AgentTesla

Agent Tesla is a remote access tool (RAT) written in visual basic.

Process spawned unexpected child process

This typically indicates the parent process was compromised via an exploit or macro.

WarzoneRat, AveMaria

WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

AgentTesla Payload

Blocklisted process makes network request

Downloads MZ/PE file

Executes dropped EXE

Sets DLL path for service in the registry