agenttesla | 023d25a8bafeb122725046d0d8f0bae8d443e2da9452b217965ab9c432be6d52

General

Target

QUOTE2021.PDF.exe
Size

615KB
MD5

424233f0bd0abbf6d559c800a47b5374
SHA1

d253a17418d0a9c26fa0275378d80b0627a28888
SHA256

023d25a8bafeb122725046d0d8f0bae8d443e2da9452b217965ab9c432be6d52
SHA512

ee703ef5c2122dca7a6f390043fe18707a3def7ecb9acb10ba21e53f7cd3bc4915492384f853428c942adc992c86459069d6fb278c7423c745f4ad3c7b3cb3b2

Score

10^/10

Family

agenttesla

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1644-10-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1644-11-0x00000000004374CE-mapping.dmp	family_agenttesla
behavioral1/memory/1644-13-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

Processes:

QUOTE2021.PDF.exe

description pid process target process

PID 1596 set thread context of 1644 1596 QUOTE2021.PDF.exe RegSvcs.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

QUOTE2021.PDF.exeRegSvcs.exe

pid process

1596 QUOTE2021.PDF.exe
1596 QUOTE2021.PDF.exe
1644 RegSvcs.exe
1644 RegSvcs.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

QUOTE2021.PDF.exeRegSvcs.exe

description pid process

Token: SeDebugPrivilege 1596 QUOTE2021.PDF.exe
Token: SeDebugPrivilege 1644 RegSvcs.exe

description	pid	process	target process
PID 1596 set thread context of 1644	1596	QUOTE2021.PDF.exe	RegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	1596	QUOTE2021.PDF.exe
Token: SeDebugPrivilege	1644	RegSvcs.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

QUOTE2021.PDF.exe

description	pid	process	target process
PID 1596 wrote to memory of 1644	1596	QUOTE2021.PDF.exe	RegSvcs.exe
PID 1596 wrote to memory of 1644	1596	QUOTE2021.PDF.exe	RegSvcs.exe
PID 1596 wrote to memory of 1644	1596	QUOTE2021.PDF.exe	RegSvcs.exe
PID 1596 wrote to memory of 1644	1596	QUOTE2021.PDF.exe	RegSvcs.exe
PID 1596 wrote to memory of 1644	1596	QUOTE2021.PDF.exe	RegSvcs.exe
PID 1596 wrote to memory of 1644	1596	QUOTE2021.PDF.exe	RegSvcs.exe
PID 1596 wrote to memory of 1644	1596	QUOTE2021.PDF.exe	RegSvcs.exe
PID 1596 wrote to memory of 1644	1596	QUOTE2021.PDF.exe	RegSvcs.exe
PID 1596 wrote to memory of 1644	1596	QUOTE2021.PDF.exe	RegSvcs.exe
PID 1596 wrote to memory of 1644	1596	QUOTE2021.PDF.exe	RegSvcs.exe
PID 1596 wrote to memory of 1644	1596	QUOTE2021.PDF.exe	RegSvcs.exe
PID 1596 wrote to memory of 1644	1596	QUOTE2021.PDF.exe	RegSvcs.exe

memory/1596-2-0x0000000074450000-0x0000000074B3E000-memory.dmp

Filesize
6.9MB

Download
memory/1596-3-0x0000000000200000-0x0000000000201000-memory.dmp

Filesize
4KB

Download
memory/1596-5-0x0000000004F30000-0x0000000004F31000-memory.dmp

Filesize
4KB

Download
memory/1596-6-0x00000000003C0000-0x00000000003C4000-memory.dmp

Filesize
16KB

Download
memory/1596-7-0x000000007EF40000-0x000000007EF41000-memory.dmp

Filesize
4KB

Download
memory/1596-8-0x00000000047C0000-0x000000000482D000-memory.dmp

Filesize
436KB

Download
memory/1596-9-0x0000000004830000-0x000000000486B000-memory.dmp

Filesize
236KB

Download
memory/1644-10-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1644-11-0x00000000004374CE-mapping.dmp

Download
memory/1644-12-0x0000000074450000-0x0000000074B3E000-memory.dmp

Filesize
6.9MB

Download
memory/1644-13-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1644-15-0x0000000004AE0000-0x0000000004AE1000-memory.dmp

Filesize
4KB

Download