agenttesla | dd2262c470cbff3cef7f965e0c457de414eb71bb0ad94ffc2d64aef577462d14

Analysis

Target
Ref 10M-86776.exe
Size 1.0MB
Sample210722-2s9nsf2lma
SHA256 dd2262c470cbff3cef7f965e0c457de414eb71bb0ad94ffc2d64aef577462d14
MD5 b6e7578868743fb3b695b388dcce06b2
SHA1 1632882505f3f76b0962e767da08623357a59372
SHA512 00a75a815838c1ebb912456fc70d43a7a8f5cca76c2d9a355af047975e5de5d5511f04d80685397e12a0057e9141d1595055e69e5c90dd290d9f6637c888469b
MD5 SHA1 SHA512

Score

10^/10

Family

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 2 IoCs

resource	yara_rule
behavioral2/memory/1964-116-0x00000000004379FE-mapping.dmp	family_agenttesla
behavioral2/memory/1964-115-0x0000000000400000-0x0000000000478000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 652 set thread context of 1964	652	Ref 10M-86776.exe	79

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 652 wrote to memory of 2304	652	Ref 10M-86776.exe	78
PID 652 wrote to memory of 2304	652	Ref 10M-86776.exe	78
PID 652 wrote to memory of 2304	652	Ref 10M-86776.exe	78
PID 652 wrote to memory of 1964	652	Ref 10M-86776.exe	79
PID 652 wrote to memory of 1964	652	Ref 10M-86776.exe	79
PID 652 wrote to memory of 1964	652	Ref 10M-86776.exe	79
PID 652 wrote to memory of 1964	652	Ref 10M-86776.exe	79
PID 652 wrote to memory of 1964	652	Ref 10M-86776.exe	79
PID 652 wrote to memory of 1964	652	Ref 10M-86776.exe	79
PID 652 wrote to memory of 1964	652	Ref 10M-86776.exe	79
PID 652 wrote to memory of 1964	652	Ref 10M-86776.exe	79
PID 1964 wrote to memory of 1416	1964	RegSvcs.exe	80
PID 1964 wrote to memory of 1416	1964	RegSvcs.exe	80
PID 1964 wrote to memory of 1416	1964	RegSvcs.exe	80

C:\Users\Admin\AppData\Local\Temp\Ref 10M-86776.exe
"C:\Users\Admin\AppData\Local\Temp\Ref 10M-86776.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:652
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
  "{path}"
  2⤵
  PID:2304
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
  "{path}"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1964
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
    dw20.exe -x -s 696
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1416

memory/652-114-0x0000000000EA0000-0x0000000000EA1000-memory.dmp

Download

memory/1964-115-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/1964-118-0x00000000027D0000-0x00000000027D1000-memory.dmp

Download