agenttesla | bcb6aa4b6393f67e3a72eb9733bb0103d74b67cb3c32bc553302ccdb0e072d98

General

Target

RFQ Our Reference 2021-1143.exe
Size

684KB
MD5

a1ef7cc0e83d9d8ede4311bfe8e124c7
SHA1

a87429754bed0dfff38aa6cc63fbe8d5568a91c9
SHA256

6594b68c027f44465b539374abe5791c970a82b3be282911d2e95a9f459f61f3
SHA512

4bc38dc390a63a369eed9bca032de8f9b0a1b720dcd976a7753e5c3c9bb940f8497ff872f200b279f84a6b26b8e68dc1239a421bc0fd785308ca037eb86bd8cc

Score

10^/10

Family

agenttesla

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/320-66-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/320-67-0x000000000043751E-mapping.dmp	family_agenttesla
behavioral1/memory/320-68-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

Processes:

RFQ Our Reference 2021-1143.exe

description pid process target process

PID 784 set thread context of 320 784 RFQ Our Reference 2021-1143.exe RegSvcs.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

RFQ Our Reference 2021-1143.exeRegSvcs.exe

pid process

784 RFQ Our Reference 2021-1143.exe
320 RegSvcs.exe
320 RegSvcs.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

RFQ Our Reference 2021-1143.exeRegSvcs.exe

description pid process

Token: SeDebugPrivilege 784 RFQ Our Reference 2021-1143.exe
Token: SeDebugPrivilege 320 RegSvcs.exe

description	pid	process	target process
PID 784 set thread context of 320	784	RFQ Our Reference 2021-1143.exe	RegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	784	RFQ Our Reference 2021-1143.exe
Token: SeDebugPrivilege	320	RegSvcs.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

RFQ Our Reference 2021-1143.exe

description	pid	process	target process
PID 784 wrote to memory of 320	784	RFQ Our Reference 2021-1143.exe	RegSvcs.exe
PID 784 wrote to memory of 320	784	RFQ Our Reference 2021-1143.exe	RegSvcs.exe
PID 784 wrote to memory of 320	784	RFQ Our Reference 2021-1143.exe	RegSvcs.exe
PID 784 wrote to memory of 320	784	RFQ Our Reference 2021-1143.exe	RegSvcs.exe
PID 784 wrote to memory of 320	784	RFQ Our Reference 2021-1143.exe	RegSvcs.exe
PID 784 wrote to memory of 320	784	RFQ Our Reference 2021-1143.exe	RegSvcs.exe
PID 784 wrote to memory of 320	784	RFQ Our Reference 2021-1143.exe	RegSvcs.exe
PID 784 wrote to memory of 320	784	RFQ Our Reference 2021-1143.exe	RegSvcs.exe
PID 784 wrote to memory of 320	784	RFQ Our Reference 2021-1143.exe	RegSvcs.exe
PID 784 wrote to memory of 320	784	RFQ Our Reference 2021-1143.exe	RegSvcs.exe
PID 784 wrote to memory of 320	784	RFQ Our Reference 2021-1143.exe	RegSvcs.exe
PID 784 wrote to memory of 320	784	RFQ Our Reference 2021-1143.exe	RegSvcs.exe

memory/320-66-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/320-67-0x000000000043751E-mapping.dmp

Download
memory/320-68-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/320-70-0x0000000004340000-0x0000000004341000-memory.dmp

Filesize
4KB

Download
memory/320-71-0x0000000004341000-0x0000000004342000-memory.dmp

Filesize
4KB

Download
memory/784-60-0x0000000001220000-0x0000000001221000-memory.dmp

Filesize
4KB

Download
memory/784-62-0x00000000047D0000-0x00000000047D1000-memory.dmp

Filesize
4KB

Download
memory/784-63-0x0000000000230000-0x000000000023E000-memory.dmp

Filesize
56KB

Download
memory/784-64-0x0000000007F70000-0x000000000800F000-memory.dmp

Filesize
636KB

Download
memory/784-65-0x0000000005D90000-0x0000000005DF1000-memory.dmp

Filesize
388KB

Download