agenttesla | 199f5c3379f3268daedc5f3b3a36383bf171511d0d657fac4057b9e3b40619c7

General

Target

Direct_advice.exe
Size

608KB
MD5

bf98feb3502d7f0914c6a1068a1bc9b1
SHA1

230ec06385b9c16f4accd3755cd72aa1c79be4a7
SHA256

bd798dda71e760acc62a228c3c770034e1a5d0f65db0e0805a6157bcd8c9c454
SHA512

04705964647d02c9b9ae2fa7b940ea493b6b0fd58f297b9d6bd9bc266cb7fd7ae94f9add7d5d85fe432f8ccb9efbbde8b7145a3b5931d08c5667c8d3765446c4

Score

10^/10

Family

agenttesla

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/980-61-0x0000000000400000-0x0000000000452000-memory.dmp	family_agenttesla
behavioral1/memory/980-62-0x0000000000400000-0x0000000000452000-memory.dmp	family_agenttesla
behavioral1/memory/980-63-0x0000000000400000-0x0000000000452000-memory.dmp	family_agenttesla
behavioral1/memory/980-64-0x000000000044C75E-mapping.dmp	family_agenttesla
behavioral1/memory/980-66-0x0000000000400000-0x0000000000452000-memory.dmp	family_agenttesla

ReZer0 packer 1 IoCs

Detects ReZer0, a packer with multiple versions used in various campaigns.

Processes:

resource	yara_rule
behavioral1/memory/1672-57-0x00000000042C0000-0x0000000004318000-memory.dmp	rezer0

Suspicious use of SetThreadContext 1 IoCs

Processes:

Direct_advice.exe

description pid process target process

PID 1672 set thread context of 980 1672 Direct_advice.exe RegSvcs.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

Direct_advice.exe

pid process

1672 Direct_advice.exe
1672 Direct_advice.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Direct_advice.exe

description pid process

Token: SeDebugPrivilege 1672 Direct_advice.exe

description	pid	process	target process
PID 1672 set thread context of 980	1672	Direct_advice.exe	RegSvcs.exe

pid	process
1672	Direct_advice.exe
1672	Direct_advice.exe

description	pid	process
Token: SeDebugPrivilege	1672	Direct_advice.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

Direct_advice.exe

description	pid	process	target process
PID 1672 wrote to memory of 980	1672	Direct_advice.exe	RegSvcs.exe
PID 1672 wrote to memory of 980	1672	Direct_advice.exe	RegSvcs.exe
PID 1672 wrote to memory of 980	1672	Direct_advice.exe	RegSvcs.exe
PID 1672 wrote to memory of 980	1672	Direct_advice.exe	RegSvcs.exe
PID 1672 wrote to memory of 980	1672	Direct_advice.exe	RegSvcs.exe
PID 1672 wrote to memory of 980	1672	Direct_advice.exe	RegSvcs.exe
PID 1672 wrote to memory of 980	1672	Direct_advice.exe	RegSvcs.exe
PID 1672 wrote to memory of 980	1672	Direct_advice.exe	RegSvcs.exe
PID 1672 wrote to memory of 980	1672	Direct_advice.exe	RegSvcs.exe
PID 1672 wrote to memory of 980	1672	Direct_advice.exe	RegSvcs.exe
PID 1672 wrote to memory of 980	1672	Direct_advice.exe	RegSvcs.exe
PID 1672 wrote to memory of 980	1672	Direct_advice.exe	RegSvcs.exe

memory/980-58-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/980-59-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/980-61-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/980-62-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/980-63-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/980-64-0x000000000044C75E-mapping.dmp

Download
memory/980-66-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/1672-54-0x0000000000060000-0x0000000000100000-memory.dmp

Filesize
640KB

Download
memory/1672-55-0x0000000001E60000-0x0000000001EC0000-memory.dmp

Filesize
384KB

Download
memory/1672-56-0x0000000000460000-0x0000000000468000-memory.dmp

Filesize
32KB

Download
memory/1672-57-0x00000000042C0000-0x0000000004318000-memory.dmp

Filesize
352KB

Download