agenttesla | 2732029a466cf6c066f468d43b058d2ccda9d0681f73e22f091bd2cf6372c9b1

General

Target

Purchase Order 5390.exe
Size

439KB
MD5

09ee0caf424df3b1070a23913fe3d016
SHA1

75edbc9eff06d5d15c907338c24ed6c2fcf58d61
SHA256

2732029a466cf6c066f468d43b058d2ccda9d0681f73e22f091bd2cf6372c9b1
SHA512

0d996f5ed0748fd8322ff7adbacd54f7b0f66f0b8d5944ab42eb2a5166e00aef074155f00a45cc00f8d576f2e87071a68c8ec111cf07b5477c77b94448519f87

Score

10^/10

Family

agenttesla

C2

https://api.telegram.org/bot1463238323:AAGtI1JM_Kj38d1Y2cvi15DJ_j42pVQvMNI/sendDocument

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/432-9-0x000000000043771E-mapping.dmp	family_agenttesla
behavioral1/memory/432-8-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/432-11-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

Processes:

Purchase Order 5390.exe

description pid process target process

PID 1924 set thread context of 432 1924 Purchase Order 5390.exe Purchase Order 5390.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

Purchase Order 5390.exe

pid process

432 Purchase Order 5390.exe
432 Purchase Order 5390.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Purchase Order 5390.exe

description pid process

Token: SeDebugPrivilege 432 Purchase Order 5390.exe

description	pid	process	target process
PID 1924 set thread context of 432	1924	Purchase Order 5390.exe	Purchase Order 5390.exe

pid	process
432	Purchase Order 5390.exe
432	Purchase Order 5390.exe

description	pid	process
Token: SeDebugPrivilege	432	Purchase Order 5390.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

Purchase Order 5390.exe

description	pid	process	target process
PID 1924 wrote to memory of 432	1924	Purchase Order 5390.exe	Purchase Order 5390.exe
PID 1924 wrote to memory of 432	1924	Purchase Order 5390.exe	Purchase Order 5390.exe
PID 1924 wrote to memory of 432	1924	Purchase Order 5390.exe	Purchase Order 5390.exe
PID 1924 wrote to memory of 432	1924	Purchase Order 5390.exe	Purchase Order 5390.exe
PID 1924 wrote to memory of 432	1924	Purchase Order 5390.exe	Purchase Order 5390.exe
PID 1924 wrote to memory of 432	1924	Purchase Order 5390.exe	Purchase Order 5390.exe
PID 1924 wrote to memory of 432	1924	Purchase Order 5390.exe	Purchase Order 5390.exe
PID 1924 wrote to memory of 432	1924	Purchase Order 5390.exe	Purchase Order 5390.exe
PID 1924 wrote to memory of 432	1924	Purchase Order 5390.exe	Purchase Order 5390.exe

memory/432-9-0x000000000043771E-mapping.dmp

Download
memory/432-8-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/432-10-0x00000000742C0000-0x00000000749AE000-memory.dmp

Filesize
6.9MB

Download
memory/432-11-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/432-13-0x0000000004880000-0x0000000004881000-memory.dmp

Filesize
4KB

Download
memory/1924-2-0x00000000742C0000-0x00000000749AE000-memory.dmp

Filesize
6.9MB

Download
memory/1924-3-0x0000000001060000-0x0000000001061000-memory.dmp

Filesize
4KB

Download
memory/1924-5-0x0000000000360000-0x0000000000364000-memory.dmp

Filesize
16KB

Download
memory/1924-6-0x0000000004D50000-0x0000000004D51000-memory.dmp

Filesize
4KB

Download
memory/1924-7-0x00000000051B0000-0x0000000005215000-memory.dmp

Filesize
404KB

Download