agenttesla | 8f081e86e16979af5f21b10046cf9ffac97c4ddfe4c4f192322e66950b8803fe

General

Target

8f081e86e16979af5f21b10046cf9ffac97c4ddfe4c4f192322e66950b8803fe.exe
Size

903KB
MD5

36d61c953931c88be3e6dcdc1c31ccbd
SHA1

a10467d4baabe41bb977f7ae67789c415900f07e
SHA256

8f081e86e16979af5f21b10046cf9ffac97c4ddfe4c4f192322e66950b8803fe
SHA512

7d348e6f6e82d90a22747e05a9f01de7f25b93340b00d823058b3130ff34aada0a0c98890ee4be6d5ad7290c6636e84134f9b5037d245957fcd3558e61ea9650

Score

10^/10

Family

agenttesla

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 6 IoCs

resource	yara_rule
behavioral1/memory/1724-61-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1724-62-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1724-64-0x000000000043763E-mapping.dmp	family_agenttesla
behavioral1/memory/1724-63-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1724-66-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1724-68-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1016 set thread context of 1724	1016	8f081e86e16979af5f21b10046cf9ffac97c4ddfe4c4f192322e66950b8803fe.exe	28

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1724	8f081e86e16979af5f21b10046cf9ffac97c4ddfe4c4f192322e66950b8803fe.exe
1724	8f081e86e16979af5f21b10046cf9ffac97c4ddfe4c4f192322e66950b8803fe.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1724	8f081e86e16979af5f21b10046cf9ffac97c4ddfe4c4f192322e66950b8803fe.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1016 wrote to memory of 1724	1016	8f081e86e16979af5f21b10046cf9ffac97c4ddfe4c4f192322e66950b8803fe.exe	28
PID 1016 wrote to memory of 1724	1016	8f081e86e16979af5f21b10046cf9ffac97c4ddfe4c4f192322e66950b8803fe.exe	28
PID 1016 wrote to memory of 1724	1016	8f081e86e16979af5f21b10046cf9ffac97c4ddfe4c4f192322e66950b8803fe.exe	28
PID 1016 wrote to memory of 1724	1016	8f081e86e16979af5f21b10046cf9ffac97c4ddfe4c4f192322e66950b8803fe.exe	28
PID 1016 wrote to memory of 1724	1016	8f081e86e16979af5f21b10046cf9ffac97c4ddfe4c4f192322e66950b8803fe.exe	28
PID 1016 wrote to memory of 1724	1016	8f081e86e16979af5f21b10046cf9ffac97c4ddfe4c4f192322e66950b8803fe.exe	28
PID 1016 wrote to memory of 1724	1016	8f081e86e16979af5f21b10046cf9ffac97c4ddfe4c4f192322e66950b8803fe.exe	28
PID 1016 wrote to memory of 1724	1016	8f081e86e16979af5f21b10046cf9ffac97c4ddfe4c4f192322e66950b8803fe.exe	28
PID 1016 wrote to memory of 1724	1016	8f081e86e16979af5f21b10046cf9ffac97c4ddfe4c4f192322e66950b8803fe.exe	28

memory/1016-54-0x0000000000C40000-0x0000000000D28000-memory.dmp

Filesize
928KB

Download
memory/1016-55-0x0000000000340000-0x00000000003A8000-memory.dmp

Filesize
416KB

Download
memory/1016-56-0x0000000000520000-0x000000000053C000-memory.dmp

Filesize
112KB

Download
memory/1016-57-0x0000000005900000-0x0000000005966000-memory.dmp

Filesize
408KB

Download
memory/1724-59-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1724-61-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1724-58-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1724-62-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1724-63-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1724-66-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1724-68-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download