agenttesla | e8c4c52fc84b28da5711b4913aa57d206e31e3f7f0f089cebc2b632e20e84027

General

Target

9PynloBGqHebwTI.exe
Size

835KB
MD5

4767054a1b8210baf87d01af18f428dd
SHA1

bc465fe25171f3f8c1bddee36f62ee768e8faf7a
SHA256

e8c4c52fc84b28da5711b4913aa57d206e31e3f7f0f089cebc2b632e20e84027
SHA512

97fb806434bb4e5b97441a4a00270b2170e5abc53e3aadb30f949d642ec6aa9d72678bda780031a9e2822cdc038e89b6fefd202e294bc64ce103c576a6741290

Score

10^/10

Family

agenttesla

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/796-65-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/796-66-0x00000000004374DE-mapping.dmp	family_agenttesla
behavioral1/memory/796-67-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

Processes:

9PynloBGqHebwTI.exe

description pid process target process

PID 1120 set thread context of 796 1120 9PynloBGqHebwTI.exe 9PynloBGqHebwTI.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

9PynloBGqHebwTI.exe9PynloBGqHebwTI.exe

pid process

1120 9PynloBGqHebwTI.exe
1120 9PynloBGqHebwTI.exe
796 9PynloBGqHebwTI.exe
796 9PynloBGqHebwTI.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

9PynloBGqHebwTI.exe9PynloBGqHebwTI.exe

description pid process

Token: SeDebugPrivilege 1120 9PynloBGqHebwTI.exe
Token: SeDebugPrivilege 796 9PynloBGqHebwTI.exe

description	pid	process	target process
PID 1120 set thread context of 796	1120	9PynloBGqHebwTI.exe	9PynloBGqHebwTI.exe

description	pid	process
Token: SeDebugPrivilege	1120	9PynloBGqHebwTI.exe
Token: SeDebugPrivilege	796	9PynloBGqHebwTI.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

9PynloBGqHebwTI.exe

description	pid	process	target process
PID 1120 wrote to memory of 752	1120	9PynloBGqHebwTI.exe	9PynloBGqHebwTI.exe
PID 1120 wrote to memory of 752	1120	9PynloBGqHebwTI.exe	9PynloBGqHebwTI.exe
PID 1120 wrote to memory of 752	1120	9PynloBGqHebwTI.exe	9PynloBGqHebwTI.exe
PID 1120 wrote to memory of 752	1120	9PynloBGqHebwTI.exe	9PynloBGqHebwTI.exe
PID 1120 wrote to memory of 796	1120	9PynloBGqHebwTI.exe	9PynloBGqHebwTI.exe
PID 1120 wrote to memory of 796	1120	9PynloBGqHebwTI.exe	9PynloBGqHebwTI.exe
PID 1120 wrote to memory of 796	1120	9PynloBGqHebwTI.exe	9PynloBGqHebwTI.exe
PID 1120 wrote to memory of 796	1120	9PynloBGqHebwTI.exe	9PynloBGqHebwTI.exe
PID 1120 wrote to memory of 796	1120	9PynloBGqHebwTI.exe	9PynloBGqHebwTI.exe
PID 1120 wrote to memory of 796	1120	9PynloBGqHebwTI.exe	9PynloBGqHebwTI.exe
PID 1120 wrote to memory of 796	1120	9PynloBGqHebwTI.exe	9PynloBGqHebwTI.exe
PID 1120 wrote to memory of 796	1120	9PynloBGqHebwTI.exe	9PynloBGqHebwTI.exe
PID 1120 wrote to memory of 796	1120	9PynloBGqHebwTI.exe	9PynloBGqHebwTI.exe

C:\Users\Admin\AppData\Local\Temp\9PynloBGqHebwTI.exe
"C:\Users\Admin\AppData\Local\Temp\9PynloBGqHebwTI.exe"
2⤵
PID:752

memory/796-65-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/796-66-0x00000000004374DE-mapping.dmp

Download
memory/796-67-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/796-69-0x0000000004BE0000-0x0000000004BE1000-memory.dmp

Filesize
4KB

Download
memory/1120-59-0x00000000000D0000-0x00000000000D1000-memory.dmp

Filesize
4KB

Download
memory/1120-61-0x0000000004E00000-0x0000000004E01000-memory.dmp

Filesize
4KB

Download
memory/1120-62-0x0000000000320000-0x000000000033B000-memory.dmp

Filesize
108KB

Download
memory/1120-63-0x0000000005AF0000-0x0000000005B72000-memory.dmp

Filesize
520KB

Download
memory/1120-64-0x00000000005B0000-0x00000000005EE000-memory.dmp

Filesize
248KB

Download