.exePO.exe

description	pid	process	target process
PID 1812 wrote to memory of 1424	1812	PO.exe	PO.exe
PID 1812 wrote to memory of 1424	1812	PO.exe	PO.exe
PID 1812 wrote to memory of 1424	1812	PO.exe	PO.exe
PID 1812 wrote to memory of 1424	1812	PO.exe	PO.exe
PID 1812 wrote to memory of 1424	1812	PO.exe	PO.exe
PID 1812 wrote to memory of 1424	1812	PO.exe	PO.exe
PID 1812 wrote to memory of 1424	1812	PO.exe	PO.exe
PID 1812 wrote to memory of 1424	1812	PO.exe	PO.exe
PID 1812 wrote to memory of 1424	1812	PO.exe	PO.exe
PID 1424 wrote to memory of 112	1424	PO.exe	dw20.exe
PID 1424 wrote to memory of 112	1424	PO.exe	dw20.exe
PID 1424 wrote to memory of 112	1424	PO.exe	dw20.exe
PID 1424 wrote to memory of 112	1424	PO.exe	dw20.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 520
3⤵
PID:112

memory/112-9-0x0000000000000000-mapping.dmp

Download
memory/112-10-0x0000000001D50000-0x0000000001D61000-memory.dmp

Filesize
68KB

Download
memory/112-13-0x0000000000370000-0x0000000000371000-memory.dmp

Filesize
4KB

Download
memory/1424-5-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1424-6-0x00000000004374BE-mapping.dmp

Download
memory/1424-8-0x00000000020E0000-0x00000000020E1000-memory.dmp

Filesize
4KB

Download
memory/1812-2-0x0000000076241000-0x0000000076243000-memory.dmp

Filesize
8KB

Download
memory/1812-3-0x0000000000810000-0x0000000000811000-memory.dmp

Filesize
4KB

Download
memory/1812-4-0x0000000000811000-0x0000000000812000-memory.dmp

Filesize
4KB

Download