agenttesla | f1624469028a2d29ddceec7ca539472c54787b4047bee8c60cfc8ee2b0c4d89c

General

Target

HTC-343467.exe
Size

781KB
MD5

2fbb52eaa4d139882e67b1b4f5bd9744
SHA1

fce4de8aba1ab5325b1d4e57678f4e08dcb68d00
SHA256

f1624469028a2d29ddceec7ca539472c54787b4047bee8c60cfc8ee2b0c4d89c
SHA512

380732049e4c8481265325289e9c233a0e4ef553cf55cdfe62d1a20262e6bba8e531d907e5ddfc8da316170c70e0b3ab3b41426d9fcbc7c4d88eea68284a526b

Score

10^/10

Family

agenttesla

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/532-64-0x000000000043735E-mapping.dmp	family_agenttesla
behavioral1/memory/532-63-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

Processes:

HTC-343467.exe

description pid process target process

PID 1872 set thread context of 532 1872 HTC-343467.exe HTC-343467.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

HTC-343467.exeHTC-343467.exe

pid process

1872 HTC-343467.exe
1872 HTC-343467.exe
532 HTC-343467.exe
532 HTC-343467.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

dw20.exe

pid process

924 dw20.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

HTC-343467.exeHTC-343467.exe

description pid process

Token: SeDebugPrivilege 1872 HTC-343467.exe
Token: SeDebugPrivilege 532 HTC-343467.exe

description	pid	process	target process
PID 1872 set thread context of 532	1872	HTC-343467.exe	HTC-343467.exe

pid	process
924	dw20.exe

description	pid	process
Token: SeDebugPrivilege	1872	HTC-343467.exe
Token: SeDebugPrivilege	532	HTC-343467.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

HTC-343467.exeHTC-343467.exe

description	pid	process	target process
PID 1872 wrote to memory of 1680	1872	HTC-343467.exe	HTC-343467.exe
PID 1872 wrote to memory of 1680	1872	HTC-343467.exe	HTC-343467.exe
PID 1872 wrote to memory of 1680	1872	HTC-343467.exe	HTC-343467.exe
PID 1872 wrote to memory of 1680	1872	HTC-343467.exe	HTC-343467.exe
PID 1872 wrote to memory of 532	1872	HTC-343467.exe	HTC-343467.exe
PID 1872 wrote to memory of 532	1872	HTC-343467.exe	HTC-343467.exe
PID 1872 wrote to memory of 532	1872	HTC-343467.exe	HTC-343467.exe
PID 1872 wrote to memory of 532	1872	HTC-343467.exe	HTC-343467.exe
PID 1872 wrote to memory of 532	1872	HTC-343467.exe	HTC-343467.exe
PID 1872 wrote to memory of 532	1872	HTC-343467.exe	HTC-343467.exe
PID 1872 wrote to memory of 532	1872	HTC-343467.exe	HTC-343467.exe
PID 1872 wrote to memory of 532	1872	HTC-343467.exe	HTC-343467.exe
PID 1872 wrote to memory of 532	1872	HTC-343467.exe	HTC-343467.exe
PID 532 wrote to memory of 924	532	HTC-343467.exe	dw20.exe
PID 532 wrote to memory of 924	532	HTC-343467.exe	dw20.exe
PID 532 wrote to memory of 924	532	HTC-343467.exe	dw20.exe
PID 532 wrote to memory of 924	532	HTC-343467.exe	dw20.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 520
3⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:924

memory/532-64-0x000000000043735E-mapping.dmp

Download
memory/532-63-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/532-67-0x0000000000140000-0x0000000000141000-memory.dmp

Filesize
4KB

Download
memory/924-68-0x0000000000000000-mapping.dmp

Download
memory/924-70-0x0000000000410000-0x0000000000411000-memory.dmp

Filesize
4KB

Download
memory/1872-60-0x0000000075631000-0x0000000075633000-memory.dmp

Filesize
8KB

Download
memory/1872-61-0x0000000000A00000-0x0000000000A01000-memory.dmp

Filesize
4KB

Download
memory/1872-62-0x000000007EF40000-0x000000007EF41000-memory.dmp

Filesize
4KB

Download
memory/1872-66-0x0000000000A01000-0x0000000000A02000-memory.dmp

Filesize
4KB

Download