agenttesla | 2efdd33ac30e96fcc41df82e89004c5553182e74f04efb8c434e881e00af0b42

General

Target

SWIFT COPY.exe
Size

723KB
MD5

d519e87d666c392d0f2ef1ad2aebc05e
SHA1

8ebbbf740d9c71a0ff552f94a04a8486ef203688
SHA256

2efdd33ac30e96fcc41df82e89004c5553182e74f04efb8c434e881e00af0b42
SHA512

63063628be679d3911e48a97d8bea96b62b9a12ff75f2b8e6ef6c1262a91df393c793495c418467d2d8395657f438a8b0711637010872458f929ac5f7f569841

Score

10^/10

Family

agenttesla

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1496-5-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1496-6-0x000000000043733E-mapping.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

Processes:

SWIFT COPY.exe

description pid process target process

PID 844 set thread context of 1496 844 SWIFT COPY.exe SWIFT COPY.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

SWIFT COPY.exe

pid process

1496 SWIFT COPY.exe
1496 SWIFT COPY.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

SWIFT COPY.exe

description pid process

Token: SeDebugPrivilege 1496 SWIFT COPY.exe

description	pid	process	target process
PID 844 set thread context of 1496	844	SWIFT COPY.exe	SWIFT COPY.exe

pid	process
1496	SWIFT COPY.exe
1496	SWIFT COPY.exe

description	pid	process
Token: SeDebugPrivilege	1496	SWIFT COPY.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

SWIFT COPY.exeSWIFT COPY.exe

description	pid	process	target process
PID 844 wrote to memory of 1496	844	SWIFT COPY.exe	SWIFT COPY.exe
PID 844 wrote to memory of 1496	844	SWIFT COPY.exe	SWIFT COPY.exe
PID 844 wrote to memory of 1496	844	SWIFT COPY.exe	SWIFT COPY.exe
PID 844 wrote to memory of 1496	844	SWIFT COPY.exe	SWIFT COPY.exe
PID 844 wrote to memory of 1496	844	SWIFT COPY.exe	SWIFT COPY.exe
PID 844 wrote to memory of 1496	844	SWIFT COPY.exe	SWIFT COPY.exe
PID 844 wrote to memory of 1496	844	SWIFT COPY.exe	SWIFT COPY.exe
PID 844 wrote to memory of 1496	844	SWIFT COPY.exe	SWIFT COPY.exe
PID 844 wrote to memory of 1496	844	SWIFT COPY.exe	SWIFT COPY.exe
PID 1496 wrote to memory of 364	1496	SWIFT COPY.exe	dw20.exe
PID 1496 wrote to memory of 364	1496	SWIFT COPY.exe	dw20.exe
PID 1496 wrote to memory of 364	1496	SWIFT COPY.exe	dw20.exe
PID 1496 wrote to memory of 364	1496	SWIFT COPY.exe	dw20.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 520
3⤵
PID:364

memory/364-9-0x0000000000000000-mapping.dmp

Download
memory/364-10-0x0000000001DF0000-0x0000000001E01000-memory.dmp

Filesize
68KB

Download
memory/364-12-0x00000000005F0000-0x00000000005F1000-memory.dmp

Filesize
4KB

Download
memory/844-2-0x0000000076881000-0x0000000076883000-memory.dmp

Filesize
8KB

Download
memory/844-3-0x0000000000850000-0x0000000000851000-memory.dmp

Filesize
4KB

Download
memory/844-4-0x0000000000851000-0x0000000000852000-memory.dmp

Filesize
4KB

Download
memory/1496-5-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1496-6-0x000000000043733E-mapping.dmp

Download
memory/1496-8-0x0000000002120000-0x0000000002121000-memory.dmp

Filesize
4KB

Download