agenttesla | eaff71128153dd8aca8aee7ae6ba8fa4b9e93d4592b3093bd4e19b8eb1d0ee36

General

Target

Ref 4359-0201-106.034.exe
Size

1.1MB
MD5

8120bed0e0875b8318ace086962b79ba
SHA1

d50078fa3081c0b6b4ce281d3e6a90263e936dc6
SHA256

34d69bd8b5f821d7287f3e04e119b2c039721d09232ad769c5209dc2605f20b7
SHA512

cad1162dcac930c55a3dde2640d27ef6d77d0781379b43a4b77a43281036de76fccb79b27798828dd1cb3c5b3973af4500eb54d9e09fe40737bff4f7292d1cfb

Score

10^/10

Family

agenttesla

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1576-63-0x00000000004374EE-mapping.dmp	family_agenttesla
behavioral1/memory/1576-62-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

Processes:

Ref 4359-0201-106.034.exe

description pid process target process

PID 1040 set thread context of 1576 1040 Ref 4359-0201-106.034.exe RegSvcs.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

RegSvcs.exe

pid process

1576 RegSvcs.exe
1576 RegSvcs.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

dw20.exe

pid process

756 dw20.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RegSvcs.exe

description pid process

Token: SeDebugPrivilege 1576 RegSvcs.exe

description	pid	process	target process
PID 1040 set thread context of 1576	1040	Ref 4359-0201-106.034.exe	RegSvcs.exe

pid	process
1576	RegSvcs.exe
1576	RegSvcs.exe

pid	process
756	dw20.exe

description	pid	process
Token: SeDebugPrivilege	1576	RegSvcs.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

Ref 4359-0201-106.034.exeRegSvcs.exe

description	pid	process	target process
PID 1040 wrote to memory of 1576	1040	Ref 4359-0201-106.034.exe	RegSvcs.exe
PID 1040 wrote to memory of 1576	1040	Ref 4359-0201-106.034.exe	RegSvcs.exe
PID 1040 wrote to memory of 1576	1040	Ref 4359-0201-106.034.exe	RegSvcs.exe
PID 1040 wrote to memory of 1576	1040	Ref 4359-0201-106.034.exe	RegSvcs.exe
PID 1040 wrote to memory of 1576	1040	Ref 4359-0201-106.034.exe	RegSvcs.exe
PID 1040 wrote to memory of 1576	1040	Ref 4359-0201-106.034.exe	RegSvcs.exe
PID 1040 wrote to memory of 1576	1040	Ref 4359-0201-106.034.exe	RegSvcs.exe
PID 1040 wrote to memory of 1576	1040	Ref 4359-0201-106.034.exe	RegSvcs.exe
PID 1040 wrote to memory of 1576	1040	Ref 4359-0201-106.034.exe	RegSvcs.exe
PID 1040 wrote to memory of 1576	1040	Ref 4359-0201-106.034.exe	RegSvcs.exe
PID 1040 wrote to memory of 1576	1040	Ref 4359-0201-106.034.exe	RegSvcs.exe
PID 1040 wrote to memory of 1576	1040	Ref 4359-0201-106.034.exe	RegSvcs.exe
PID 1576 wrote to memory of 756	1576	RegSvcs.exe	dw20.exe
PID 1576 wrote to memory of 756	1576	RegSvcs.exe	dw20.exe
PID 1576 wrote to memory of 756	1576	RegSvcs.exe	dw20.exe
PID 1576 wrote to memory of 756	1576	RegSvcs.exe	dw20.exe

memory/756-66-0x0000000000000000-mapping.dmp

Download
memory/756-68-0x0000000002600000-0x0000000002601000-memory.dmp

Filesize
4KB

Download
memory/1040-59-0x0000000074F31000-0x0000000074F33000-memory.dmp

Filesize
8KB

Download
memory/1040-60-0x00000000024E0000-0x00000000024E1000-memory.dmp

Filesize
4KB

Download
memory/1040-61-0x00000000024E1000-0x00000000024E2000-memory.dmp

Filesize
4KB

Download
memory/1576-63-0x00000000004374EE-mapping.dmp

Download
memory/1576-62-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1576-65-0x0000000002140000-0x0000000002141000-memory.dmp

Filesize
4KB

Download