agenttesla | 173823409774ef479a83ebbf296e78199779fd5641fd7a6ec7a1e0e0653b948a

Analysis

Target

SWIFT_COPY.exe
Size

1.1MB
MD5

52862946ab473edb24310638e680f352
SHA1

19be1f62b40398ffb074397ef6fb797377228a6b
SHA256

8fcc1d5411f20280e9e142e535fb622aa55d6117030c1644032e5e2e709ef98a
SHA512

f4f1f0b784c3318932ce4eee4c1f5ec0f29d1adbe77b7986cd5276b29601a17bd683e7bc94ac626cea3a8733c58acbb06e6c07bb510f1634792ef0f3fbf03eb2

Score

10^/10

Family

agenttesla

https://api.telegram.org/bot1437981864:AAFmXsejy8kUC_pj3BwrEvAeb2cv12XMVZI/sendDocument

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1628-66-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1628-67-0x000000000043775E-mapping.dmp	family_agenttesla
behavioral1/memory/1628-68-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

Processes:

SWIFT_COPY.exe

description pid process target process

PID 1088 set thread context of 1628 1088 SWIFT_COPY.exe SWIFT_COPY.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

SWIFT_COPY.exe

pid process

1628 SWIFT_COPY.exe
1628 SWIFT_COPY.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

SWIFT_COPY.exe

description pid process

Token: SeDebugPrivilege 1628 SWIFT_COPY.exe

description	pid	process	target process
PID 1088 set thread context of 1628	1088	SWIFT_COPY.exe	SWIFT_COPY.exe

pid	process
1628	SWIFT_COPY.exe
1628	SWIFT_COPY.exe

description	pid	process
Token: SeDebugPrivilege	1628	SWIFT_COPY.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

SWIFT_COPY.exe

description	pid	process	target process
PID 1088 wrote to memory of 1628	1088	SWIFT_COPY.exe	SWIFT_COPY.exe
PID 1088 wrote to memory of 1628	1088	SWIFT_COPY.exe	SWIFT_COPY.exe
PID 1088 wrote to memory of 1628	1088	SWIFT_COPY.exe	SWIFT_COPY.exe
PID 1088 wrote to memory of 1628	1088	SWIFT_COPY.exe	SWIFT_COPY.exe
PID 1088 wrote to memory of 1628	1088	SWIFT_COPY.exe	SWIFT_COPY.exe
PID 1088 wrote to memory of 1628	1088	SWIFT_COPY.exe	SWIFT_COPY.exe
PID 1088 wrote to memory of 1628	1088	SWIFT_COPY.exe	SWIFT_COPY.exe
PID 1088 wrote to memory of 1628	1088	SWIFT_COPY.exe	SWIFT_COPY.exe
PID 1088 wrote to memory of 1628	1088	SWIFT_COPY.exe	SWIFT_COPY.exe

memory/1088-60-0x0000000000F70000-0x0000000000F71000-memory.dmp

Filesize
4KB

Download
memory/1088-62-0x0000000004B90000-0x0000000004B91000-memory.dmp

Filesize
4KB

Download
memory/1088-63-0x0000000000460000-0x000000000047B000-memory.dmp

Filesize
108KB

Download
memory/1088-64-0x0000000005120000-0x00000000051A2000-memory.dmp

Filesize
520KB

Download
memory/1088-65-0x0000000000CA0000-0x0000000000CDE000-memory.dmp

Filesize
248KB

Download
memory/1628-66-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1628-67-0x000000000043775E-mapping.dmp

Download
memory/1628-68-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1628-70-0x0000000004B40000-0x0000000004B41000-memory.dmp

Filesize
4KB

Download