agenttesla | 7fa3b55ce11219e0e1ec66f25d9eb886a0510863a2d3c98a79c817ffd5d579ae

General

Target

RFQ03121013.exe
Size

767KB
MD5

b865eba7ad12435f66fcc532eeb6f2ce
SHA1

53c1a9b23d65b6dc77bf79aebdef23ee815106f7
SHA256

a22a93aa201096c6ae9d68aa245093f3b922b90e31a529ce94bcdbd2c0507e86
SHA512

e0c8080044ad1d0a57f70c4834be9b62468bd61ec85f3464dfcdf1efe6efba6b9b22f57f1a6294c729fcaa9f0a4a79a28e5b03fdb05d4fae0781eca18ee07265

Score

10^/10

Family

agenttesla

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1360-126-0x00000000004374DE-mapping.dmp	family_agenttesla
behavioral1/memory/1360-125-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1360-131-0x0000000005540000-0x0000000005A3E000-memory.dmp	family_agenttesla
behavioral1/memory/1360-136-0x0000000005540000-0x0000000005A3E000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

Processes:

RFQ03121013.exe

description pid process target process

PID 3908 set thread context of 1360 3908 RFQ03121013.exe RegSvcs.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

RegSvcs.exe

pid process

1360 RegSvcs.exe
1360 RegSvcs.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

RFQ03121013.exeRegSvcs.exe

description pid process

Token: SeDebugPrivilege 3908 RFQ03121013.exe
Token: SeDebugPrivilege 1360 RegSvcs.exe

description	pid	process	target process
PID 3908 set thread context of 1360	3908	RFQ03121013.exe	RegSvcs.exe

pid	process
1360	RegSvcs.exe
1360	RegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	3908	RFQ03121013.exe
Token: SeDebugPrivilege	1360	RegSvcs.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

RFQ03121013.exe

description	pid	process	target process
PID 3908 wrote to memory of 1360	3908	RFQ03121013.exe	RegSvcs.exe
PID 3908 wrote to memory of 1360	3908	RFQ03121013.exe	RegSvcs.exe
PID 3908 wrote to memory of 1360	3908	RFQ03121013.exe	RegSvcs.exe
PID 3908 wrote to memory of 1360	3908	RFQ03121013.exe	RegSvcs.exe
PID 3908 wrote to memory of 1360	3908	RFQ03121013.exe	RegSvcs.exe
PID 3908 wrote to memory of 1360	3908	RFQ03121013.exe	RegSvcs.exe
PID 3908 wrote to memory of 1360	3908	RFQ03121013.exe	RegSvcs.exe
PID 3908 wrote to memory of 1360	3908	RFQ03121013.exe	RegSvcs.exe

memory/1360-126-0x00000000004374DE-mapping.dmp

Download
memory/1360-136-0x0000000005540000-0x0000000005A3E000-memory.dmp

Filesize
5.0MB

Download
memory/1360-133-0x00000000061A0000-0x00000000061A1000-memory.dmp

Filesize
4KB

Download
memory/1360-132-0x0000000005A10000-0x0000000005A11000-memory.dmp

Filesize
4KB

Download
memory/1360-131-0x0000000005540000-0x0000000005A3E000-memory.dmp

Filesize
5.0MB

Download
memory/1360-125-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3908-119-0x000000000A4E0000-0x000000000A4E1000-memory.dmp

Filesize
4KB

Download
memory/3908-122-0x0000000004FF0000-0x000000000500B000-memory.dmp

Filesize
108KB

Download
memory/3908-123-0x0000000000E20000-0x0000000000EA1000-memory.dmp

Filesize
516KB

Download
memory/3908-124-0x0000000000EC0000-0x0000000000EFD000-memory.dmp

Filesize
244KB

Download
memory/3908-121-0x0000000004E90000-0x0000000004E91000-memory.dmp

Filesize
4KB

Download
memory/3908-120-0x0000000002910000-0x0000000002911000-memory.dmp

Filesize
4KB

Download
memory/3908-114-0x0000000000540000-0x0000000000541000-memory.dmp

Filesize
4KB

Download
memory/3908-118-0x000000000A3A0000-0x000000000A3A1000-memory.dmp

Filesize
4KB

Download
memory/3908-117-0x000000000A860000-0x000000000A861000-memory.dmp

Filesize
4KB

Download
memory/3908-116-0x0000000004DB0000-0x0000000004E6A000-memory.dmp

Filesize
744KB

Download