agenttesla | d60b973ccf00336efa9393865752eb2e5024bc136b40879bf2786e3935ac49f1

General

Target

7HCYDW.exe
Size

439KB
MD5

df149dd69ac46dbfafd8194e3d10a6ab
SHA1

f15fae56c94c46576e7b656ea34d5eb42bd8fda4
SHA256

8715b90fdea709f60563d5cfad92a81de645f3241e25804e6b58e891a11e6192
SHA512

861f099e004e61391f51d2f2266f3d05130db1a817838a2e5e26ba586274593cafa751b88b7a549236131fd8dfaad67ff27ba071334e9202ebb3e3196db75ef8

Score

10^/10

Family

agenttesla

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1912-62-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1912-63-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1912-64-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1912-65-0x00000000004374BE-mapping.dmp	family_agenttesla
behavioral1/memory/1912-66-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

Processes:

7HCYDW.exe

description pid process target process

PID 1276 set thread context of 1912 1276 7HCYDW.exe 7HCYDW.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

7HCYDW.exe7HCYDW.exe

pid process

1276 7HCYDW.exe
1912 7HCYDW.exe
1912 7HCYDW.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

7HCYDW.exe7HCYDW.exe

description pid process

Token: SeDebugPrivilege 1276 7HCYDW.exe
Token: SeDebugPrivilege 1912 7HCYDW.exe

description	pid	process	target process
PID 1276 set thread context of 1912	1276	7HCYDW.exe	7HCYDW.exe

description	pid	process
Token: SeDebugPrivilege	1276	7HCYDW.exe
Token: SeDebugPrivilege	1912	7HCYDW.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

7HCYDW.exe

description	pid	process	target process
PID 1276 wrote to memory of 1864	1276	7HCYDW.exe	7HCYDW.exe
PID 1276 wrote to memory of 1864	1276	7HCYDW.exe	7HCYDW.exe
PID 1276 wrote to memory of 1864	1276	7HCYDW.exe	7HCYDW.exe
PID 1276 wrote to memory of 1864	1276	7HCYDW.exe	7HCYDW.exe
PID 1276 wrote to memory of 1912	1276	7HCYDW.exe	7HCYDW.exe
PID 1276 wrote to memory of 1912	1276	7HCYDW.exe	7HCYDW.exe
PID 1276 wrote to memory of 1912	1276	7HCYDW.exe	7HCYDW.exe
PID 1276 wrote to memory of 1912	1276	7HCYDW.exe	7HCYDW.exe
PID 1276 wrote to memory of 1912	1276	7HCYDW.exe	7HCYDW.exe
PID 1276 wrote to memory of 1912	1276	7HCYDW.exe	7HCYDW.exe
PID 1276 wrote to memory of 1912	1276	7HCYDW.exe	7HCYDW.exe
PID 1276 wrote to memory of 1912	1276	7HCYDW.exe	7HCYDW.exe
PID 1276 wrote to memory of 1912	1276	7HCYDW.exe	7HCYDW.exe

C:\Users\Admin\AppData\Local\Temp\7HCYDW.exe
"C:\Users\Admin\AppData\Local\Temp\7HCYDW.exe"
2⤵
PID:1864

memory/1276-54-0x0000000000110000-0x0000000000111000-memory.dmp

Filesize
4KB

Download
memory/1276-56-0x00000000763C1000-0x00000000763C3000-memory.dmp

Filesize
8KB

Download
memory/1276-57-0x0000000004330000-0x0000000004331000-memory.dmp

Filesize
4KB

Download
memory/1276-58-0x0000000000530000-0x0000000000538000-memory.dmp

Filesize
32KB

Download
memory/1276-59-0x0000000004830000-0x0000000004888000-memory.dmp

Filesize
352KB

Download
memory/1912-60-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1912-61-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1912-62-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1912-63-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1912-64-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1912-65-0x00000000004374BE-mapping.dmp

Download
memory/1912-66-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1912-68-0x00000000004B0000-0x00000000004B1000-memory.dmp

Filesize
4KB

Download