agenttesla | 2f639103b3a2a16f0eacad22c7df0a037c3a45d74cfe09ce96f86e13fe74a1b8

General

Target

P44898408970-1.exe
Size

894KB
MD5

fb06ed245f080393bbfe1ae577053085
SHA1

a003c960669f5a64ae182dcfc9d7185750a84f0d
SHA256

2f639103b3a2a16f0eacad22c7df0a037c3a45d74cfe09ce96f86e13fe74a1b8
SHA512

cf75bb4fe26c743c3e448700a7baccb233f82113562afd46836beebe0593a21adc34d15de9dfa7918a034b6b75a8e2a4c989391c1b3dcf08a17dc8b0983932e3

Score

10^/10

Family

agenttesla

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1072-63-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1072-64-0x00000000004374EE-mapping.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

Processes:

P44898408970-1.exe

description pid process target process

PID 1652 set thread context of 1072 1652 P44898408970-1.exe RegSvcs.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

P44898408970-1.exeRegSvcs.exe

pid process

1652 P44898408970-1.exe
1652 P44898408970-1.exe
1072 RegSvcs.exe
1072 RegSvcs.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

P44898408970-1.exeRegSvcs.exe

description pid process

Token: SeDebugPrivilege 1652 P44898408970-1.exe
Token: SeDebugPrivilege 1072 RegSvcs.exe

description	pid	process	target process
PID 1652 set thread context of 1072	1652	P44898408970-1.exe	RegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	1652	P44898408970-1.exe
Token: SeDebugPrivilege	1072	RegSvcs.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

P44898408970-1.exeRegSvcs.exe

description	pid	process	target process
PID 1652 wrote to memory of 792	1652	P44898408970-1.exe	RegSvcs.exe
PID 1652 wrote to memory of 792	1652	P44898408970-1.exe	RegSvcs.exe
PID 1652 wrote to memory of 792	1652	P44898408970-1.exe	RegSvcs.exe
PID 1652 wrote to memory of 792	1652	P44898408970-1.exe	RegSvcs.exe
PID 1652 wrote to memory of 792	1652	P44898408970-1.exe	RegSvcs.exe
PID 1652 wrote to memory of 792	1652	P44898408970-1.exe	RegSvcs.exe
PID 1652 wrote to memory of 792	1652	P44898408970-1.exe	RegSvcs.exe
PID 1652 wrote to memory of 1072	1652	P44898408970-1.exe	RegSvcs.exe
PID 1652 wrote to memory of 1072	1652	P44898408970-1.exe	RegSvcs.exe
PID 1652 wrote to memory of 1072	1652	P44898408970-1.exe	RegSvcs.exe
PID 1652 wrote to memory of 1072	1652	P44898408970-1.exe	RegSvcs.exe
PID 1652 wrote to memory of 1072	1652	P44898408970-1.exe	RegSvcs.exe
PID 1652 wrote to memory of 1072	1652	P44898408970-1.exe	RegSvcs.exe
PID 1652 wrote to memory of 1072	1652	P44898408970-1.exe	RegSvcs.exe
PID 1652 wrote to memory of 1072	1652	P44898408970-1.exe	RegSvcs.exe
PID 1652 wrote to memory of 1072	1652	P44898408970-1.exe	RegSvcs.exe
PID 1652 wrote to memory of 1072	1652	P44898408970-1.exe	RegSvcs.exe
PID 1652 wrote to memory of 1072	1652	P44898408970-1.exe	RegSvcs.exe
PID 1652 wrote to memory of 1072	1652	P44898408970-1.exe	RegSvcs.exe
PID 1072 wrote to memory of 916	1072	RegSvcs.exe	dw20.exe
PID 1072 wrote to memory of 916	1072	RegSvcs.exe	dw20.exe
PID 1072 wrote to memory of 916	1072	RegSvcs.exe	dw20.exe
PID 1072 wrote to memory of 916	1072	RegSvcs.exe	dw20.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 520
3⤵
PID:916

memory/916-67-0x0000000000000000-mapping.dmp

Download
memory/916-69-0x0000000002600000-0x0000000002601000-memory.dmp

Filesize
4KB

Download
memory/1072-63-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1072-64-0x00000000004374EE-mapping.dmp

Download
memory/1072-66-0x0000000000680000-0x0000000000681000-memory.dmp

Filesize
4KB

Download
memory/1652-60-0x00000000754F1000-0x00000000754F3000-memory.dmp

Filesize
8KB

Download
memory/1652-61-0x00000000007A0000-0x00000000007A1000-memory.dmp

Filesize
4KB

Download
memory/1652-62-0x00000000007A1000-0x00000000007A2000-memory.dmp

Filesize
4KB

Download