agenttesla | 35a006c11e8b3efaa0b70dea8608b25d61ad5ad51c21bc8faa9733c06ccd2147

General

Target

Quotation Prices.exe
Size

956KB
MD5

a68285dc5382313f6c565940baf8db40
SHA1

3e69f0f574fd2cdeb11ded1ff4f04f2b8a4905f3
SHA256

35a006c11e8b3efaa0b70dea8608b25d61ad5ad51c21bc8faa9733c06ccd2147
SHA512

07ba463f8c66bb1068f14dcc6b6ec1e93c890516f5844a0e30373364a00b93f0f9d103e65f63f84940e505dbeedc1357cee6ab3dfb0f0b7e241e9475edcfe91e

Score

10^/10

Family

agenttesla

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1252-6-0x00000000004374BE-mapping.dmp	family_agenttesla
behavioral1/memory/1252-5-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

Processes:

Quotation Prices.exe

description pid process target process

PID 744 set thread context of 1252 744 Quotation Prices.exe Quotation Prices.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

Quotation Prices.exe

pid process

1252 Quotation Prices.exe
1252 Quotation Prices.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Quotation Prices.exe

description pid process

Token: SeDebugPrivilege 1252 Quotation Prices.exe

description	pid	process	target process
PID 744 set thread context of 1252	744	Quotation Prices.exe	Quotation Prices.exe

pid	process
1252	Quotation Prices.exe
1252	Quotation Prices.exe

description	pid	process
Token: SeDebugPrivilege	1252	Quotation Prices.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

Quotation Prices.exeQuotation Prices.exe

description	pid	process	target process
PID 744 wrote to memory of 1252	744	Quotation Prices.exe	Quotation Prices.exe
PID 744 wrote to memory of 1252	744	Quotation Prices.exe	Quotation Prices.exe
PID 744 wrote to memory of 1252	744	Quotation Prices.exe	Quotation Prices.exe
PID 744 wrote to memory of 1252	744	Quotation Prices.exe	Quotation Prices.exe
PID 744 wrote to memory of 1252	744	Quotation Prices.exe	Quotation Prices.exe
PID 744 wrote to memory of 1252	744	Quotation Prices.exe	Quotation Prices.exe
PID 744 wrote to memory of 1252	744	Quotation Prices.exe	Quotation Prices.exe
PID 744 wrote to memory of 1252	744	Quotation Prices.exe	Quotation Prices.exe
PID 744 wrote to memory of 1252	744	Quotation Prices.exe	Quotation Prices.exe
PID 1252 wrote to memory of 1748	1252	Quotation Prices.exe	dw20.exe
PID 1252 wrote to memory of 1748	1252	Quotation Prices.exe	dw20.exe
PID 1252 wrote to memory of 1748	1252	Quotation Prices.exe	dw20.exe
PID 1252 wrote to memory of 1748	1252	Quotation Prices.exe	dw20.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 520
3⤵
PID:1748

memory/744-2-0x0000000075E51000-0x0000000075E53000-memory.dmp

Filesize
8KB

Download
memory/744-3-0x0000000000F80000-0x0000000000F81000-memory.dmp

Filesize
4KB

Download
memory/744-4-0x0000000000F81000-0x0000000000F82000-memory.dmp

Filesize
4KB

Download
memory/1252-6-0x00000000004374BE-mapping.dmp

Download
memory/1252-5-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1252-8-0x00000000002E0000-0x00000000002E1000-memory.dmp

Filesize
4KB

Download
memory/1748-9-0x0000000000000000-mapping.dmp

Download
memory/1748-10-0x0000000001E60000-0x0000000001E71000-memory.dmp

Filesize
68KB

Download
memory/1748-12-0x0000000001DF0000-0x0000000001DF1000-memory.dmp

Filesize
4KB

Download