agenttesla | 93e7796d76ff4964bd890c0ebd40eba1a21ef42608627a3952a2c88031fa59a6

General

Target

93e7796d76ff4964bd890c0ebd40eba1a21ef42608627a3952a2c88031fa59a6.exe
Size

547KB
MD5

c6e140f31193e55e86a8af8aa7279061
SHA1

a65656c04f2099404ebcaa54cd9d05bf5de06043
SHA256

93e7796d76ff4964bd890c0ebd40eba1a21ef42608627a3952a2c88031fa59a6
SHA512

a017cc910cf2fb77b2ff4139ad768037a71e3aa9955e6c6746d5ceaa034decf81fd57c8230ab7ac4cb991aa960724f6e2d68b9a324e4d229e2b33f4edefb51a9

Score

10^/10

Family

agenttesla

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 6 IoCs

resource	yara_rule
behavioral1/memory/1472-60-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1472-61-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1472-62-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1472-63-0x000000000043751E-mapping.dmp	family_agenttesla
behavioral1/memory/1472-65-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1472-67-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1664 set thread context of 1472	1664	93e7796d76ff4964bd890c0ebd40eba1a21ef42608627a3952a2c88031fa59a6.exe	29

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1472	RegSvcs.exe
1472	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1472	RegSvcs.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1664 wrote to memory of 1472	1664	93e7796d76ff4964bd890c0ebd40eba1a21ef42608627a3952a2c88031fa59a6.exe	29
PID 1664 wrote to memory of 1472	1664	93e7796d76ff4964bd890c0ebd40eba1a21ef42608627a3952a2c88031fa59a6.exe	29
PID 1664 wrote to memory of 1472	1664	93e7796d76ff4964bd890c0ebd40eba1a21ef42608627a3952a2c88031fa59a6.exe	29
PID 1664 wrote to memory of 1472	1664	93e7796d76ff4964bd890c0ebd40eba1a21ef42608627a3952a2c88031fa59a6.exe	29
PID 1664 wrote to memory of 1472	1664	93e7796d76ff4964bd890c0ebd40eba1a21ef42608627a3952a2c88031fa59a6.exe	29
PID 1664 wrote to memory of 1472	1664	93e7796d76ff4964bd890c0ebd40eba1a21ef42608627a3952a2c88031fa59a6.exe	29
PID 1664 wrote to memory of 1472	1664	93e7796d76ff4964bd890c0ebd40eba1a21ef42608627a3952a2c88031fa59a6.exe	29
PID 1664 wrote to memory of 1472	1664	93e7796d76ff4964bd890c0ebd40eba1a21ef42608627a3952a2c88031fa59a6.exe	29
PID 1664 wrote to memory of 1472	1664	93e7796d76ff4964bd890c0ebd40eba1a21ef42608627a3952a2c88031fa59a6.exe	29
PID 1664 wrote to memory of 1472	1664	93e7796d76ff4964bd890c0ebd40eba1a21ef42608627a3952a2c88031fa59a6.exe	29
PID 1664 wrote to memory of 1472	1664	93e7796d76ff4964bd890c0ebd40eba1a21ef42608627a3952a2c88031fa59a6.exe	29
PID 1664 wrote to memory of 1472	1664	93e7796d76ff4964bd890c0ebd40eba1a21ef42608627a3952a2c88031fa59a6.exe	29

memory/1472-57-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1472-58-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1472-60-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1472-61-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1472-62-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1472-65-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1472-67-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1664-54-0x0000000000AD0000-0x0000000000B60000-memory.dmp

Filesize
576KB

Download
memory/1664-55-0x0000000001FB0000-0x0000000001FCC000-memory.dmp

Filesize
112KB

Download
memory/1664-56-0x00000000059C0000-0x0000000005A26000-memory.dmp

Filesize
408KB

Download