agenttesla | 479f557c555bdd70bfcb8cb9c39703ea5dceed4bc145c2695babf3e18b737a24

General

Target

479f557c555bdd70bfcb8cb9c39703ea5dceed4bc145c2695babf3e18b737a24.exe
Size

718KB
MD5

4723100da4878c6e30761960809f1d5d
SHA1

09440545558fde0df0ce5a604921d1666b8dadfe
SHA256

479f557c555bdd70bfcb8cb9c39703ea5dceed4bc145c2695babf3e18b737a24
SHA512

86fab8dcf491e352eb2beeb0c1f8046f72625a459578e6c421dab0b1f3599547833b73572b1bf5661c3d12eecb1e7c8c8cc8465b5e805d25f744045cce1aed03

Score

10^/10

Family

agenttesla

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 6 IoCs

resource	yara_rule
behavioral1/memory/1960-61-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1960-62-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1960-63-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1960-64-0x000000000043734E-mapping.dmp	family_agenttesla
behavioral1/memory/1960-66-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1960-68-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1612 set thread context of 1960	1612	479f557c555bdd70bfcb8cb9c39703ea5dceed4bc145c2695babf3e18b737a24.exe	28

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1960	479f557c555bdd70bfcb8cb9c39703ea5dceed4bc145c2695babf3e18b737a24.exe
1960	479f557c555bdd70bfcb8cb9c39703ea5dceed4bc145c2695babf3e18b737a24.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1960	479f557c555bdd70bfcb8cb9c39703ea5dceed4bc145c2695babf3e18b737a24.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1612 wrote to memory of 1960	1612	479f557c555bdd70bfcb8cb9c39703ea5dceed4bc145c2695babf3e18b737a24.exe	28
PID 1612 wrote to memory of 1960	1612	479f557c555bdd70bfcb8cb9c39703ea5dceed4bc145c2695babf3e18b737a24.exe	28
PID 1612 wrote to memory of 1960	1612	479f557c555bdd70bfcb8cb9c39703ea5dceed4bc145c2695babf3e18b737a24.exe	28
PID 1612 wrote to memory of 1960	1612	479f557c555bdd70bfcb8cb9c39703ea5dceed4bc145c2695babf3e18b737a24.exe	28
PID 1612 wrote to memory of 1960	1612	479f557c555bdd70bfcb8cb9c39703ea5dceed4bc145c2695babf3e18b737a24.exe	28
PID 1612 wrote to memory of 1960	1612	479f557c555bdd70bfcb8cb9c39703ea5dceed4bc145c2695babf3e18b737a24.exe	28
PID 1612 wrote to memory of 1960	1612	479f557c555bdd70bfcb8cb9c39703ea5dceed4bc145c2695babf3e18b737a24.exe	28
PID 1612 wrote to memory of 1960	1612	479f557c555bdd70bfcb8cb9c39703ea5dceed4bc145c2695babf3e18b737a24.exe	28
PID 1612 wrote to memory of 1960	1612	479f557c555bdd70bfcb8cb9c39703ea5dceed4bc145c2695babf3e18b737a24.exe	28

memory/1612-54-0x00000000011B0000-0x000000000126A000-memory.dmp

Filesize
744KB

Download
memory/1612-55-0x0000000000670000-0x00000000006D2000-memory.dmp

Filesize
392KB

Download
memory/1612-56-0x0000000000550000-0x000000000056C000-memory.dmp

Filesize
112KB

Download
memory/1612-57-0x0000000005080000-0x00000000050E6000-memory.dmp

Filesize
408KB

Download
memory/1960-58-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1960-59-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1960-61-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1960-62-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1960-63-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1960-66-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1960-68-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download