agenttesla | b33da17596e956896a4791449395b6c8eee6e9d214b645373b218bc23240e203

General

Target

QUOTE B1020363.pdf.exe
Size

735KB
MD5

8c817545d7ba60333a000ba5ce565776
SHA1

e2c55dc26dde7b0e07b950d9753ccee89d0216f0
SHA256

26799266072f7aeaf11cfe54773cd3f387dd383bb8900cf1708a8db00740d101
SHA512

2beec0619d4834e696f6c30513a9007e2e0c822c0290221de050b422abdd5e99025561ada8508e085d6415479a35eaef47f7040c3b5b1bffb464f0e95316d241

Score

10^/10

Family

agenttesla

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3436-124-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral2/memory/3436-125-0x00000000004374DE-mapping.dmp	family_agenttesla
behavioral2/memory/3436-130-0x0000000005530000-0x0000000005A2E000-memory.dmp	family_agenttesla
behavioral2/memory/3436-135-0x0000000005530000-0x0000000005A2E000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

Processes:

QUOTE B1020363.pdf.exe

description pid process target process

PID 856 set thread context of 3436 856 QUOTE B1020363.pdf.exe RegSvcs.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

RegSvcs.exe

pid process

3436 RegSvcs.exe
3436 RegSvcs.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RegSvcs.exe

description pid process

Token: SeDebugPrivilege 3436 RegSvcs.exe

description	pid	process	target process
PID 856 set thread context of 3436	856	QUOTE B1020363.pdf.exe	RegSvcs.exe

pid	process
3436	RegSvcs.exe
3436	RegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	3436	RegSvcs.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

QUOTE B1020363.pdf.exe

description	pid	process	target process
PID 856 wrote to memory of 3436	856	QUOTE B1020363.pdf.exe	RegSvcs.exe
PID 856 wrote to memory of 3436	856	QUOTE B1020363.pdf.exe	RegSvcs.exe
PID 856 wrote to memory of 3436	856	QUOTE B1020363.pdf.exe	RegSvcs.exe
PID 856 wrote to memory of 3436	856	QUOTE B1020363.pdf.exe	RegSvcs.exe
PID 856 wrote to memory of 3436	856	QUOTE B1020363.pdf.exe	RegSvcs.exe
PID 856 wrote to memory of 3436	856	QUOTE B1020363.pdf.exe	RegSvcs.exe
PID 856 wrote to memory of 3436	856	QUOTE B1020363.pdf.exe	RegSvcs.exe
PID 856 wrote to memory of 3436	856	QUOTE B1020363.pdf.exe	RegSvcs.exe

memory/856-114-0x0000000000D10000-0x0000000000D11000-memory.dmp

Filesize
4KB

Download
memory/856-116-0x0000000008090000-0x0000000008091000-memory.dmp

Filesize
4KB

Download
memory/856-117-0x0000000007C30000-0x0000000007C31000-memory.dmp

Filesize
4KB

Download
memory/856-118-0x0000000007B90000-0x000000000808E000-memory.dmp

Filesize
5.0MB

Download
memory/856-119-0x0000000007DA0000-0x0000000007DA1000-memory.dmp

Filesize
4KB

Download
memory/856-120-0x000000000B0F0000-0x000000000B0F1000-memory.dmp

Filesize
4KB

Download
memory/856-121-0x0000000005180000-0x000000000518E000-memory.dmp

Filesize
56KB

Download
memory/856-122-0x0000000005B60000-0x0000000005BF5000-memory.dmp

Filesize
596KB

Download
memory/856-123-0x00000000061D0000-0x0000000006224000-memory.dmp

Filesize
336KB

Download
memory/3436-124-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3436-125-0x00000000004374DE-mapping.dmp

Download
memory/3436-130-0x0000000005530000-0x0000000005A2E000-memory.dmp

Filesize
5.0MB

Download
memory/3436-131-0x00000000055B0000-0x00000000055B1000-memory.dmp

Filesize
4KB

Download
memory/3436-132-0x0000000006220000-0x0000000006221000-memory.dmp

Filesize
4KB

Download
memory/3436-135-0x0000000005530000-0x0000000005A2E000-memory.dmp

Filesize
5.0MB

Download