agenttesla | 21cd1dea5f6846f81699ddc9c7a4469901a87c13efd253001c030645bcca9fd3

General

Target

384b03372b0048e1cb96f7db323d31af.exe
Size

537KB
MD5

384b03372b0048e1cb96f7db323d31af
SHA1

26c2955b326420fc61f64fb1f0c1ac26bb8fe6d9
SHA256

21cd1dea5f6846f81699ddc9c7a4469901a87c13efd253001c030645bcca9fd3
SHA512

f5be075a925c363ebd0a2174ed587637d76f60401ae2d45bdd0210ae989b817df4f702529bbd289bfc1c5b79efeaac4597f838c7ac0ca62cacf7a15f5cff5f73

Score

10^/10

Family

agenttesla

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1564-60-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1564-61-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1564-62-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1564-63-0x000000000043760E-mapping.dmp	family_agenttesla
behavioral1/memory/1564-64-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

Processes:

384b03372b0048e1cb96f7db323d31af.exe

description pid process target process

PID 1200 set thread context of 1564 1200 384b03372b0048e1cb96f7db323d31af.exe 384b03372b0048e1cb96f7db323d31af.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

384b03372b0048e1cb96f7db323d31af.exe

pid process

1564 384b03372b0048e1cb96f7db323d31af.exe
1564 384b03372b0048e1cb96f7db323d31af.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

384b03372b0048e1cb96f7db323d31af.exe

description pid process

Token: SeDebugPrivilege 1564 384b03372b0048e1cb96f7db323d31af.exe

description	pid	process	target process
PID 1200 set thread context of 1564	1200	384b03372b0048e1cb96f7db323d31af.exe	384b03372b0048e1cb96f7db323d31af.exe

pid	process
1564	384b03372b0048e1cb96f7db323d31af.exe
1564	384b03372b0048e1cb96f7db323d31af.exe

description	pid	process
Token: SeDebugPrivilege	1564	384b03372b0048e1cb96f7db323d31af.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

384b03372b0048e1cb96f7db323d31af.exe

description	pid	process	target process
PID 1200 wrote to memory of 1564	1200	384b03372b0048e1cb96f7db323d31af.exe	384b03372b0048e1cb96f7db323d31af.exe
PID 1200 wrote to memory of 1564	1200	384b03372b0048e1cb96f7db323d31af.exe	384b03372b0048e1cb96f7db323d31af.exe
PID 1200 wrote to memory of 1564	1200	384b03372b0048e1cb96f7db323d31af.exe	384b03372b0048e1cb96f7db323d31af.exe
PID 1200 wrote to memory of 1564	1200	384b03372b0048e1cb96f7db323d31af.exe	384b03372b0048e1cb96f7db323d31af.exe
PID 1200 wrote to memory of 1564	1200	384b03372b0048e1cb96f7db323d31af.exe	384b03372b0048e1cb96f7db323d31af.exe
PID 1200 wrote to memory of 1564	1200	384b03372b0048e1cb96f7db323d31af.exe	384b03372b0048e1cb96f7db323d31af.exe
PID 1200 wrote to memory of 1564	1200	384b03372b0048e1cb96f7db323d31af.exe	384b03372b0048e1cb96f7db323d31af.exe
PID 1200 wrote to memory of 1564	1200	384b03372b0048e1cb96f7db323d31af.exe	384b03372b0048e1cb96f7db323d31af.exe
PID 1200 wrote to memory of 1564	1200	384b03372b0048e1cb96f7db323d31af.exe	384b03372b0048e1cb96f7db323d31af.exe

memory/1200-53-0x00000000009B0000-0x00000000009B1000-memory.dmp

Filesize
4KB

Download
memory/1200-55-0x0000000000910000-0x0000000000917000-memory.dmp

Filesize
28KB

Download
memory/1200-56-0x0000000002030000-0x0000000002031000-memory.dmp

Filesize
4KB

Download
memory/1200-57-0x00000000043F0000-0x0000000004448000-memory.dmp

Filesize
352KB

Download
memory/1564-58-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1564-59-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1564-60-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1564-61-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1564-62-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1564-63-0x000000000043760E-mapping.dmp

Download
memory/1564-64-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1564-66-0x0000000004AE0000-0x0000000004AE1000-memory.dmp

Filesize
4KB

Download