agenttesla | 24e27b79291475c64e5f2a71833ac988a888e66c86d32ad5d5b20be3b7717604

General

Target

RFQ.exe
Size

585KB
MD5

e3fc0a2977f6ace1e8dcc4d170613b6e
SHA1

0fd7d3e125ae5971855a1ba0e204ec5ae0f4829d
SHA256

24e27b79291475c64e5f2a71833ac988a888e66c86d32ad5d5b20be3b7717604
SHA512

1b19a53b46d5a7c2d2ac7c5c3595f775f78da42e5f8ca3babf1e71406c5d990447238aea61be66c28eff0bc620fc7a5858181e4e97b2f38e694cb7b27708bef2

Score

10^/10

Family

agenttesla

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/680-57-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/680-58-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/680-59-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/680-60-0x00000000004375AE-mapping.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

Processes:

RFQ.exe

description pid process target process

PID 1192 set thread context of 680 1192 RFQ.exe RFQ.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

RFQ.exe

pid process

1192 RFQ.exe
1192 RFQ.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

dw20.exe

pid process

1464 dw20.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RFQ.exe

description pid process

Token: SeDebugPrivilege 1192 RFQ.exe

description	pid	process	target process
PID 1192 set thread context of 680	1192	RFQ.exe	RFQ.exe

pid	process
1192	RFQ.exe
1192	RFQ.exe

pid	process
1464	dw20.exe

description	pid	process
Token: SeDebugPrivilege	1192	RFQ.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

RFQ.exeRFQ.exe

description	pid	process	target process
PID 1192 wrote to memory of 596	1192	RFQ.exe	RFQ.exe
PID 1192 wrote to memory of 596	1192	RFQ.exe	RFQ.exe
PID 1192 wrote to memory of 596	1192	RFQ.exe	RFQ.exe
PID 1192 wrote to memory of 596	1192	RFQ.exe	RFQ.exe
PID 1192 wrote to memory of 680	1192	RFQ.exe	RFQ.exe
PID 1192 wrote to memory of 680	1192	RFQ.exe	RFQ.exe
PID 1192 wrote to memory of 680	1192	RFQ.exe	RFQ.exe
PID 1192 wrote to memory of 680	1192	RFQ.exe	RFQ.exe
PID 1192 wrote to memory of 680	1192	RFQ.exe	RFQ.exe
PID 1192 wrote to memory of 680	1192	RFQ.exe	RFQ.exe
PID 1192 wrote to memory of 680	1192	RFQ.exe	RFQ.exe
PID 1192 wrote to memory of 680	1192	RFQ.exe	RFQ.exe
PID 1192 wrote to memory of 680	1192	RFQ.exe	RFQ.exe
PID 680 wrote to memory of 1464	680	RFQ.exe	dw20.exe
PID 680 wrote to memory of 1464	680	RFQ.exe	dw20.exe
PID 680 wrote to memory of 1464	680	RFQ.exe	dw20.exe
PID 680 wrote to memory of 1464	680	RFQ.exe	dw20.exe

C:\Users\Admin\AppData\Local\Temp\RFQ.exe
"{path}"
2⤵
- Suspicious use of WriteProcessMemory
PID:680

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 396
3⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:1464

memory/680-55-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/680-57-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/680-58-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/680-56-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/680-59-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/680-60-0x00000000004375AE-mapping.dmp

Download
memory/680-64-0x0000000000810000-0x0000000000811000-memory.dmp

Filesize
4KB

Download
memory/1192-53-0x0000000075871000-0x0000000075873000-memory.dmp

Filesize
8KB

Download
memory/1192-54-0x0000000000780000-0x0000000000781000-memory.dmp

Filesize
4KB

Download
memory/1192-63-0x0000000000781000-0x0000000000782000-memory.dmp

Filesize
4KB

Download
memory/1464-62-0x0000000000000000-mapping.dmp

Download
memory/1464-66-0x0000000002800000-0x0000000002801000-memory.dmp

Filesize
4KB

Download