agenttesla | 26799266072f7aeaf11cfe54773cd3f387dd383bb8900cf1708a8db00740d101

General

Target

QUOTE B1020363.pdf.exe
Size

735KB
MD5

8c817545d7ba60333a000ba5ce565776
SHA1

e2c55dc26dde7b0e07b950d9753ccee89d0216f0
SHA256

26799266072f7aeaf11cfe54773cd3f387dd383bb8900cf1708a8db00740d101
SHA512

2beec0619d4834e696f6c30513a9007e2e0c822c0290221de050b422abdd5e99025561ada8508e085d6415479a35eaef47f7040c3b5b1bffb464f0e95316d241

Score

10^/10

Family

agenttesla

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3380-124-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral2/memory/3380-125-0x00000000004374DE-mapping.dmp	family_agenttesla
behavioral2/memory/3380-130-0x0000000004ED0000-0x00000000053CE000-memory.dmp	family_agenttesla
behavioral2/memory/3380-135-0x0000000004ED0000-0x00000000053CE000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

Processes:

QUOTE B1020363.pdf.exe

description pid process target process

PID 3904 set thread context of 3380 3904 QUOTE B1020363.pdf.exe RegSvcs.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

RegSvcs.exe

pid process

3380 RegSvcs.exe
3380 RegSvcs.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RegSvcs.exe

description pid process

Token: SeDebugPrivilege 3380 RegSvcs.exe

description	pid	process	target process
PID 3904 set thread context of 3380	3904	QUOTE B1020363.pdf.exe	RegSvcs.exe

pid	process
3380	RegSvcs.exe
3380	RegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	3380	RegSvcs.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

QUOTE B1020363.pdf.exe

description	pid	process	target process
PID 3904 wrote to memory of 3380	3904	QUOTE B1020363.pdf.exe	RegSvcs.exe
PID 3904 wrote to memory of 3380	3904	QUOTE B1020363.pdf.exe	RegSvcs.exe
PID 3904 wrote to memory of 3380	3904	QUOTE B1020363.pdf.exe	RegSvcs.exe
PID 3904 wrote to memory of 3380	3904	QUOTE B1020363.pdf.exe	RegSvcs.exe
PID 3904 wrote to memory of 3380	3904	QUOTE B1020363.pdf.exe	RegSvcs.exe
PID 3904 wrote to memory of 3380	3904	QUOTE B1020363.pdf.exe	RegSvcs.exe
PID 3904 wrote to memory of 3380	3904	QUOTE B1020363.pdf.exe	RegSvcs.exe
PID 3904 wrote to memory of 3380	3904	QUOTE B1020363.pdf.exe	RegSvcs.exe

memory/3380-124-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3380-135-0x0000000004ED0000-0x00000000053CE000-memory.dmp

Filesize
5.0MB

Download
memory/3380-132-0x0000000005C30000-0x0000000005C31000-memory.dmp

Filesize
4KB

Download
memory/3380-131-0x0000000005360000-0x0000000005361000-memory.dmp

Filesize
4KB

Download
memory/3380-130-0x0000000004ED0000-0x00000000053CE000-memory.dmp

Filesize
5.0MB

Download
memory/3380-125-0x00000000004374DE-mapping.dmp

Download
memory/3904-118-0x00000000077F0000-0x0000000007CEE000-memory.dmp

Filesize
5.0MB

Download
memory/3904-122-0x00000000057C0000-0x0000000005855000-memory.dmp

Filesize
596KB

Download
memory/3904-123-0x0000000005E30000-0x0000000005E84000-memory.dmp

Filesize
336KB

Download
memory/3904-121-0x0000000004D20000-0x0000000004D2E000-memory.dmp

Filesize
56KB

Download
memory/3904-120-0x0000000009860000-0x0000000009861000-memory.dmp

Filesize
4KB

Download
memory/3904-119-0x0000000007820000-0x0000000007821000-memory.dmp

Filesize
4KB

Download
memory/3904-114-0x0000000000A50000-0x0000000000A51000-memory.dmp

Filesize
4KB

Download
memory/3904-117-0x0000000007890000-0x0000000007891000-memory.dmp

Filesize
4KB

Download
memory/3904-116-0x0000000007CF0000-0x0000000007CF1000-memory.dmp

Filesize
4KB

Download