agenttesla | 3a121fe0868a35e1b49b0d37241d04bcef95d9b34bcd3b33736857c9b59c846d

General

Target

Ref 4359-0201-106.034.exe
Size

749KB
MD5

b494cae2a5d2841dfc30166f2420b591
SHA1

02d3c49ab6714d37974031ac5236b285a251668c
SHA256

3a121fe0868a35e1b49b0d37241d04bcef95d9b34bcd3b33736857c9b59c846d
SHA512

ba5d8bf08d7c8b549c728893261468c789ca0965c4fb301e64ac0f21e23687c0d6ebd13c25d2745aad6078636be09bfb4c741992a610b4156617dd676551e16b

Score

10^/10

Family

agenttesla

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1696-62-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1696-63-0x0000000000437A2E-mapping.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

Processes:

Ref 4359-0201-106.034.exe

description pid process target process

PID 1092 set thread context of 1696 1092 Ref 4359-0201-106.034.exe RegSvcs.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

dw20.exe

pid process

472 dw20.exe

description	pid	process	target process
PID 1092 set thread context of 1696	1092	Ref 4359-0201-106.034.exe	RegSvcs.exe

pid	process
472	dw20.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

Ref 4359-0201-106.034.exeRegSvcs.exe

description	pid	process	target process
PID 1092 wrote to memory of 1696	1092	Ref 4359-0201-106.034.exe	RegSvcs.exe
PID 1092 wrote to memory of 1696	1092	Ref 4359-0201-106.034.exe	RegSvcs.exe
PID 1092 wrote to memory of 1696	1092	Ref 4359-0201-106.034.exe	RegSvcs.exe
PID 1092 wrote to memory of 1696	1092	Ref 4359-0201-106.034.exe	RegSvcs.exe
PID 1092 wrote to memory of 1696	1092	Ref 4359-0201-106.034.exe	RegSvcs.exe
PID 1092 wrote to memory of 1696	1092	Ref 4359-0201-106.034.exe	RegSvcs.exe
PID 1092 wrote to memory of 1696	1092	Ref 4359-0201-106.034.exe	RegSvcs.exe
PID 1092 wrote to memory of 1696	1092	Ref 4359-0201-106.034.exe	RegSvcs.exe
PID 1092 wrote to memory of 1696	1092	Ref 4359-0201-106.034.exe	RegSvcs.exe
PID 1092 wrote to memory of 1696	1092	Ref 4359-0201-106.034.exe	RegSvcs.exe
PID 1092 wrote to memory of 1696	1092	Ref 4359-0201-106.034.exe	RegSvcs.exe
PID 1092 wrote to memory of 1696	1092	Ref 4359-0201-106.034.exe	RegSvcs.exe
PID 1696 wrote to memory of 472	1696	RegSvcs.exe	dw20.exe
PID 1696 wrote to memory of 472	1696	RegSvcs.exe	dw20.exe
PID 1696 wrote to memory of 472	1696	RegSvcs.exe	dw20.exe
PID 1696 wrote to memory of 472	1696	RegSvcs.exe	dw20.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
"{path}"
2⤵
- Suspicious use of WriteProcessMemory
PID:1696

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 388
3⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:472

memory/472-65-0x0000000000000000-mapping.dmp

Download
memory/472-68-0x0000000002480000-0x0000000002481000-memory.dmp

Filesize
4KB

Download
memory/1092-59-0x0000000075A31000-0x0000000075A33000-memory.dmp

Filesize
8KB

Download
memory/1092-60-0x0000000000D30000-0x0000000000D31000-memory.dmp

Filesize
4KB

Download
memory/1092-61-0x0000000000D31000-0x0000000000D32000-memory.dmp

Filesize
4KB

Download
memory/1696-62-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1696-63-0x0000000000437A2E-mapping.dmp

Download
memory/1696-67-0x00000000004B0000-0x00000000004B1000-memory.dmp

Filesize
4KB

Download