agenttesla | 271170cb7b83cb6365facd500c213e5cd2efb157288fd58281ec84d19a6f357a

Analysis

Target

SIGN_AND.EXE
Size

717KB
MD5

4cc0def143dc2acc2bf653dc3d69f1c5
SHA1

20a739bf4278016e0ee4563685e0cd3d8521aa2d
SHA256

271170cb7b83cb6365facd500c213e5cd2efb157288fd58281ec84d19a6f357a
SHA512

68e5cbb9847e7a1f4991aca0693130ee937ad704acbfc16d33b12035d88fae797151bb815165019e4b8342ec33ed8085b5c99b8e5b023f3384d700771be53a70

Score

10^/10

Family

agenttesla

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4492-116-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral2/memory/4492-117-0x000000000043779E-mapping.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

Processes:

SIGN_AND.EXE

description pid process target process

PID 3668 set thread context of 4492 3668 SIGN_AND.EXE SIGN_AND.EXE
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

dw20.exe

pid process

4444 dw20.exe
4444 dw20.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

dw20.exe

description pid process

Token: SeRestorePrivilege 4444 dw20.exe
Token: SeBackupPrivilege 4444 dw20.exe

description	pid	process	target process
PID 3668 set thread context of 4492	3668	SIGN_AND.EXE	SIGN_AND.EXE

pid	process
4444	dw20.exe
4444	dw20.exe

description	pid	process
Token: SeRestorePrivilege	4444	dw20.exe
Token: SeBackupPrivilege	4444	dw20.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

SIGN_AND.EXESIGN_AND.EXE

description	pid	process	target process
PID 3668 wrote to memory of 4492	3668	SIGN_AND.EXE	SIGN_AND.EXE
PID 3668 wrote to memory of 4492	3668	SIGN_AND.EXE	SIGN_AND.EXE
PID 3668 wrote to memory of 4492	3668	SIGN_AND.EXE	SIGN_AND.EXE
PID 3668 wrote to memory of 4492	3668	SIGN_AND.EXE	SIGN_AND.EXE
PID 3668 wrote to memory of 4492	3668	SIGN_AND.EXE	SIGN_AND.EXE
PID 3668 wrote to memory of 4492	3668	SIGN_AND.EXE	SIGN_AND.EXE
PID 3668 wrote to memory of 4492	3668	SIGN_AND.EXE	SIGN_AND.EXE
PID 3668 wrote to memory of 4492	3668	SIGN_AND.EXE	SIGN_AND.EXE
PID 4492 wrote to memory of 4444	4492	SIGN_AND.EXE	dw20.exe
PID 4492 wrote to memory of 4444	4492	SIGN_AND.EXE	dw20.exe
PID 4492 wrote to memory of 4444	4492	SIGN_AND.EXE	dw20.exe

C:\Users\Admin\AppData\Local\Temp\SIGN_AND.EXE
"C:\Users\Admin\AppData\Local\Temp\SIGN_AND.EXE"
2⤵
- Suspicious use of WriteProcessMemory
PID:4492

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\SIGN_AND.EXE.log
MD5
ef140ef600b2463c9e7dbf064a104046

SHA1
c08fd1853877be95575ea2e860dd8cafef31f54c

SHA256
ad8ae97fdeb174b20f02c7ddf9466981856d77d51133599b5954f48f78a1b616

SHA512
bf16df0994080bdc832cb39a312e0095de57608256fcf0d04d589e0bdf3283f918fb0d6ec86ea28a4b1af6db12813c52a724028f02330ebc3a9d32a4fcda706c

Download Submit
memory/3668-115-0x0000000002D20000-0x0000000002D21000-memory.dmp

Filesize
4KB

Download
memory/4444-119-0x0000000000000000-mapping.dmp

Download
memory/4492-116-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4492-117-0x000000000043779E-mapping.dmp

Download
memory/4492-120-0x0000000000AC0000-0x0000000000AC1000-memory.dmp

Filesize
4KB

Download