agenttesla | 271170cb7b83cb6365facd500c213e5cd2efb157288fd58281ec84d19a6f357a

General

Target

SIGN_AND.EXE
Size

717KB
MD5

4cc0def143dc2acc2bf653dc3d69f1c5
SHA1

20a739bf4278016e0ee4563685e0cd3d8521aa2d
SHA256

271170cb7b83cb6365facd500c213e5cd2efb157288fd58281ec84d19a6f357a
SHA512

68e5cbb9847e7a1f4991aca0693130ee937ad704acbfc16d33b12035d88fae797151bb815165019e4b8342ec33ed8085b5c99b8e5b023f3384d700771be53a70

Score

10^/10

Family

agenttesla

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1412-59-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1412-60-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1412-61-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1412-62-0x000000000043779E-mapping.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

Processes:

SIGN_AND.EXE

description pid process target process

PID 1612 set thread context of 1412 1612 SIGN_AND.EXE SIGN_AND.EXE
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

SIGN_AND.EXE

pid process

1612 SIGN_AND.EXE
1612 SIGN_AND.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

SIGN_AND.EXE

description pid process

Token: SeDebugPrivilege 1612 SIGN_AND.EXE

description	pid	process	target process
PID 1612 set thread context of 1412	1612	SIGN_AND.EXE	SIGN_AND.EXE

pid	process
1612	SIGN_AND.EXE
1612	SIGN_AND.EXE

description	pid	process
Token: SeDebugPrivilege	1612	SIGN_AND.EXE

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

SIGN_AND.EXE

description	pid	process	target process
PID 1612 wrote to memory of 1412	1612	SIGN_AND.EXE	SIGN_AND.EXE
PID 1612 wrote to memory of 1412	1612	SIGN_AND.EXE	SIGN_AND.EXE
PID 1612 wrote to memory of 1412	1612	SIGN_AND.EXE	SIGN_AND.EXE
PID 1612 wrote to memory of 1412	1612	SIGN_AND.EXE	SIGN_AND.EXE
PID 1612 wrote to memory of 1412	1612	SIGN_AND.EXE	SIGN_AND.EXE
PID 1612 wrote to memory of 1412	1612	SIGN_AND.EXE	SIGN_AND.EXE
PID 1612 wrote to memory of 1412	1612	SIGN_AND.EXE	SIGN_AND.EXE
PID 1612 wrote to memory of 1412	1612	SIGN_AND.EXE	SIGN_AND.EXE
PID 1612 wrote to memory of 1412	1612	SIGN_AND.EXE	SIGN_AND.EXE

C:\Users\Admin\AppData\Local\Temp\SIGN_AND.EXE
"C:\Users\Admin\AppData\Local\Temp\SIGN_AND.EXE"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Users\Admin\AppData\Local\Temp\SIGN_AND.EXE
  "C:\Users\Admin\AppData\Local\Temp\SIGN_AND.EXE"
  2⤵
  PID:1412

memory/1412-57-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1412-58-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1412-59-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1412-60-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1412-61-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1412-62-0x000000000043779E-mapping.dmp

Download
memory/1412-64-0x0000000002000000-0x0000000002001000-memory.dmp

Filesize
4KB

Download
memory/1612-54-0x00000000751A1000-0x00000000751A3000-memory.dmp

Filesize
8KB

Download
memory/1612-55-0x0000000002000000-0x0000000002001000-memory.dmp

Filesize
4KB

Download
memory/1612-56-0x0000000002001000-0x0000000002002000-memory.dmp

Filesize
4KB

Download