agenttesla | 1d97f0b09573ff206fdc36f12a6c6f30cb55fed8c3789e13b321382421d9151f

General

Target

invoice.exe
Size

1.1MB
MD5

76a240af49acdb8ff5396abb32f84e5a
SHA1

a64f8bdf5ab921873c7fcac67cc380f14c5448d4
SHA256

1d97f0b09573ff206fdc36f12a6c6f30cb55fed8c3789e13b321382421d9151f
SHA512

80ffc303326778dc51962e796af56c4ede35aa465421f03b7e18b9b1b85b36dc28bc87d39e6ca765aeaa4dc3c874fcc07fd1c36a0f29fe7e9706e15ed9f8dd4d

Score

10^/10

Family

agenttesla

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3556-125-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral2/memory/3556-126-0x00000000004374AE-mapping.dmp	family_agenttesla
behavioral2/memory/3556-131-0x0000000004CA0000-0x000000000519E000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

Processes:

invoice.exe

description pid process target process

PID 3916 set thread context of 3556 3916 invoice.exe RegSvcs.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

RegSvcs.exe

pid process

3556 RegSvcs.exe
3556 RegSvcs.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RegSvcs.exe

description pid process

Token: SeDebugPrivilege 3556 RegSvcs.exe

description	pid	process	target process
PID 3916 set thread context of 3556	3916	invoice.exe	RegSvcs.exe

pid	process
3556	RegSvcs.exe
3556	RegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	3556	RegSvcs.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

invoice.exe

description	pid	process	target process
PID 3916 wrote to memory of 3556	3916	invoice.exe	RegSvcs.exe
PID 3916 wrote to memory of 3556	3916	invoice.exe	RegSvcs.exe
PID 3916 wrote to memory of 3556	3916	invoice.exe	RegSvcs.exe
PID 3916 wrote to memory of 3556	3916	invoice.exe	RegSvcs.exe
PID 3916 wrote to memory of 3556	3916	invoice.exe	RegSvcs.exe
PID 3916 wrote to memory of 3556	3916	invoice.exe	RegSvcs.exe
PID 3916 wrote to memory of 3556	3916	invoice.exe	RegSvcs.exe
PID 3916 wrote to memory of 3556	3916	invoice.exe	RegSvcs.exe

memory/3556-125-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3556-133-0x0000000005A00000-0x0000000005A01000-memory.dmp

Filesize
4KB

Download
memory/3556-132-0x0000000005150000-0x0000000005151000-memory.dmp

Filesize
4KB

Download
memory/3556-131-0x0000000004CA0000-0x000000000519E000-memory.dmp

Filesize
5.0MB

Download
memory/3556-126-0x00000000004374AE-mapping.dmp

Download
memory/3916-121-0x0000000005360000-0x000000000585E000-memory.dmp

Filesize
5.0MB

Download
memory/3916-114-0x0000000000940000-0x0000000000941000-memory.dmp

Filesize
4KB

Download
memory/3916-122-0x00000000056C0000-0x00000000056DB000-memory.dmp

Filesize
108KB

Download
memory/3916-123-0x00000000071B0000-0x0000000007262000-memory.dmp

Filesize
712KB

Download
memory/3916-124-0x0000000007880000-0x00000000078EE000-memory.dmp

Filesize
440KB

Download
memory/3916-120-0x0000000005530000-0x0000000005531000-memory.dmp

Filesize
4KB

Download
memory/3916-119-0x0000000005260000-0x0000000005261000-memory.dmp

Filesize
4KB

Download
memory/3916-118-0x0000000005360000-0x0000000005361000-memory.dmp

Filesize
4KB

Download
memory/3916-117-0x0000000005860000-0x0000000005861000-memory.dmp

Filesize
4KB

Download
memory/3916-116-0x00000000052C0000-0x00000000052C1000-memory.dmp

Filesize
4KB

Download