agenttesla | f2a3c147eb3cb69591f0291b5a1d324a288f86773890fd77b24f255d13feb7bc

General

Target

0000000654.pdf.exe
Size

919KB
MD5

349f507794afb6e5c6c5a1abeeaae124
SHA1

665a2e9b4695df7246dc17cc5add3a173fd42c16
SHA256

f2a3c147eb3cb69591f0291b5a1d324a288f86773890fd77b24f255d13feb7bc
SHA512

5e7df9509825e59ee04072365a441a3f7e01fa6cafdecfbd2a6f746363a8d3a3c4d7712f9be1300691d96dac2e0697a14c9b61fcfa8c55c2c552f6d9c202b9c6

Score

10^/10

Family

agenttesla

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3856-125-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral2/memory/3856-126-0x000000000043761E-mapping.dmp	family_agenttesla
behavioral2/memory/3856-130-0x00000000053A0000-0x000000000589E000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

Processes:

0000000654.pdf.exe

description pid process target process

PID 808 set thread context of 3856 808 0000000654.pdf.exe 0000000654.pdf.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

0000000654.pdf.exe

pid process

3856 0000000654.pdf.exe
3856 0000000654.pdf.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

0000000654.pdf.exe

description pid process

Token: SeDebugPrivilege 3856 0000000654.pdf.exe

description	pid	process	target process
PID 808 set thread context of 3856	808	0000000654.pdf.exe	0000000654.pdf.exe

pid	process
3856	0000000654.pdf.exe
3856	0000000654.pdf.exe

description	pid	process
Token: SeDebugPrivilege	3856	0000000654.pdf.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

0000000654.pdf.exe

description	pid	process	target process
PID 808 wrote to memory of 3856	808	0000000654.pdf.exe	0000000654.pdf.exe
PID 808 wrote to memory of 3856	808	0000000654.pdf.exe	0000000654.pdf.exe
PID 808 wrote to memory of 3856	808	0000000654.pdf.exe	0000000654.pdf.exe
PID 808 wrote to memory of 3856	808	0000000654.pdf.exe	0000000654.pdf.exe
PID 808 wrote to memory of 3856	808	0000000654.pdf.exe	0000000654.pdf.exe
PID 808 wrote to memory of 3856	808	0000000654.pdf.exe	0000000654.pdf.exe
PID 808 wrote to memory of 3856	808	0000000654.pdf.exe	0000000654.pdf.exe
PID 808 wrote to memory of 3856	808	0000000654.pdf.exe	0000000654.pdf.exe

memory/808-114-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/808-116-0x0000000004950000-0x0000000004951000-memory.dmp

Filesize
4KB

Download
memory/808-117-0x0000000005050000-0x0000000005051000-memory.dmp

Filesize
4KB

Download
memory/808-118-0x0000000004A90000-0x0000000004A91000-memory.dmp

Filesize
4KB

Download
memory/808-119-0x00000000024D0000-0x00000000024D1000-memory.dmp

Filesize
4KB

Download
memory/808-120-0x00000000049F0000-0x0000000004A82000-memory.dmp

Filesize
584KB

Download
memory/808-121-0x0000000004C10000-0x0000000004C11000-memory.dmp

Filesize
4KB

Download
memory/808-122-0x0000000004CB0000-0x0000000004CB4000-memory.dmp

Filesize
16KB

Download
memory/808-123-0x0000000005850000-0x000000000591C000-memory.dmp

Filesize
816KB

Download
memory/808-124-0x0000000007DD0000-0x0000000007E66000-memory.dmp

Filesize
600KB

Download
memory/3856-125-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3856-126-0x000000000043761E-mapping.dmp

Download
memory/3856-130-0x00000000053A0000-0x000000000589E000-memory.dmp

Filesize
5.0MB

Download
memory/3856-132-0x0000000005520000-0x0000000005521000-memory.dmp

Filesize
4KB

Download
memory/3856-133-0x0000000006090000-0x0000000006091000-memory.dmp

Filesize
4KB

Download