agenttesla | ed5aeb58bb7327270d75e75505bc2322bb62e5764b4245dba88d5a91c40ebe8b

General

Target

PROFORMA INVOICE.exe
Size

774KB
MD5

b58d742577f386edbf58075fff9ffacc
SHA1

a2b677224dc4fd241018dc05d0bf788df090cf01
SHA256

ed5aeb58bb7327270d75e75505bc2322bb62e5764b4245dba88d5a91c40ebe8b
SHA512

19dfc707c7dc31ba73cf20b3f986ed956d076b88781ca50b7e5409d877788bddfcdc14a9a7dc7ed12baa407a62d72f9622c8740d7e4d8f5b9a5244f09d7d28d4

Score

10^/10

Family

agenttesla

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1828-8-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1828-9-0x00000000004375EE-mapping.dmp	family_agenttesla
behavioral1/memory/1828-11-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

Processes:

PROFORMA INVOICE.exe

description pid process target process

PID 1888 set thread context of 1828 1888 PROFORMA INVOICE.exe PROFORMA INVOICE.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

PROFORMA INVOICE.exe

pid process

1828 PROFORMA INVOICE.exe
1828 PROFORMA INVOICE.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

PROFORMA INVOICE.exe

description pid process

Token: SeDebugPrivilege 1828 PROFORMA INVOICE.exe

description	pid	process	target process
PID 1888 set thread context of 1828	1888	PROFORMA INVOICE.exe	PROFORMA INVOICE.exe

pid	process
1828	PROFORMA INVOICE.exe
1828	PROFORMA INVOICE.exe

description	pid	process
Token: SeDebugPrivilege	1828	PROFORMA INVOICE.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

PROFORMA INVOICE.exe

description	pid	process	target process
PID 1888 wrote to memory of 1828	1888	PROFORMA INVOICE.exe	PROFORMA INVOICE.exe
PID 1888 wrote to memory of 1828	1888	PROFORMA INVOICE.exe	PROFORMA INVOICE.exe
PID 1888 wrote to memory of 1828	1888	PROFORMA INVOICE.exe	PROFORMA INVOICE.exe
PID 1888 wrote to memory of 1828	1888	PROFORMA INVOICE.exe	PROFORMA INVOICE.exe
PID 1888 wrote to memory of 1828	1888	PROFORMA INVOICE.exe	PROFORMA INVOICE.exe
PID 1888 wrote to memory of 1828	1888	PROFORMA INVOICE.exe	PROFORMA INVOICE.exe
PID 1888 wrote to memory of 1828	1888	PROFORMA INVOICE.exe	PROFORMA INVOICE.exe
PID 1888 wrote to memory of 1828	1888	PROFORMA INVOICE.exe	PROFORMA INVOICE.exe
PID 1888 wrote to memory of 1828	1888	PROFORMA INVOICE.exe	PROFORMA INVOICE.exe

memory/1828-8-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1828-9-0x00000000004375EE-mapping.dmp

Download
memory/1828-10-0x0000000074320000-0x0000000074A0E000-memory.dmp

Filesize
6.9MB

Download
memory/1828-11-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1828-13-0x0000000001000000-0x0000000001001000-memory.dmp

Filesize
4KB

Download
memory/1888-2-0x0000000074320000-0x0000000074A0E000-memory.dmp

Filesize
6.9MB

Download
memory/1888-3-0x00000000010B0000-0x00000000010B1000-memory.dmp

Filesize
4KB

Download
memory/1888-5-0x0000000000290000-0x0000000000293000-memory.dmp

Filesize
12KB

Download
memory/1888-6-0x0000000004E40000-0x0000000004E41000-memory.dmp

Filesize
4KB

Download
memory/1888-7-0x0000000004D00000-0x0000000004D5C000-memory.dmp

Filesize
368KB

Download