agenttesla | a22ca2c5d6086e8c6703deb2e345efc08627e7063c447d60babe6edb17503856

General

Target

Halkbank.exe
Size

604KB
MD5

4b230a305cc22a04446b397310070d56
SHA1

208524b096c579b89579febff0b40f752b4e7db4
SHA256

a22ca2c5d6086e8c6703deb2e345efc08627e7063c447d60babe6edb17503856
SHA512

c0dcfea90b46ef91463d6ff272e0febd9ee5615bad9f84993458bde3f9f7983fe025747b7a6e306b31884bc57f10040b965d4578900138721b519dcd37da4f95

Score

10^/10

Family

agenttesla

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3320-125-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral2/memory/3320-126-0x0000000000436F2E-mapping.dmp	family_agenttesla
behavioral2/memory/3320-131-0x0000000004EB0000-0x00000000053AE000-memory.dmp	family_agenttesla

Drops file in Drivers directory 1 IoCs

Processes:

RegSvcs.exe

description ioc process

File opened for modification C:\Windows\system32\drivers\etc\hosts RegSvcs.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

Halkbank.exe

description pid process target process

PID 3252 set thread context of 3320 3252 Halkbank.exe RegSvcs.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

RegSvcs.exe

pid process

3320 RegSvcs.exe
3320 RegSvcs.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RegSvcs.exe

description pid process

Token: SeDebugPrivilege 3320 RegSvcs.exe

description	ioc	process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	RegSvcs.exe

description	pid	process	target process
PID 3252 set thread context of 3320	3252	Halkbank.exe	RegSvcs.exe

pid	process
3320	RegSvcs.exe
3320	RegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	3320	RegSvcs.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

Halkbank.exe

description	pid	process	target process
PID 3252 wrote to memory of 3320	3252	Halkbank.exe	RegSvcs.exe
PID 3252 wrote to memory of 3320	3252	Halkbank.exe	RegSvcs.exe
PID 3252 wrote to memory of 3320	3252	Halkbank.exe	RegSvcs.exe
PID 3252 wrote to memory of 3320	3252	Halkbank.exe	RegSvcs.exe
PID 3252 wrote to memory of 3320	3252	Halkbank.exe	RegSvcs.exe
PID 3252 wrote to memory of 3320	3252	Halkbank.exe	RegSvcs.exe
PID 3252 wrote to memory of 3320	3252	Halkbank.exe	RegSvcs.exe
PID 3252 wrote to memory of 3320	3252	Halkbank.exe	RegSvcs.exe

memory/3252-115-0x0000000000C90000-0x0000000000C91000-memory.dmp

Filesize
4KB

Download
memory/3252-117-0x0000000005C00000-0x0000000005C01000-memory.dmp

Filesize
4KB

Download
memory/3252-118-0x0000000005700000-0x0000000005701000-memory.dmp

Filesize
4KB

Download
memory/3252-119-0x0000000005600000-0x0000000005692000-memory.dmp

Filesize
584KB

Download
memory/3252-120-0x00000000056C0000-0x00000000056C1000-memory.dmp

Filesize
4KB

Download
memory/3252-121-0x00000000056E0000-0x00000000056E8000-memory.dmp

Filesize
32KB

Download
memory/3252-122-0x0000000006130000-0x0000000006131000-memory.dmp

Filesize
4KB

Download
memory/3252-123-0x00000000064A0000-0x00000000064A1000-memory.dmp

Filesize
4KB

Download
memory/3252-124-0x0000000006640000-0x00000000066AA000-memory.dmp

Filesize
424KB

Download
memory/3320-125-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3320-126-0x0000000000436F2E-mapping.dmp

Download
memory/3320-131-0x0000000004EB0000-0x00000000053AE000-memory.dmp

Filesize
5.0MB

Download
memory/3320-132-0x0000000004F70000-0x0000000004F71000-memory.dmp

Filesize
4KB

Download
memory/3320-133-0x0000000005C10000-0x0000000005C11000-memory.dmp

Filesize
4KB

Download