agenttesla | e341509e17c5b93c792305dfa2183d27d12b5806b3fdf313aa128f3930b16772

General

Target

e341509e17c5b93c792305dfa2183d27d12b5806b3fdf313aa128f3930b16772.exe
Size

982KB
MD5

4085a12eba2a7d21a84aa1203d8f4a78
SHA1

6b58a2c4bec97a991944f66bfded8e251d2f3e3a
SHA256

e341509e17c5b93c792305dfa2183d27d12b5806b3fdf313aa128f3930b16772
SHA512

443eb3d206f31578bd0c2dfec4a4aec1be11e784f604426e56cff19023f06b8d67f4cde5d709541eec396f35a7dcbb97a23ebfc60681690daa94a71d9617067a

Score

10^/10

Family

agenttesla

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 6 IoCs

resource	yara_rule
behavioral1/memory/1184-60-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1184-61-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1184-62-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1184-63-0x000000000043739E-mapping.dmp	family_agenttesla
behavioral1/memory/1184-65-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1184-67-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1896 set thread context of 1184	1896	e341509e17c5b93c792305dfa2183d27d12b5806b3fdf313aa128f3930b16772.exe	29

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1184	RegSvcs.exe
1184	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1184	RegSvcs.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1896 wrote to memory of 1184	1896	e341509e17c5b93c792305dfa2183d27d12b5806b3fdf313aa128f3930b16772.exe	29
PID 1896 wrote to memory of 1184	1896	e341509e17c5b93c792305dfa2183d27d12b5806b3fdf313aa128f3930b16772.exe	29
PID 1896 wrote to memory of 1184	1896	e341509e17c5b93c792305dfa2183d27d12b5806b3fdf313aa128f3930b16772.exe	29
PID 1896 wrote to memory of 1184	1896	e341509e17c5b93c792305dfa2183d27d12b5806b3fdf313aa128f3930b16772.exe	29
PID 1896 wrote to memory of 1184	1896	e341509e17c5b93c792305dfa2183d27d12b5806b3fdf313aa128f3930b16772.exe	29
PID 1896 wrote to memory of 1184	1896	e341509e17c5b93c792305dfa2183d27d12b5806b3fdf313aa128f3930b16772.exe	29
PID 1896 wrote to memory of 1184	1896	e341509e17c5b93c792305dfa2183d27d12b5806b3fdf313aa128f3930b16772.exe	29
PID 1896 wrote to memory of 1184	1896	e341509e17c5b93c792305dfa2183d27d12b5806b3fdf313aa128f3930b16772.exe	29
PID 1896 wrote to memory of 1184	1896	e341509e17c5b93c792305dfa2183d27d12b5806b3fdf313aa128f3930b16772.exe	29
PID 1896 wrote to memory of 1184	1896	e341509e17c5b93c792305dfa2183d27d12b5806b3fdf313aa128f3930b16772.exe	29
PID 1896 wrote to memory of 1184	1896	e341509e17c5b93c792305dfa2183d27d12b5806b3fdf313aa128f3930b16772.exe	29
PID 1896 wrote to memory of 1184	1896	e341509e17c5b93c792305dfa2183d27d12b5806b3fdf313aa128f3930b16772.exe	29

memory/1184-57-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1184-58-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1184-60-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1184-61-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1184-62-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1184-65-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1184-67-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1896-54-0x00000000011E0000-0x00000000012DC000-memory.dmp

Filesize
1008KB

Download
memory/1896-55-0x0000000000560000-0x000000000057E000-memory.dmp

Filesize
120KB

Download
memory/1896-56-0x0000000007D20000-0x0000000007DD8000-memory.dmp

Filesize
736KB

Download