agenttesla | 113c1364bffb0f75376c6728d53bc47304fd8f8077dc0765f1b924f04d5456e8

General

Target

8DL3LHg4SB6Q7z2.exe
Size

598KB
MD5

4212c79d57ff6347883dbc23d4f3846d
SHA1

17cc7ba6332e18a8572a82ab4bc1e039d791d308
SHA256

113c1364bffb0f75376c6728d53bc47304fd8f8077dc0765f1b924f04d5456e8
SHA512

c97f56f6a9373cb2b0dcaefddeedb2cf436847edf01fb35e7a020ae111aaa325a2ff192da0bd4787d943fa1ea32ae7ebafc4785ccce00f8fe9152ad23d34826e

Score

10^/10

Family

agenttesla

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/832-64-0x000000000043767E-mapping.dmp	family_agenttesla
behavioral1/memory/832-63-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

Processes:

8DL3LHg4SB6Q7z2.exe

description pid process target process

PID 484 set thread context of 832 484 8DL3LHg4SB6Q7z2.exe 8DL3LHg4SB6Q7z2.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

8DL3LHg4SB6Q7z2.exe

pid process

832 8DL3LHg4SB6Q7z2.exe
832 8DL3LHg4SB6Q7z2.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

8DL3LHg4SB6Q7z2.exe

description pid process

Token: SeDebugPrivilege 832 8DL3LHg4SB6Q7z2.exe

description	pid	process	target process
PID 484 set thread context of 832	484	8DL3LHg4SB6Q7z2.exe	8DL3LHg4SB6Q7z2.exe

pid	process
832	8DL3LHg4SB6Q7z2.exe
832	8DL3LHg4SB6Q7z2.exe

description	pid	process
Token: SeDebugPrivilege	832	8DL3LHg4SB6Q7z2.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

8DL3LHg4SB6Q7z2.exe8DL3LHg4SB6Q7z2.exe

description	pid	process	target process
PID 484 wrote to memory of 832	484	8DL3LHg4SB6Q7z2.exe	8DL3LHg4SB6Q7z2.exe
PID 484 wrote to memory of 832	484	8DL3LHg4SB6Q7z2.exe	8DL3LHg4SB6Q7z2.exe
PID 484 wrote to memory of 832	484	8DL3LHg4SB6Q7z2.exe	8DL3LHg4SB6Q7z2.exe
PID 484 wrote to memory of 832	484	8DL3LHg4SB6Q7z2.exe	8DL3LHg4SB6Q7z2.exe
PID 484 wrote to memory of 832	484	8DL3LHg4SB6Q7z2.exe	8DL3LHg4SB6Q7z2.exe
PID 484 wrote to memory of 832	484	8DL3LHg4SB6Q7z2.exe	8DL3LHg4SB6Q7z2.exe
PID 484 wrote to memory of 832	484	8DL3LHg4SB6Q7z2.exe	8DL3LHg4SB6Q7z2.exe
PID 484 wrote to memory of 832	484	8DL3LHg4SB6Q7z2.exe	8DL3LHg4SB6Q7z2.exe
PID 484 wrote to memory of 832	484	8DL3LHg4SB6Q7z2.exe	8DL3LHg4SB6Q7z2.exe
PID 832 wrote to memory of 324	832	8DL3LHg4SB6Q7z2.exe	dw20.exe
PID 832 wrote to memory of 324	832	8DL3LHg4SB6Q7z2.exe	dw20.exe
PID 832 wrote to memory of 324	832	8DL3LHg4SB6Q7z2.exe	dw20.exe
PID 832 wrote to memory of 324	832	8DL3LHg4SB6Q7z2.exe	dw20.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 520
3⤵
PID:324

memory/324-67-0x0000000000000000-mapping.dmp

Download
memory/324-69-0x0000000001D90000-0x0000000001D91000-memory.dmp

Filesize
4KB

Download
memory/484-60-0x0000000075EF1000-0x0000000075EF3000-memory.dmp

Filesize
8KB

Download
memory/484-61-0x00000000000F0000-0x00000000000F1000-memory.dmp

Filesize
4KB

Download
memory/484-62-0x00000000000F1000-0x00000000000F2000-memory.dmp

Filesize
4KB

Download
memory/832-64-0x000000000043767E-mapping.dmp

Download
memory/832-63-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/832-66-0x0000000002310000-0x0000000002311000-memory.dmp

Filesize
4KB

Download