agenttesla | 34d69bd8b5f821d7287f3e04e119b2c039721d09232ad769c5209dc2605f20b7

Analysis

Target

Ref 4359-0201-106.034.exe
Size

1.1MB
MD5

8120bed0e0875b8318ace086962b79ba
SHA1

d50078fa3081c0b6b4ce281d3e6a90263e936dc6
SHA256

34d69bd8b5f821d7287f3e04e119b2c039721d09232ad769c5209dc2605f20b7
SHA512

cad1162dcac930c55a3dde2640d27ef6d77d0781379b43a4b77a43281036de76fccb79b27798828dd1cb3c5b3973af4500eb54d9e09fe40737bff4f7292d1cfb

Score

10^/10

Family

agenttesla

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 5 IoCs

Processes:

resource	yara_rule
behavioral2/memory/820-115-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral2/memory/820-116-0x00000000004374EE-mapping.dmp	family_agenttesla
behavioral2/memory/820-117-0x0000000000DC0000-0x0000000000E6E000-memory.dmp	family_agenttesla
behavioral2/memory/820-118-0x0000000000DC0000-0x0000000000E6E000-memory.dmp	family_agenttesla
behavioral2/memory/820-119-0x0000000000DC0000-0x0000000000E6E000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

Processes:

Ref 4359-0201-106.034.exe

description pid process target process

PID 636 set thread context of 820 636 Ref 4359-0201-106.034.exe RegSvcs.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

RegSvcs.exe

pid process

820 RegSvcs.exe
820 RegSvcs.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RegSvcs.exe

description pid process

Token: SeDebugPrivilege 820 RegSvcs.exe

description	pid	process	target process
PID 636 set thread context of 820	636	Ref 4359-0201-106.034.exe	RegSvcs.exe

pid	process
820	RegSvcs.exe
820	RegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	820	RegSvcs.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

Ref 4359-0201-106.034.exe

description	pid	process	target process
PID 636 wrote to memory of 820	636	Ref 4359-0201-106.034.exe	RegSvcs.exe
PID 636 wrote to memory of 820	636	Ref 4359-0201-106.034.exe	RegSvcs.exe
PID 636 wrote to memory of 820	636	Ref 4359-0201-106.034.exe	RegSvcs.exe
PID 636 wrote to memory of 820	636	Ref 4359-0201-106.034.exe	RegSvcs.exe
PID 636 wrote to memory of 820	636	Ref 4359-0201-106.034.exe	RegSvcs.exe
PID 636 wrote to memory of 820	636	Ref 4359-0201-106.034.exe	RegSvcs.exe
PID 636 wrote to memory of 820	636	Ref 4359-0201-106.034.exe	RegSvcs.exe
PID 636 wrote to memory of 820	636	Ref 4359-0201-106.034.exe	RegSvcs.exe

memory/636-114-0x0000000002EF0000-0x0000000002EF1000-memory.dmp

Filesize
4KB

Download
memory/820-115-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/820-116-0x00000000004374EE-mapping.dmp

Download
memory/820-117-0x0000000000DC0000-0x0000000000E6E000-memory.dmp

Filesize
696KB

Download
memory/820-118-0x0000000000DC0000-0x0000000000E6E000-memory.dmp

Filesize
696KB

Download
memory/820-119-0x0000000000DC0000-0x0000000000E6E000-memory.dmp

Filesize
696KB

Download