agenttesla | 452465e6ae5ed95bac8429eb7517fd5591c872932a352f33932dec36308e7b51 | Triage

Analysis

max time kernel
76s
max time network
112s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
21-05-2022 01:37

Sharing

Report Analysis Logs

General

Target

bestelling0617_img.exe
Size

801KB
MD5

90cc17cfab3f7a33b6e75bc6d95af453
SHA1

2db5b5fe345cdc5b508880c1559706640c83009a
SHA256

c05f2597d7eefa874b49a615c112274a2d19e2149a420194aa428be36695268e
SHA512

746728a647cf3c4e8119158c753b5e4b18c53e14c562c06583872657078f25cf5b4323c08a6a1a00edb0bdca3e3db6b2cbb9bdc8e6272fb0c7960ed8602e2484

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

bestelling0617_img.exe

pid process

880 bestelling0617_img.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

bestelling0617_img.exe

description pid process

Token: SeDebugPrivilege 880 bestelling0617_img.exe

C:\Users\Admin\AppData\Local\Temp\bestelling0617_img.exe
"C:\Users\Admin\AppData\Local\Temp\bestelling0617_img.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:880

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/880-130-0x00000000007D0000-0x000000000089E000-memory.dmp

Filesize
824KB

Download
memory/880-131-0x0000000006040000-0x00000000065E4000-memory.dmp

Filesize
5.6MB

Download
memory/880-132-0x0000000005B70000-0x0000000005C02000-memory.dmp

Filesize
584KB

Download