agenttesla | d60b973ccf00336efa9393865752eb2e5024bc136b40879bf2786e3935ac49f1

General

Target

7HCYDW.exe
Size

439KB
MD5

df149dd69ac46dbfafd8194e3d10a6ab
SHA1

f15fae56c94c46576e7b656ea34d5eb42bd8fda4
SHA256

8715b90fdea709f60563d5cfad92a81de645f3241e25804e6b58e891a11e6192
SHA512

861f099e004e61391f51d2f2266f3d05130db1a817838a2e5e26ba586274593cafa751b88b7a549236131fd8dfaad67ff27ba071334e9202ebb3e3196db75ef8

Score

10^/10

Family

agenttesla

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1248-63-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1248-64-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1248-65-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1248-66-0x00000000004374BE-mapping.dmp	family_agenttesla
behavioral1/memory/1248-67-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

Processes:

7HCYDW.exe

description pid process target process

PID 1384 set thread context of 1248 1384 7HCYDW.exe 7HCYDW.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

7HCYDW.exe

pid process

1248 7HCYDW.exe
1248 7HCYDW.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

7HCYDW.exe

description pid process

Token: SeDebugPrivilege 1248 7HCYDW.exe

description	pid	process	target process
PID 1384 set thread context of 1248	1384	7HCYDW.exe	7HCYDW.exe

pid	process
1248	7HCYDW.exe
1248	7HCYDW.exe

description	pid	process
Token: SeDebugPrivilege	1248	7HCYDW.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

7HCYDW.exe

description	pid	process	target process
PID 1384 wrote to memory of 1248	1384	7HCYDW.exe	7HCYDW.exe
PID 1384 wrote to memory of 1248	1384	7HCYDW.exe	7HCYDW.exe
PID 1384 wrote to memory of 1248	1384	7HCYDW.exe	7HCYDW.exe
PID 1384 wrote to memory of 1248	1384	7HCYDW.exe	7HCYDW.exe
PID 1384 wrote to memory of 1248	1384	7HCYDW.exe	7HCYDW.exe
PID 1384 wrote to memory of 1248	1384	7HCYDW.exe	7HCYDW.exe
PID 1384 wrote to memory of 1248	1384	7HCYDW.exe	7HCYDW.exe
PID 1384 wrote to memory of 1248	1384	7HCYDW.exe	7HCYDW.exe
PID 1384 wrote to memory of 1248	1384	7HCYDW.exe	7HCYDW.exe

memory/1248-65-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1248-61-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1248-62-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1248-63-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1248-64-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1248-66-0x00000000004374BE-mapping.dmp

Download
memory/1248-67-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1248-69-0x0000000004A20000-0x0000000004A21000-memory.dmp

Filesize
4KB

Download
memory/1384-57-0x0000000076241000-0x0000000076243000-memory.dmp

Filesize
8KB

Download
memory/1384-58-0x00000000008B0000-0x00000000008B1000-memory.dmp

Filesize
4KB

Download
memory/1384-59-0x0000000000930000-0x0000000000938000-memory.dmp

Filesize
32KB

Download
memory/1384-60-0x0000000004BA0000-0x0000000004BF8000-memory.dmp

Filesize
352KB

Download
memory/1384-55-0x00000000009F0000-0x00000000009F1000-memory.dmp

Filesize
4KB

Download