agenttesla | 229f478aaa51fd7d2bd00cfa60a1f370229b324ea71415bf174963070cef0440

Analysis

Target

invoice.exe
Size

541KB
MD5

7c2ab8164ec60eeea9ab0169ec7a475d
SHA1

cb750e8c591d9e0776552b32d50156929b3eae60
SHA256

66332e53989ee89d3c963cecd82424b45e332cadb2d9e13ba13f9f49d22b25ee
SHA512

15b844d0cfd0f6d6013b95f66abf07d88d805344eb8590c38e129b192b973026d5862299758dede7ac08ba731ff6f3455fb17b38ac84ecfa8f9a04c2f38959b9

Score

10^/10

Family

agenttesla

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4568-136-0x0000000000400000-0x000000000045A000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

Processes:

invoice.exe

description pid process target process

PID 1160 set thread context of 4568 1160 invoice.exe RegSvcs.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

invoice.exeRegSvcs.exe

pid process

1160 invoice.exe
1160 invoice.exe
1160 invoice.exe
4568 RegSvcs.exe
4568 RegSvcs.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

invoice.exeRegSvcs.exe

description pid process

Token: SeDebugPrivilege 1160 invoice.exe
Token: SeDebugPrivilege 4568 RegSvcs.exe

description	pid	process	target process
PID 1160 set thread context of 4568	1160	invoice.exe	RegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	1160	invoice.exe
Token: SeDebugPrivilege	4568	RegSvcs.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

invoice.exe

description	pid	process	target process
PID 1160 wrote to memory of 4568	1160	invoice.exe	RegSvcs.exe
PID 1160 wrote to memory of 4568	1160	invoice.exe	RegSvcs.exe
PID 1160 wrote to memory of 4568	1160	invoice.exe	RegSvcs.exe
PID 1160 wrote to memory of 4568	1160	invoice.exe	RegSvcs.exe
PID 1160 wrote to memory of 4568	1160	invoice.exe	RegSvcs.exe
PID 1160 wrote to memory of 4568	1160	invoice.exe	RegSvcs.exe
PID 1160 wrote to memory of 4568	1160	invoice.exe	RegSvcs.exe
PID 1160 wrote to memory of 4568	1160	invoice.exe	RegSvcs.exe

memory/1160-130-0x0000000000670000-0x00000000006FE000-memory.dmp

Filesize
568KB

Download
memory/1160-131-0x0000000005660000-0x0000000005C04000-memory.dmp

Filesize
5.6MB

Download
memory/1160-132-0x00000000050B0000-0x0000000005142000-memory.dmp

Filesize
584KB

Download
memory/1160-133-0x0000000005150000-0x000000000515A000-memory.dmp

Filesize
40KB

Download
memory/1160-134-0x00000000075A0000-0x000000000763C000-memory.dmp

Filesize
624KB

Download
memory/4568-135-0x0000000000000000-mapping.dmp

Download
memory/4568-136-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/4568-137-0x0000000005C40000-0x0000000005CA6000-memory.dmp

Filesize
408KB

Download