agenttesla | 8468cc08571c3290982083780878df02735e8dd243dc8fa606741e499303d97e

General

Target

QTY-3322.exe
Size

743KB
MD5

a3d83561dfbe5040966053844b20d68b
SHA1

02de62dee6785a08b2025fa21ecc8619bd6dcd35
SHA256

8468cc08571c3290982083780878df02735e8dd243dc8fa606741e499303d97e
SHA512

ca710982c00d4b98aee6a467dfb4f8f0264cf8e7139dbd3c6d4a1756bb5c70ff41cf9c7aeee45cf073ce4d3ef96280be36c9d3cbb34b7a3987f954c30b90971c

Score

10^/10

Family

agenttesla

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1588-62-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1588-63-0x000000000043736E-mapping.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

Processes:

QTY-3322.exe

description pid process target process

PID 1652 set thread context of 1588 1652 QTY-3322.exe QTY-3322.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

QTY-3322.exe

pid process

1588 QTY-3322.exe
1588 QTY-3322.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

QTY-3322.exe

description pid process

Token: SeDebugPrivilege 1588 QTY-3322.exe

description	pid	process	target process
PID 1652 set thread context of 1588	1652	QTY-3322.exe	QTY-3322.exe

pid	process
1588	QTY-3322.exe
1588	QTY-3322.exe

description	pid	process
Token: SeDebugPrivilege	1588	QTY-3322.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

QTY-3322.exeQTY-3322.exe

description	pid	process	target process
PID 1652 wrote to memory of 1588	1652	QTY-3322.exe	QTY-3322.exe
PID 1652 wrote to memory of 1588	1652	QTY-3322.exe	QTY-3322.exe
PID 1652 wrote to memory of 1588	1652	QTY-3322.exe	QTY-3322.exe
PID 1652 wrote to memory of 1588	1652	QTY-3322.exe	QTY-3322.exe
PID 1652 wrote to memory of 1588	1652	QTY-3322.exe	QTY-3322.exe
PID 1652 wrote to memory of 1588	1652	QTY-3322.exe	QTY-3322.exe
PID 1652 wrote to memory of 1588	1652	QTY-3322.exe	QTY-3322.exe
PID 1652 wrote to memory of 1588	1652	QTY-3322.exe	QTY-3322.exe
PID 1652 wrote to memory of 1588	1652	QTY-3322.exe	QTY-3322.exe
PID 1588 wrote to memory of 1032	1588	QTY-3322.exe	dw20.exe
PID 1588 wrote to memory of 1032	1588	QTY-3322.exe	dw20.exe
PID 1588 wrote to memory of 1032	1588	QTY-3322.exe	dw20.exe
PID 1588 wrote to memory of 1032	1588	QTY-3322.exe	dw20.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 520
3⤵
PID:1032

memory/1032-67-0x0000000000000000-mapping.dmp

Download
memory/1032-69-0x0000000000700000-0x0000000000701000-memory.dmp

Filesize
4KB

Download
memory/1588-62-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1588-63-0x000000000043736E-mapping.dmp

Download
memory/1588-66-0x0000000000BB0000-0x0000000000BB1000-memory.dmp

Filesize
4KB

Download
memory/1652-60-0x00000000754F1000-0x00000000754F3000-memory.dmp

Filesize
8KB

Download
memory/1652-61-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/1652-65-0x0000000000081000-0x0000000000082000-memory.dmp

Filesize
4KB

Download