agenttesla | 1124d0232cd747fbba4b105ad701f41057d8e3a3153beb8d5dc4558ae477c37c

General

Score

10^/10

Family

agenttesla

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2324-14-0x00000000004375CE-mapping.dmp	family_agenttesla
behavioral2/memory/2324-13-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

Processes:

ORDER 2021022500010101001010.exe

description pid process target process

PID 4712 set thread context of 2324 4712 ORDER 2021022500010101001010.exe ORDER 2021022500010101001010.exe

description	pid	process	target process
PID 4712 set thread context of 2324	4712	ORDER 2021022500010101001010.exe	ORDER 2021022500010101001010.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

ORDER 2021022500010101001010.exeORDER 2021022500010101001010.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

ORDER 2021022500010101001010.exeORDER 2021022500010101001010.exe

description pid process

Token: SeDebugPrivilege 4712 ORDER 2021022500010101001010.exe
Token: SeDebugPrivilege 2324 ORDER 2021022500010101001010.exe

description	pid	process
Token: SeDebugPrivilege	4712	ORDER 2021022500010101001010.exe
Token: SeDebugPrivilege	2324	ORDER 2021022500010101001010.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

ORDER 2021022500010101001010.exe

description	pid	process	target process
PID 4712 wrote to memory of 2108	4712	ORDER 2021022500010101001010.exe	ORDER 2021022500010101001010.exe
PID 4712 wrote to memory of 2108	4712	ORDER 2021022500010101001010.exe	ORDER 2021022500010101001010.exe
PID 4712 wrote to memory of 2108	4712	ORDER 2021022500010101001010.exe	ORDER 2021022500010101001010.exe
PID 4712 wrote to memory of 2324	4712	ORDER 2021022500010101001010.exe	ORDER 2021022500010101001010.exe
PID 4712 wrote to memory of 2324	4712	ORDER 2021022500010101001010.exe	ORDER 2021022500010101001010.exe
PID 4712 wrote to memory of 2324	4712	ORDER 2021022500010101001010.exe	ORDER 2021022500010101001010.exe
PID 4712 wrote to memory of 2324	4712	ORDER 2021022500010101001010.exe	ORDER 2021022500010101001010.exe
PID 4712 wrote to memory of 2324	4712	ORDER 2021022500010101001010.exe	ORDER 2021022500010101001010.exe
PID 4712 wrote to memory of 2324	4712	ORDER 2021022500010101001010.exe	ORDER 2021022500010101001010.exe
PID 4712 wrote to memory of 2324	4712	ORDER 2021022500010101001010.exe	ORDER 2021022500010101001010.exe
PID 4712 wrote to memory of 2324	4712	ORDER 2021022500010101001010.exe	ORDER 2021022500010101001010.exe

C:\Users\Admin\AppData\Local\Temp\ORDER 2021022500010101001010.exe
"C:\Users\Admin\AppData\Local\Temp\ORDER 2021022500010101001010.exe"
2⤵
PID:2108

memory/2324-14-0x00000000004375CE-mapping.dmp

Download
memory/2324-22-0x0000000006260000-0x0000000006261000-memory.dmp

Filesize
4KB

Download
memory/2324-21-0x00000000061D0000-0x00000000061D1000-memory.dmp

Filesize
4KB

Download
memory/2324-20-0x0000000005590000-0x0000000005591000-memory.dmp

Filesize
4KB

Download
memory/2324-15-0x0000000073FA0000-0x000000007468E000-memory.dmp

Filesize
6.9MB

Download
memory/2324-13-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4712-7-0x0000000004E10000-0x0000000004E11000-memory.dmp

Filesize
4KB

Download
memory/4712-10-0x0000000000D70000-0x0000000000D71000-memory.dmp

Filesize
4KB

Download
memory/4712-11-0x0000000002750000-0x0000000002753000-memory.dmp

Filesize
12KB

Download
memory/4712-12-0x00000000051E0000-0x000000000523C000-memory.dmp

Filesize
368KB

Download
memory/4712-9-0x0000000004EB0000-0x0000000004EB1000-memory.dmp

Filesize
4KB

Download
memory/4712-8-0x0000000002720000-0x0000000002721000-memory.dmp

Filesize
4KB

Download
memory/4712-2-0x0000000073FA0000-0x000000007468E000-memory.dmp

Filesize
6.9MB

Download
memory/4712-6-0x0000000005310000-0x0000000005311000-memory.dmp

Filesize
4KB

Download
memory/4712-5-0x0000000002650000-0x0000000002651000-memory.dmp

Filesize
4KB

Download
memory/4712-3-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download