agenttesla | 59915adde8ff6809e7c41085595d3d74285283bce1c5aa3c25acfe8300f00b50

General

Score

10^/10

Family

agenttesla

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1360-6-0x00000000004374CE-mapping.dmp	family_agenttesla
behavioral1/memory/1360-5-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

Processes:

t7TPWzR6ik7Go42.exe

description pid process target process

PID 1724 set thread context of 1360 1724 t7TPWzR6ik7Go42.exe t7TPWzR6ik7Go42.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

t7TPWzR6ik7Go42.exe

pid process

1360 t7TPWzR6ik7Go42.exe
1360 t7TPWzR6ik7Go42.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

t7TPWzR6ik7Go42.exe

description pid process

Token: SeDebugPrivilege 1360 t7TPWzR6ik7Go42.exe

description	pid	process	target process
PID 1724 set thread context of 1360	1724	t7TPWzR6ik7Go42.exe	t7TPWzR6ik7Go42.exe

pid	process
1360	t7TPWzR6ik7Go42.exe
1360	t7TPWzR6ik7Go42.exe

description	pid	process
Token: SeDebugPrivilege	1360	t7TPWzR6ik7Go42.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

t7TPWzR6ik7Go42.exet7TPWzR6ik7Go42.exe

description	pid	process	target process
PID 1724 wrote to memory of 1360	1724	t7TPWzR6ik7Go42.exe	t7TPWzR6ik7Go42.exe
PID 1724 wrote to memory of 1360	1724	t7TPWzR6ik7Go42.exe	t7TPWzR6ik7Go42.exe
PID 1724 wrote to memory of 1360	1724	t7TPWzR6ik7Go42.exe	t7TPWzR6ik7Go42.exe
PID 1724 wrote to memory of 1360	1724	t7TPWzR6ik7Go42.exe	t7TPWzR6ik7Go42.exe
PID 1724 wrote to memory of 1360	1724	t7TPWzR6ik7Go42.exe	t7TPWzR6ik7Go42.exe
PID 1724 wrote to memory of 1360	1724	t7TPWzR6ik7Go42.exe	t7TPWzR6ik7Go42.exe
PID 1724 wrote to memory of 1360	1724	t7TPWzR6ik7Go42.exe	t7TPWzR6ik7Go42.exe
PID 1724 wrote to memory of 1360	1724	t7TPWzR6ik7Go42.exe	t7TPWzR6ik7Go42.exe
PID 1724 wrote to memory of 1360	1724	t7TPWzR6ik7Go42.exe	t7TPWzR6ik7Go42.exe
PID 1360 wrote to memory of 1016	1360	t7TPWzR6ik7Go42.exe	dw20.exe
PID 1360 wrote to memory of 1016	1360	t7TPWzR6ik7Go42.exe	dw20.exe
PID 1360 wrote to memory of 1016	1360	t7TPWzR6ik7Go42.exe	dw20.exe
PID 1360 wrote to memory of 1016	1360	t7TPWzR6ik7Go42.exe	dw20.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 520
3⤵
PID:1016

memory/1016-9-0x0000000000000000-mapping.dmp

Download
memory/1016-10-0x0000000001D80000-0x0000000001D91000-memory.dmp

Filesize
68KB

Download
memory/1016-12-0x0000000001D10000-0x0000000001D11000-memory.dmp

Filesize
4KB

Download
memory/1360-6-0x00000000004374CE-mapping.dmp

Download
memory/1360-5-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1360-8-0x0000000000BA0000-0x0000000000BA1000-memory.dmp

Filesize
4KB

Download
memory/1724-2-0x00000000761E1000-0x00000000761E3000-memory.dmp

Filesize
8KB

Download
memory/1724-3-0x0000000000A90000-0x0000000000A91000-memory.dmp

Filesize
4KB

Download
memory/1724-4-0x0000000000A91000-0x0000000000A92000-memory.dmp

Filesize
4KB

Download