agenttesla | a061525b3a2bd5c33247101b2ba5cb9b7c6dcb10f2923c4315a88d080b2b4b1c

General

Target

MV. HUA SHAN.exe
Size

750KB
MD5

01cb8bc3d29ffd8b250929e4ff86f332
SHA1

c0b95a3eafb986bd532f4723ffb93be60d8cf5a1
SHA256

d4dcc5c195854c35dd8936c0ec04ce903b60153042e5e13e03ba080fbf73519e
SHA512

480b8315dde715541d87d0bd1f01585471f5e19de59de062fabfcc2804a1b5bfa219c3df4ba448ebb9c9fba027059798f8a72350d31af6cc2e74972ea04206a0

Score

10^/10

Family

agenttesla

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1400-61-0x0000000000400000-0x0000000000466000-memory.dmp	family_agenttesla
behavioral1/memory/1400-62-0x0000000000400000-0x0000000000466000-memory.dmp	family_agenttesla
behavioral1/memory/1400-63-0x0000000000400000-0x0000000000466000-memory.dmp	family_agenttesla
behavioral1/memory/1400-64-0x0000000000460DFE-mapping.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

Processes:

MV. HUA SHAN.exe

description pid process target process

PID 1872 set thread context of 1400 1872 MV. HUA SHAN.exe MV. HUA SHAN.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

MV. HUA SHAN.exe

pid process

1872 MV. HUA SHAN.exe
1872 MV. HUA SHAN.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

MV. HUA SHAN.exe

description pid process

Token: SeDebugPrivilege 1872 MV. HUA SHAN.exe

description	pid	process	target process
PID 1872 set thread context of 1400	1872	MV. HUA SHAN.exe	MV. HUA SHAN.exe

pid	process
1872	MV. HUA SHAN.exe
1872	MV. HUA SHAN.exe

description	pid	process
Token: SeDebugPrivilege	1872	MV. HUA SHAN.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

MV. HUA SHAN.exe

description	pid	process	target process
PID 1872 wrote to memory of 1400	1872	MV. HUA SHAN.exe	MV. HUA SHAN.exe
PID 1872 wrote to memory of 1400	1872	MV. HUA SHAN.exe	MV. HUA SHAN.exe
PID 1872 wrote to memory of 1400	1872	MV. HUA SHAN.exe	MV. HUA SHAN.exe
PID 1872 wrote to memory of 1400	1872	MV. HUA SHAN.exe	MV. HUA SHAN.exe
PID 1872 wrote to memory of 1400	1872	MV. HUA SHAN.exe	MV. HUA SHAN.exe
PID 1872 wrote to memory of 1400	1872	MV. HUA SHAN.exe	MV. HUA SHAN.exe
PID 1872 wrote to memory of 1400	1872	MV. HUA SHAN.exe	MV. HUA SHAN.exe
PID 1872 wrote to memory of 1400	1872	MV. HUA SHAN.exe	MV. HUA SHAN.exe
PID 1872 wrote to memory of 1400	1872	MV. HUA SHAN.exe	MV. HUA SHAN.exe

memory/1400-58-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/1400-59-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/1400-61-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/1400-62-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/1400-63-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/1400-64-0x0000000000460DFE-mapping.dmp

Download
memory/1872-54-0x0000000000DB0000-0x0000000000E72000-memory.dmp

Filesize
776KB

Download
memory/1872-55-0x0000000000340000-0x000000000034A000-memory.dmp

Filesize
40KB

Download
memory/1872-56-0x0000000004BF0000-0x0000000004C78000-memory.dmp

Filesize
544KB

Download
memory/1872-57-0x0000000007940000-0x00000000079C4000-memory.dmp

Filesize
528KB

Download