agenttesla | 723b9b35a4589438b1f7b3aa1306762c1a8bbb40e58b721bdb26248cfe5b4817

Analysis

Target

AWL DOCUMENTS.exe
Size

1.1MB
MD5

dc7c594729e403ce1d87f86e3a7b19cf
SHA1

067371590de6f458e54bb34640ee2ef68156cc4e
SHA256

723b9b35a4589438b1f7b3aa1306762c1a8bbb40e58b721bdb26248cfe5b4817
SHA512

42ed8d8cfbb190e908000ca7d65340bc412cf81db81e04105817b78aa2dc88bccd22de43b0e5f2b983433729b3bb2203224fe27b07832ef0b28d6cd4a6a3d504

Score

10^/10

Family

agenttesla

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/616-65-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/616-66-0x00000000004365BE-mapping.dmp	family_agenttesla
behavioral1/memory/616-67-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

Processes:

AWL DOCUMENTS.exe

description pid process target process

PID 468 set thread context of 616 468 AWL DOCUMENTS.exe AWL DOCUMENTS.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

AWL DOCUMENTS.exe

pid process

616 AWL DOCUMENTS.exe
616 AWL DOCUMENTS.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

AWL DOCUMENTS.exe

description pid process

Token: SeDebugPrivilege 616 AWL DOCUMENTS.exe

description	pid	process	target process
PID 468 set thread context of 616	468	AWL DOCUMENTS.exe	AWL DOCUMENTS.exe

pid	process
616	AWL DOCUMENTS.exe
616	AWL DOCUMENTS.exe

description	pid	process
Token: SeDebugPrivilege	616	AWL DOCUMENTS.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

AWL DOCUMENTS.exe

description	pid	process	target process
PID 468 wrote to memory of 616	468	AWL DOCUMENTS.exe	AWL DOCUMENTS.exe
PID 468 wrote to memory of 616	468	AWL DOCUMENTS.exe	AWL DOCUMENTS.exe
PID 468 wrote to memory of 616	468	AWL DOCUMENTS.exe	AWL DOCUMENTS.exe
PID 468 wrote to memory of 616	468	AWL DOCUMENTS.exe	AWL DOCUMENTS.exe
PID 468 wrote to memory of 616	468	AWL DOCUMENTS.exe	AWL DOCUMENTS.exe
PID 468 wrote to memory of 616	468	AWL DOCUMENTS.exe	AWL DOCUMENTS.exe
PID 468 wrote to memory of 616	468	AWL DOCUMENTS.exe	AWL DOCUMENTS.exe
PID 468 wrote to memory of 616	468	AWL DOCUMENTS.exe	AWL DOCUMENTS.exe
PID 468 wrote to memory of 616	468	AWL DOCUMENTS.exe	AWL DOCUMENTS.exe

memory/468-59-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/468-61-0x0000000004760000-0x0000000004761000-memory.dmp

Filesize
4KB

Download
memory/468-62-0x0000000000470000-0x0000000000472000-memory.dmp

Filesize
8KB

Download
memory/468-63-0x0000000008110000-0x00000000081C0000-memory.dmp

Filesize
704KB

Download
memory/468-64-0x0000000007FB0000-0x0000000008022000-memory.dmp

Filesize
456KB

Download
memory/616-65-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/616-66-0x00000000004365BE-mapping.dmp

Download
memory/616-67-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/616-69-0x0000000002090000-0x0000000002091000-memory.dmp

Filesize
4KB

Download