agenttesla | 361cfcc65ffe2112687ddd9fd49ad22102d4bb83aa9afb40b04a3531d852f95a

General

Target

#20JML643.exe
Size

943KB
MD5

22872f4d32c9801fcfe832fe3dcf0561
SHA1

6c7891c126cd3b230887f916b461f5c6ceb163a8
SHA256

361cfcc65ffe2112687ddd9fd49ad22102d4bb83aa9afb40b04a3531d852f95a
SHA512

38084e825f42f49a01147ccaf98cb1e1de4cfd5dbeb46277999992ce0b9f72fa93bb45fb668b4bf5c94aa84473326d60258cb7b982341b844a0ebb28e7425b8d

Score

10^/10

Family

agenttesla

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1644-66-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1644-67-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1644-68-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1644-69-0x000000000043761E-mapping.dmp	family_agenttesla
behavioral1/memory/1644-70-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

Processes:

#20JML643.exe

description pid process target process

PID 892 set thread context of 1644 892 #20JML643.exe #20JML643.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

#20JML643.exe

pid process

1644 #20JML643.exe
1644 #20JML643.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

#20JML643.exe

description pid process

Token: SeDebugPrivilege 1644 #20JML643.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

#20JML643.exe

pid process

892 #20JML643.exe
892 #20JML643.exe

description	pid	process	target process
PID 892 set thread context of 1644	892	#20JML643.exe	#20JML643.exe

pid	process
1644	#20JML643.exe
1644	#20JML643.exe

description	pid	process
Token: SeDebugPrivilege	1644	#20JML643.exe

pid	process
892	#20JML643.exe
892	#20JML643.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

#20JML643.exe

description	pid	process	target process
PID 892 wrote to memory of 1644	892	#20JML643.exe	#20JML643.exe
PID 892 wrote to memory of 1644	892	#20JML643.exe	#20JML643.exe
PID 892 wrote to memory of 1644	892	#20JML643.exe	#20JML643.exe
PID 892 wrote to memory of 1644	892	#20JML643.exe	#20JML643.exe
PID 892 wrote to memory of 1644	892	#20JML643.exe	#20JML643.exe
PID 892 wrote to memory of 1644	892	#20JML643.exe	#20JML643.exe
PID 892 wrote to memory of 1644	892	#20JML643.exe	#20JML643.exe
PID 892 wrote to memory of 1644	892	#20JML643.exe	#20JML643.exe
PID 892 wrote to memory of 1644	892	#20JML643.exe	#20JML643.exe

memory/892-55-0x0000000001260000-0x0000000001261000-memory.dmp

Filesize
4KB

Download
memory/892-57-0x00000000754F1000-0x00000000754F3000-memory.dmp

Filesize
8KB

Download
memory/892-58-0x0000000004E10000-0x0000000004E11000-memory.dmp

Filesize
4KB

Download
memory/892-59-0x0000000004E11000-0x0000000004E12000-memory.dmp

Filesize
4KB

Download
memory/892-60-0x0000000004E12000-0x0000000004E13000-memory.dmp

Filesize
4KB

Download
memory/892-61-0x00000000006B0000-0x00000000006BE000-memory.dmp

Filesize
56KB

Download
memory/892-62-0x00000000085A0000-0x0000000008619000-memory.dmp

Filesize
484KB

Download
memory/892-63-0x0000000007EF0000-0x0000000007F28000-memory.dmp

Filesize
224KB

Download
memory/1644-64-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1644-65-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1644-66-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1644-67-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1644-68-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1644-69-0x000000000043761E-mapping.dmp

Download
memory/1644-70-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1644-72-0x0000000004B50000-0x0000000004B51000-memory.dmp

Filesize
4KB

Download