agenttesla | e1b8ac04414e9c6ad5899d525e6c8a7bafeccde2fb255fe4ed23c24afb721da0

General

Target

z2tcOyqI7985wOo.exe
Size

673KB
MD5

5d57a40ff54e66f72b06f0c581d2163e
SHA1

81c4a3c92234aeb9cc42c379327b7e566653d18e
SHA256

e1b8ac04414e9c6ad5899d525e6c8a7bafeccde2fb255fe4ed23c24afb721da0
SHA512

6667bc0d8e2e524815fe55fafe3d410a60172649588c9cb06d5a518e273861187c824fe5e9cce91d7692e486152c3b5c588cd98da1800d8c7e6a9fdecad6cc5a

Score

10^/10

Family

agenttesla

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1732-67-0x00000000004374DE-mapping.dmp	family_agenttesla
behavioral1/memory/1732-66-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1732-68-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

Processes:

z2tcOyqI7985wOo.exe

description pid process target process

PID 368 set thread context of 1732 368 z2tcOyqI7985wOo.exe z2tcOyqI7985wOo.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

z2tcOyqI7985wOo.exez2tcOyqI7985wOo.exe

pid process

368 z2tcOyqI7985wOo.exe
368 z2tcOyqI7985wOo.exe
368 z2tcOyqI7985wOo.exe
1732 z2tcOyqI7985wOo.exe
1732 z2tcOyqI7985wOo.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

z2tcOyqI7985wOo.exez2tcOyqI7985wOo.exe

description pid process

Token: SeDebugPrivilege 368 z2tcOyqI7985wOo.exe
Token: SeDebugPrivilege 1732 z2tcOyqI7985wOo.exe

description	pid	process	target process
PID 368 set thread context of 1732	368	z2tcOyqI7985wOo.exe	z2tcOyqI7985wOo.exe

description	pid	process
Token: SeDebugPrivilege	368	z2tcOyqI7985wOo.exe
Token: SeDebugPrivilege	1732	z2tcOyqI7985wOo.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

z2tcOyqI7985wOo.exe

description	pid	process	target process
PID 368 wrote to memory of 896	368	z2tcOyqI7985wOo.exe	z2tcOyqI7985wOo.exe
PID 368 wrote to memory of 896	368	z2tcOyqI7985wOo.exe	z2tcOyqI7985wOo.exe
PID 368 wrote to memory of 896	368	z2tcOyqI7985wOo.exe	z2tcOyqI7985wOo.exe
PID 368 wrote to memory of 896	368	z2tcOyqI7985wOo.exe	z2tcOyqI7985wOo.exe
PID 368 wrote to memory of 1732	368	z2tcOyqI7985wOo.exe	z2tcOyqI7985wOo.exe
PID 368 wrote to memory of 1732	368	z2tcOyqI7985wOo.exe	z2tcOyqI7985wOo.exe
PID 368 wrote to memory of 1732	368	z2tcOyqI7985wOo.exe	z2tcOyqI7985wOo.exe
PID 368 wrote to memory of 1732	368	z2tcOyqI7985wOo.exe	z2tcOyqI7985wOo.exe
PID 368 wrote to memory of 1732	368	z2tcOyqI7985wOo.exe	z2tcOyqI7985wOo.exe
PID 368 wrote to memory of 1732	368	z2tcOyqI7985wOo.exe	z2tcOyqI7985wOo.exe
PID 368 wrote to memory of 1732	368	z2tcOyqI7985wOo.exe	z2tcOyqI7985wOo.exe
PID 368 wrote to memory of 1732	368	z2tcOyqI7985wOo.exe	z2tcOyqI7985wOo.exe
PID 368 wrote to memory of 1732	368	z2tcOyqI7985wOo.exe	z2tcOyqI7985wOo.exe

C:\Users\Admin\AppData\Local\Temp\z2tcOyqI7985wOo.exe
"C:\Users\Admin\AppData\Local\Temp\z2tcOyqI7985wOo.exe"
2⤵
PID:896

memory/368-60-0x0000000000ED0000-0x0000000000ED1000-memory.dmp

Filesize
4KB

Download
memory/368-62-0x0000000004DD0000-0x0000000004DD1000-memory.dmp

Filesize
4KB

Download
memory/368-63-0x0000000000330000-0x000000000034B000-memory.dmp

Filesize
108KB

Download
memory/368-64-0x00000000052B0000-0x000000000532A000-memory.dmp

Filesize
488KB

Download
memory/368-65-0x0000000000810000-0x0000000000849000-memory.dmp

Filesize
228KB

Download
memory/1732-67-0x00000000004374DE-mapping.dmp

Download
memory/1732-66-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1732-68-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1732-70-0x0000000000E20000-0x0000000000E21000-memory.dmp

Filesize
4KB

Download