agenttesla | f5975138fbd005ad1399f0f2623cff56d494f138a207156e272c85e6e3e77445

General

Target

Swift Copy.exe
Size

640KB
MD5

b772387208e2bc581bd9758fcf1399ab
SHA1

a3159e22c2c3e447f9f025d4cb34afd54cb4bc5e
SHA256

f5975138fbd005ad1399f0f2623cff56d494f138a207156e272c85e6e3e77445
SHA512

a12ce9107c2dd6f6fd1b87657112eccbd374a0a2302984f54ec30e215adc9956d806814562fe678f8a129cb4393a69bb2455c1de16b7f66ed518348bfc912f46

Score

10^/10

Family

agenttesla

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1296-62-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1296-63-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1296-64-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1296-65-0x0000000000436C3E-mapping.dmp	family_agenttesla
behavioral1/memory/1296-66-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

Processes:

Swift Copy.exe

description pid process target process

PID 1548 set thread context of 1296 1548 Swift Copy.exe MSBuild.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

Swift Copy.exeMSBuild.exe

pid process

1548 Swift Copy.exe
1548 Swift Copy.exe
1296 MSBuild.exe
1296 MSBuild.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Swift Copy.exeMSBuild.exe

description pid process

Token: SeDebugPrivilege 1548 Swift Copy.exe
Token: SeDebugPrivilege 1296 MSBuild.exe

description	pid	process	target process
PID 1548 set thread context of 1296	1548	Swift Copy.exe	MSBuild.exe

description	pid	process
Token: SeDebugPrivilege	1548	Swift Copy.exe
Token: SeDebugPrivilege	1296	MSBuild.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

Swift Copy.exe

description	pid	process	target process
PID 1548 wrote to memory of 1296	1548	Swift Copy.exe	MSBuild.exe
PID 1548 wrote to memory of 1296	1548	Swift Copy.exe	MSBuild.exe
PID 1548 wrote to memory of 1296	1548	Swift Copy.exe	MSBuild.exe
PID 1548 wrote to memory of 1296	1548	Swift Copy.exe	MSBuild.exe
PID 1548 wrote to memory of 1296	1548	Swift Copy.exe	MSBuild.exe
PID 1548 wrote to memory of 1296	1548	Swift Copy.exe	MSBuild.exe
PID 1548 wrote to memory of 1296	1548	Swift Copy.exe	MSBuild.exe
PID 1548 wrote to memory of 1296	1548	Swift Copy.exe	MSBuild.exe
PID 1548 wrote to memory of 1296	1548	Swift Copy.exe	MSBuild.exe

memory/1296-64-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1296-60-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1296-61-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1296-62-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1296-63-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1296-65-0x0000000000436C3E-mapping.dmp

Download
memory/1296-66-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1296-68-0x0000000004A20000-0x0000000004A21000-memory.dmp

Filesize
4KB

Download
memory/1548-56-0x00000000762D1000-0x00000000762D3000-memory.dmp

Filesize
8KB

Download
memory/1548-57-0x0000000004C30000-0x0000000004C31000-memory.dmp

Filesize
4KB

Download
memory/1548-58-0x0000000000420000-0x0000000000425000-memory.dmp

Filesize
20KB

Download
memory/1548-59-0x0000000005850000-0x00000000058CE000-memory.dmp

Filesize
504KB

Download
memory/1548-54-0x0000000001280000-0x0000000001281000-memory.dmp

Filesize
4KB

Download