agenttesla | 8392af9cff73aab10a60befd359d4ca2638d6a936071285579147303bb453497

General

Target

OCXQZK3KWmWNdRx.exe
Size

803KB
MD5

c6286c765c37478223b99c6ab0dc96f5
SHA1

eb043c7435526162e7e3a85005421fba3c1f3618
SHA256

8392af9cff73aab10a60befd359d4ca2638d6a936071285579147303bb453497
SHA512

04bfd49be5af17080f7fed1b28e665aa8a76e637589a3a0e4d846c79c79bfb56d78508898d2181b928e7483d7b4489f19831c58dea29ef0997d48b772da384e4

Score

10^/10

Family

agenttesla

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1668-8-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1668-9-0x00000000004374DE-mapping.dmp	family_agenttesla
behavioral1/memory/1668-11-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

Processes:

OCXQZK3KWmWNdRx.exe

description pid process target process

PID 1336 set thread context of 1668 1336 OCXQZK3KWmWNdRx.exe OCXQZK3KWmWNdRx.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

OCXQZK3KWmWNdRx.exeOCXQZK3KWmWNdRx.exe

pid process

1336 OCXQZK3KWmWNdRx.exe
1336 OCXQZK3KWmWNdRx.exe
1668 OCXQZK3KWmWNdRx.exe
1668 OCXQZK3KWmWNdRx.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

OCXQZK3KWmWNdRx.exeOCXQZK3KWmWNdRx.exe

description pid process

Token: SeDebugPrivilege 1336 OCXQZK3KWmWNdRx.exe
Token: SeDebugPrivilege 1668 OCXQZK3KWmWNdRx.exe

description	pid	process	target process
PID 1336 set thread context of 1668	1336	OCXQZK3KWmWNdRx.exe	OCXQZK3KWmWNdRx.exe

description	pid	process
Token: SeDebugPrivilege	1336	OCXQZK3KWmWNdRx.exe
Token: SeDebugPrivilege	1668	OCXQZK3KWmWNdRx.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

OCXQZK3KWmWNdRx.exe

description	pid	process	target process
PID 1336 wrote to memory of 1716	1336	OCXQZK3KWmWNdRx.exe	OCXQZK3KWmWNdRx.exe
PID 1336 wrote to memory of 1716	1336	OCXQZK3KWmWNdRx.exe	OCXQZK3KWmWNdRx.exe
PID 1336 wrote to memory of 1716	1336	OCXQZK3KWmWNdRx.exe	OCXQZK3KWmWNdRx.exe
PID 1336 wrote to memory of 1716	1336	OCXQZK3KWmWNdRx.exe	OCXQZK3KWmWNdRx.exe
PID 1336 wrote to memory of 1668	1336	OCXQZK3KWmWNdRx.exe	OCXQZK3KWmWNdRx.exe
PID 1336 wrote to memory of 1668	1336	OCXQZK3KWmWNdRx.exe	OCXQZK3KWmWNdRx.exe
PID 1336 wrote to memory of 1668	1336	OCXQZK3KWmWNdRx.exe	OCXQZK3KWmWNdRx.exe
PID 1336 wrote to memory of 1668	1336	OCXQZK3KWmWNdRx.exe	OCXQZK3KWmWNdRx.exe
PID 1336 wrote to memory of 1668	1336	OCXQZK3KWmWNdRx.exe	OCXQZK3KWmWNdRx.exe
PID 1336 wrote to memory of 1668	1336	OCXQZK3KWmWNdRx.exe	OCXQZK3KWmWNdRx.exe
PID 1336 wrote to memory of 1668	1336	OCXQZK3KWmWNdRx.exe	OCXQZK3KWmWNdRx.exe
PID 1336 wrote to memory of 1668	1336	OCXQZK3KWmWNdRx.exe	OCXQZK3KWmWNdRx.exe
PID 1336 wrote to memory of 1668	1336	OCXQZK3KWmWNdRx.exe	OCXQZK3KWmWNdRx.exe

C:\Users\Admin\AppData\Local\Temp\OCXQZK3KWmWNdRx.exe
"C:\Users\Admin\AppData\Local\Temp\OCXQZK3KWmWNdRx.exe"
2⤵
PID:1716

memory/1336-2-0x0000000073980000-0x000000007406E000-memory.dmp

Filesize
6.9MB

Download
memory/1336-3-0x0000000000810000-0x0000000000811000-memory.dmp

Filesize
4KB

Download
memory/1336-5-0x0000000000A40000-0x0000000000A63000-memory.dmp

Filesize
140KB

Download
memory/1336-6-0x00000000022A0000-0x00000000022A1000-memory.dmp

Filesize
4KB

Download
memory/1336-7-0x00000000050D0000-0x0000000005147000-memory.dmp

Filesize
476KB

Download
memory/1668-8-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1668-9-0x00000000004374DE-mapping.dmp

Download
memory/1668-10-0x0000000073980000-0x000000007406E000-memory.dmp

Filesize
6.9MB

Download
memory/1668-11-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1668-13-0x0000000004D00000-0x0000000004D01000-memory.dmp

Filesize
4KB

Download