agenttesla | 2732029a466cf6c066f468d43b058d2ccda9d0681f73e22f091bd2cf6372c9b1

Analysis

Target

Purchase Order 5390.exe
Size

439KB
MD5

09ee0caf424df3b1070a23913fe3d016
SHA1

75edbc9eff06d5d15c907338c24ed6c2fcf58d61
SHA256

2732029a466cf6c066f468d43b058d2ccda9d0681f73e22f091bd2cf6372c9b1
SHA512

0d996f5ed0748fd8322ff7adbacd54f7b0f66f0b8d5944ab42eb2a5166e00aef074155f00a45cc00f8d576f2e87071a68c8ec111cf07b5477c77b94448519f87

Score

10^/10

Family

agenttesla

https://api.telegram.org/bot1463238323:AAGtI1JM_Kj38d1Y2cvi15DJ_j42pVQvMNI/sendDocument

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 3 IoCs

resource	yara_rule
behavioral1/memory/432-9-0x000000000043771E-mapping.dmp	family_agenttesla
behavioral1/memory/432-8-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/432-11-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1924 set thread context of 432	1924	Purchase Order 5390.exe	29

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
432	Purchase Order 5390.exe
432	Purchase Order 5390.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	432	Purchase Order 5390.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1924 wrote to memory of 432	1924	Purchase Order 5390.exe	29
PID 1924 wrote to memory of 432	1924	Purchase Order 5390.exe	29
PID 1924 wrote to memory of 432	1924	Purchase Order 5390.exe	29
PID 1924 wrote to memory of 432	1924	Purchase Order 5390.exe	29
PID 1924 wrote to memory of 432	1924	Purchase Order 5390.exe	29
PID 1924 wrote to memory of 432	1924	Purchase Order 5390.exe	29
PID 1924 wrote to memory of 432	1924	Purchase Order 5390.exe	29
PID 1924 wrote to memory of 432	1924	Purchase Order 5390.exe	29
PID 1924 wrote to memory of 432	1924	Purchase Order 5390.exe	29

memory/432-8-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/432-10-0x00000000742C0000-0x00000000749AE000-memory.dmp

Filesize
6.9MB

Download
memory/432-11-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/432-13-0x0000000004880000-0x0000000004881000-memory.dmp

Filesize
4KB

Download
memory/1924-2-0x00000000742C0000-0x00000000749AE000-memory.dmp

Filesize
6.9MB

Download
memory/1924-3-0x0000000001060000-0x0000000001061000-memory.dmp

Filesize
4KB

Download
memory/1924-5-0x0000000000360000-0x0000000000364000-memory.dmp

Filesize
16KB

Download
memory/1924-6-0x0000000004D50000-0x0000000004D51000-memory.dmp

Filesize
4KB

Download
memory/1924-7-0x00000000051B0000-0x0000000005215000-memory.dmp

Filesize
404KB

Download