agenttesla | 1d97f0b09573ff206fdc36f12a6c6f30cb55fed8c3789e13b321382421d9151f

General

Target

invoice.exe
Size

1.1MB
MD5

76a240af49acdb8ff5396abb32f84e5a
SHA1

a64f8bdf5ab921873c7fcac67cc380f14c5448d4
SHA256

1d97f0b09573ff206fdc36f12a6c6f30cb55fed8c3789e13b321382421d9151f
SHA512

80ffc303326778dc51962e796af56c4ede35aa465421f03b7e18b9b1b85b36dc28bc87d39e6ca765aeaa4dc3c874fcc07fd1c36a0f29fe7e9706e15ed9f8dd4d

Score

10^/10

Family

agenttesla

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1696-65-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1696-66-0x00000000004374AE-mapping.dmp	family_agenttesla
behavioral1/memory/1696-67-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

Processes:

invoice.exe

description pid process target process

PID 1100 set thread context of 1696 1100 invoice.exe RegSvcs.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

RegSvcs.exe

pid process

1696 RegSvcs.exe
1696 RegSvcs.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RegSvcs.exe

description pid process

Token: SeDebugPrivilege 1696 RegSvcs.exe

description	pid	process	target process
PID 1100 set thread context of 1696	1100	invoice.exe	RegSvcs.exe

pid	process
1696	RegSvcs.exe
1696	RegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	1696	RegSvcs.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

invoice.exe

description	pid	process	target process
PID 1100 wrote to memory of 1696	1100	invoice.exe	RegSvcs.exe
PID 1100 wrote to memory of 1696	1100	invoice.exe	RegSvcs.exe
PID 1100 wrote to memory of 1696	1100	invoice.exe	RegSvcs.exe
PID 1100 wrote to memory of 1696	1100	invoice.exe	RegSvcs.exe
PID 1100 wrote to memory of 1696	1100	invoice.exe	RegSvcs.exe
PID 1100 wrote to memory of 1696	1100	invoice.exe	RegSvcs.exe
PID 1100 wrote to memory of 1696	1100	invoice.exe	RegSvcs.exe
PID 1100 wrote to memory of 1696	1100	invoice.exe	RegSvcs.exe
PID 1100 wrote to memory of 1696	1100	invoice.exe	RegSvcs.exe
PID 1100 wrote to memory of 1696	1100	invoice.exe	RegSvcs.exe
PID 1100 wrote to memory of 1696	1100	invoice.exe	RegSvcs.exe
PID 1100 wrote to memory of 1696	1100	invoice.exe	RegSvcs.exe

memory/1100-59-0x0000000000B90000-0x0000000000B91000-memory.dmp

Filesize
4KB

Download
memory/1100-61-0x0000000000A10000-0x0000000000A11000-memory.dmp

Filesize
4KB

Download
memory/1100-62-0x0000000000AE0000-0x0000000000AFB000-memory.dmp

Filesize
108KB

Download
memory/1100-63-0x0000000005670000-0x0000000005722000-memory.dmp

Filesize
712KB

Download
memory/1100-64-0x0000000005780000-0x00000000057EE000-memory.dmp

Filesize
440KB

Download
memory/1696-65-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1696-66-0x00000000004374AE-mapping.dmp

Download
memory/1696-67-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1696-69-0x0000000004AA0000-0x0000000004AA1000-memory.dmp

Filesize
4KB

Download