agenttesla | 756ba5dbbdeb25bbd2fbab5f1fb58d9928f25e1be1ce3c608d8433eb69df298d

General

Target

756ba5dbbdeb25bbd2fbab5f1fb58d9928f25e1be1ce3c608d8433eb69df298d.exe
Size

771KB
MD5

8952e566dc30b2b0928253d3d066463d
SHA1

41c507fa1dba4e479f7db844b661ac130b8e907d
SHA256

756ba5dbbdeb25bbd2fbab5f1fb58d9928f25e1be1ce3c608d8433eb69df298d
SHA512

03dd400dc5217ce847934eaa6095204487fba4dddfc4c86bc4f7222d493702a798e9238c092fc4325dde1c46131e74ee65415d9c5ef24bc17407becca5004335

Score

10^/10

Family

agenttesla

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 6 IoCs

resource	yara_rule
behavioral1/memory/940-61-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/940-62-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/940-63-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/940-64-0x000000000043760E-mapping.dmp	family_agenttesla
behavioral1/memory/940-66-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/940-68-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1616 set thread context of 940	1616	756ba5dbbdeb25bbd2fbab5f1fb58d9928f25e1be1ce3c608d8433eb69df298d.exe	28

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
940	756ba5dbbdeb25bbd2fbab5f1fb58d9928f25e1be1ce3c608d8433eb69df298d.exe
940	756ba5dbbdeb25bbd2fbab5f1fb58d9928f25e1be1ce3c608d8433eb69df298d.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	940	756ba5dbbdeb25bbd2fbab5f1fb58d9928f25e1be1ce3c608d8433eb69df298d.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1616 wrote to memory of 940	1616	756ba5dbbdeb25bbd2fbab5f1fb58d9928f25e1be1ce3c608d8433eb69df298d.exe	28
PID 1616 wrote to memory of 940	1616	756ba5dbbdeb25bbd2fbab5f1fb58d9928f25e1be1ce3c608d8433eb69df298d.exe	28
PID 1616 wrote to memory of 940	1616	756ba5dbbdeb25bbd2fbab5f1fb58d9928f25e1be1ce3c608d8433eb69df298d.exe	28
PID 1616 wrote to memory of 940	1616	756ba5dbbdeb25bbd2fbab5f1fb58d9928f25e1be1ce3c608d8433eb69df298d.exe	28
PID 1616 wrote to memory of 940	1616	756ba5dbbdeb25bbd2fbab5f1fb58d9928f25e1be1ce3c608d8433eb69df298d.exe	28
PID 1616 wrote to memory of 940	1616	756ba5dbbdeb25bbd2fbab5f1fb58d9928f25e1be1ce3c608d8433eb69df298d.exe	28
PID 1616 wrote to memory of 940	1616	756ba5dbbdeb25bbd2fbab5f1fb58d9928f25e1be1ce3c608d8433eb69df298d.exe	28
PID 1616 wrote to memory of 940	1616	756ba5dbbdeb25bbd2fbab5f1fb58d9928f25e1be1ce3c608d8433eb69df298d.exe	28
PID 1616 wrote to memory of 940	1616	756ba5dbbdeb25bbd2fbab5f1fb58d9928f25e1be1ce3c608d8433eb69df298d.exe	28

memory/940-58-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/940-59-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/940-61-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/940-62-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/940-63-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/940-66-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/940-68-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1616-54-0x0000000000FA0000-0x0000000001068000-memory.dmp

Filesize
800KB

Download
memory/1616-55-0x0000000000A00000-0x0000000000A70000-memory.dmp

Filesize
448KB

Download
memory/1616-56-0x0000000000990000-0x00000000009AC000-memory.dmp

Filesize
112KB

Download
memory/1616-57-0x000000000A920000-0x000000000A986000-memory.dmp

Filesize
408KB

Download