agenttesla | 1fe84fb18ac571783c60a204adf2ad5a852d75ddbbbff29ba49a3f62e626ca09

General

Target

1fe84fb18ac571783c60a204adf2ad5a852d75ddbbbff29ba49a3f62e626ca09.exe
Size

957KB
MD5

938c2703939dda11b234257eda92c8dc
SHA1

e4e1f38e72ec376437ebca8eee716ca3c143adf0
SHA256

1fe84fb18ac571783c60a204adf2ad5a852d75ddbbbff29ba49a3f62e626ca09
SHA512

db5d486619a82c183dbaeaf8037980f7ac35a3b0d94c62c733ab16a29eda5cc9aaa113db225dd4b8a55e7b3741d620e8e98a699be11992aa96afd76338eaffa8

Score

10^/10

Family

agenttesla

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 6 IoCs

resource	yara_rule
behavioral1/memory/1276-60-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1276-61-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1276-62-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1276-63-0x000000000043762E-mapping.dmp	family_agenttesla
behavioral1/memory/1276-67-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1276-65-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1936 set thread context of 1276	1936	1fe84fb18ac571783c60a204adf2ad5a852d75ddbbbff29ba49a3f62e626ca09.exe	29

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1276	1fe84fb18ac571783c60a204adf2ad5a852d75ddbbbff29ba49a3f62e626ca09.exe
1276	1fe84fb18ac571783c60a204adf2ad5a852d75ddbbbff29ba49a3f62e626ca09.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1936	1fe84fb18ac571783c60a204adf2ad5a852d75ddbbbff29ba49a3f62e626ca09.exe
Token: SeDebugPrivilege	1276	1fe84fb18ac571783c60a204adf2ad5a852d75ddbbbff29ba49a3f62e626ca09.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 1276	1936	1fe84fb18ac571783c60a204adf2ad5a852d75ddbbbff29ba49a3f62e626ca09.exe	29
PID 1936 wrote to memory of 1276	1936	1fe84fb18ac571783c60a204adf2ad5a852d75ddbbbff29ba49a3f62e626ca09.exe	29
PID 1936 wrote to memory of 1276	1936	1fe84fb18ac571783c60a204adf2ad5a852d75ddbbbff29ba49a3f62e626ca09.exe	29
PID 1936 wrote to memory of 1276	1936	1fe84fb18ac571783c60a204adf2ad5a852d75ddbbbff29ba49a3f62e626ca09.exe	29
PID 1936 wrote to memory of 1276	1936	1fe84fb18ac571783c60a204adf2ad5a852d75ddbbbff29ba49a3f62e626ca09.exe	29
PID 1936 wrote to memory of 1276	1936	1fe84fb18ac571783c60a204adf2ad5a852d75ddbbbff29ba49a3f62e626ca09.exe	29
PID 1936 wrote to memory of 1276	1936	1fe84fb18ac571783c60a204adf2ad5a852d75ddbbbff29ba49a3f62e626ca09.exe	29
PID 1936 wrote to memory of 1276	1936	1fe84fb18ac571783c60a204adf2ad5a852d75ddbbbff29ba49a3f62e626ca09.exe	29
PID 1936 wrote to memory of 1276	1936	1fe84fb18ac571783c60a204adf2ad5a852d75ddbbbff29ba49a3f62e626ca09.exe	29

memory/1276-57-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1276-58-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1276-60-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1276-61-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1276-62-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1276-67-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1276-65-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1936-54-0x0000000000B00000-0x0000000000BF6000-memory.dmp

Filesize
984KB

Download
memory/1936-55-0x0000000000590000-0x00000000005AE000-memory.dmp

Filesize
120KB

Download
memory/1936-56-0x0000000007E60000-0x0000000007F14000-memory.dmp

Filesize
720KB

Download