agenttesla | 3332ae8c0f7892922ad49600076bf9f76080ce02a6071be444299815f26c66db

General

Target

SecuriteInfo.com.Trojan.Inject4.6821.6799.24358.exe
Size

923KB
MD5

76c23349842c2c27816ae56bc9f4fa90
SHA1

d3bbfcab13dc36d2702ef82b808b53f25570fdaa
SHA256

3332ae8c0f7892922ad49600076bf9f76080ce02a6071be444299815f26c66db
SHA512

b69eac91bbb5240490a41a12183bb154be7934efb1bd160eeeaff337ee307f62eb8eb56dbb8996c15bfa4126360033641d3eaee8fe52e07c2b9bc54da58187e9

Score

10^/10

Family

agenttesla

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/980-8-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/980-9-0x000000000043760E-mapping.dmp	family_agenttesla
behavioral1/memory/980-11-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

Processes:

SecuriteInfo.com.Trojan.Inject4.6821.6799.24358.exe

description pid process target process

PID 1684 set thread context of 980 1684 SecuriteInfo.com.Trojan.Inject4.6821.6799.24358.exe RegSvcs.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

RegSvcs.exe

pid process

980 RegSvcs.exe
980 RegSvcs.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RegSvcs.exe

description pid process

Token: SeDebugPrivilege 980 RegSvcs.exe

description	pid	process	target process
PID 1684 set thread context of 980	1684	SecuriteInfo.com.Trojan.Inject4.6821.6799.24358.exe	RegSvcs.exe

pid	process
980	RegSvcs.exe
980	RegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	980	RegSvcs.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

SecuriteInfo.com.Trojan.Inject4.6821.6799.24358.exe

description	pid	process	target process
PID 1684 wrote to memory of 980	1684	SecuriteInfo.com.Trojan.Inject4.6821.6799.24358.exe	RegSvcs.exe
PID 1684 wrote to memory of 980	1684	SecuriteInfo.com.Trojan.Inject4.6821.6799.24358.exe	RegSvcs.exe
PID 1684 wrote to memory of 980	1684	SecuriteInfo.com.Trojan.Inject4.6821.6799.24358.exe	RegSvcs.exe
PID 1684 wrote to memory of 980	1684	SecuriteInfo.com.Trojan.Inject4.6821.6799.24358.exe	RegSvcs.exe
PID 1684 wrote to memory of 980	1684	SecuriteInfo.com.Trojan.Inject4.6821.6799.24358.exe	RegSvcs.exe
PID 1684 wrote to memory of 980	1684	SecuriteInfo.com.Trojan.Inject4.6821.6799.24358.exe	RegSvcs.exe
PID 1684 wrote to memory of 980	1684	SecuriteInfo.com.Trojan.Inject4.6821.6799.24358.exe	RegSvcs.exe
PID 1684 wrote to memory of 980	1684	SecuriteInfo.com.Trojan.Inject4.6821.6799.24358.exe	RegSvcs.exe
PID 1684 wrote to memory of 980	1684	SecuriteInfo.com.Trojan.Inject4.6821.6799.24358.exe	RegSvcs.exe
PID 1684 wrote to memory of 980	1684	SecuriteInfo.com.Trojan.Inject4.6821.6799.24358.exe	RegSvcs.exe
PID 1684 wrote to memory of 980	1684	SecuriteInfo.com.Trojan.Inject4.6821.6799.24358.exe	RegSvcs.exe
PID 1684 wrote to memory of 980	1684	SecuriteInfo.com.Trojan.Inject4.6821.6799.24358.exe	RegSvcs.exe

memory/980-8-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/980-9-0x000000000043760E-mapping.dmp

Download
memory/980-10-0x0000000074450000-0x0000000074B3E000-memory.dmp

Filesize
6.9MB

Download
memory/980-11-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/980-13-0x00000000006F0000-0x00000000006F1000-memory.dmp

Filesize
4KB

Download
memory/1684-2-0x0000000074450000-0x0000000074B3E000-memory.dmp

Filesize
6.9MB

Download
memory/1684-3-0x0000000000C20000-0x0000000000C21000-memory.dmp

Filesize
4KB

Download
memory/1684-5-0x0000000000700000-0x0000000000701000-memory.dmp

Filesize
4KB

Download
memory/1684-6-0x0000000000740000-0x0000000000743000-memory.dmp

Filesize
12KB

Download
memory/1684-7-0x0000000005600000-0x00000000056A8000-memory.dmp

Filesize
672KB

Download