agenttesla | 0751800875e7c5a0dcc2463d2864a1391785edb3da6b1e990435bf8c4c396d81

General

Target

0751800875e7c5a0dcc2463d2864a1391785edb3da6b1e990435bf8c4c396d81.exe
Size

753KB
MD5

cc508061b7e46c2d3c5152bac6abe356
SHA1

e6fa2e72beac848a49d0425b300c98ca94f99131
SHA256

0751800875e7c5a0dcc2463d2864a1391785edb3da6b1e990435bf8c4c396d81
SHA512

b5daaddb2e4cc883c878b9b0d57c9c133ef80b882ea0bbc5fba0adb257f270c8faa3d752899bddf7c91c683ffa16c077a8eef127598a08401983f15338591298

Score

10^/10

Family

agenttesla

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 6 IoCs

resource	yara_rule
behavioral1/memory/1104-61-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1104-62-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1104-63-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1104-64-0x00000000004375FE-mapping.dmp	family_agenttesla
behavioral1/memory/1104-66-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1104-68-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1744 set thread context of 1104	1744	0751800875e7c5a0dcc2463d2864a1391785edb3da6b1e990435bf8c4c396d81.exe	28

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1104	0751800875e7c5a0dcc2463d2864a1391785edb3da6b1e990435bf8c4c396d81.exe
1104	0751800875e7c5a0dcc2463d2864a1391785edb3da6b1e990435bf8c4c396d81.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1104	0751800875e7c5a0dcc2463d2864a1391785edb3da6b1e990435bf8c4c396d81.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1744 wrote to memory of 1104	1744	0751800875e7c5a0dcc2463d2864a1391785edb3da6b1e990435bf8c4c396d81.exe	28
PID 1744 wrote to memory of 1104	1744	0751800875e7c5a0dcc2463d2864a1391785edb3da6b1e990435bf8c4c396d81.exe	28
PID 1744 wrote to memory of 1104	1744	0751800875e7c5a0dcc2463d2864a1391785edb3da6b1e990435bf8c4c396d81.exe	28
PID 1744 wrote to memory of 1104	1744	0751800875e7c5a0dcc2463d2864a1391785edb3da6b1e990435bf8c4c396d81.exe	28
PID 1744 wrote to memory of 1104	1744	0751800875e7c5a0dcc2463d2864a1391785edb3da6b1e990435bf8c4c396d81.exe	28
PID 1744 wrote to memory of 1104	1744	0751800875e7c5a0dcc2463d2864a1391785edb3da6b1e990435bf8c4c396d81.exe	28
PID 1744 wrote to memory of 1104	1744	0751800875e7c5a0dcc2463d2864a1391785edb3da6b1e990435bf8c4c396d81.exe	28
PID 1744 wrote to memory of 1104	1744	0751800875e7c5a0dcc2463d2864a1391785edb3da6b1e990435bf8c4c396d81.exe	28
PID 1744 wrote to memory of 1104	1744	0751800875e7c5a0dcc2463d2864a1391785edb3da6b1e990435bf8c4c396d81.exe	28

memory/1104-58-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1104-59-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1104-61-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1104-62-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1104-63-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1104-66-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1104-68-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1744-54-0x0000000000060000-0x0000000000122000-memory.dmp

Filesize
776KB

Download
memory/1744-55-0x0000000000760000-0x00000000007CC000-memory.dmp

Filesize
432KB

Download
memory/1744-56-0x0000000000710000-0x000000000072C000-memory.dmp

Filesize
112KB

Download
memory/1744-57-0x0000000005900000-0x0000000005966000-memory.dmp

Filesize
408KB

Download