agenttesla | bb8c5d01927965b23f73675067caacda1a5289bcf26646d41353436c4e28d6bd

General

Target

bb8c5d01927965b23f73675067caacda1a5289bcf26646d41353436c4e28d6bd.exe
Size

757KB
MD5

6f9419d0156908698670142676d3606d
SHA1

d529a9f62f07656c4cd7b3049f12bfe27bebf66e
SHA256

bb8c5d01927965b23f73675067caacda1a5289bcf26646d41353436c4e28d6bd
SHA512

55cabbb1e9257356ba5be9ce653206f2bfa009c3f13e082455be91cbf9f30640d49163f5924e9a1efa530ab335188c98f7bb89b4b44349292ffeae19c1bfbb78

Score

10^/10

Family

agenttesla

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 6 IoCs

resource	yara_rule
behavioral1/memory/840-61-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/840-62-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/840-64-0x00000000004374DE-mapping.dmp	family_agenttesla
behavioral1/memory/840-63-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/840-66-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/840-68-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1784 set thread context of 840	1784	bb8c5d01927965b23f73675067caacda1a5289bcf26646d41353436c4e28d6bd.exe	28

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
840	bb8c5d01927965b23f73675067caacda1a5289bcf26646d41353436c4e28d6bd.exe
840	bb8c5d01927965b23f73675067caacda1a5289bcf26646d41353436c4e28d6bd.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	840	bb8c5d01927965b23f73675067caacda1a5289bcf26646d41353436c4e28d6bd.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1784 wrote to memory of 840	1784	bb8c5d01927965b23f73675067caacda1a5289bcf26646d41353436c4e28d6bd.exe	28
PID 1784 wrote to memory of 840	1784	bb8c5d01927965b23f73675067caacda1a5289bcf26646d41353436c4e28d6bd.exe	28
PID 1784 wrote to memory of 840	1784	bb8c5d01927965b23f73675067caacda1a5289bcf26646d41353436c4e28d6bd.exe	28
PID 1784 wrote to memory of 840	1784	bb8c5d01927965b23f73675067caacda1a5289bcf26646d41353436c4e28d6bd.exe	28
PID 1784 wrote to memory of 840	1784	bb8c5d01927965b23f73675067caacda1a5289bcf26646d41353436c4e28d6bd.exe	28
PID 1784 wrote to memory of 840	1784	bb8c5d01927965b23f73675067caacda1a5289bcf26646d41353436c4e28d6bd.exe	28
PID 1784 wrote to memory of 840	1784	bb8c5d01927965b23f73675067caacda1a5289bcf26646d41353436c4e28d6bd.exe	28
PID 1784 wrote to memory of 840	1784	bb8c5d01927965b23f73675067caacda1a5289bcf26646d41353436c4e28d6bd.exe	28
PID 1784 wrote to memory of 840	1784	bb8c5d01927965b23f73675067caacda1a5289bcf26646d41353436c4e28d6bd.exe	28

memory/840-58-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/840-61-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/840-59-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/840-62-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/840-63-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/840-66-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/840-68-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1784-54-0x0000000001100000-0x00000000011C4000-memory.dmp

Filesize
784KB

Download
memory/1784-55-0x0000000000370000-0x00000000003DC000-memory.dmp

Filesize
432KB

Download
memory/1784-56-0x0000000000AF0000-0x0000000000B0C000-memory.dmp

Filesize
112KB

Download
memory/1784-57-0x0000000004CA0000-0x0000000004D06000-memory.dmp

Filesize
408KB

Download