agenttesla | 6b0fe1f4cfb10e06abc3603956fcf0953de6e4ab63a034665d449b4f880366ef

General

Target

Purchase Order - 8279018110.exe
Size

368KB
MD5

ce16e76c031c756a7580719e65e0ff63
SHA1

cde97cb49d940071dc5b5d0cb4af0e59ce2a830c
SHA256

09d051ae9f992668f4b86a538c3483174f491cd16b18ca1e6799eaf1506e4a87
SHA512

ddd5c2241e07b4d1610d13312e118d0b7558fbf38dc0b4a828f773b4de2ea85a36805940193fe28b3405bdfdc33546f949716471e81c1d737afffec93bd21b7d

Score

10^/10

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1656-59-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla
behavioral1/memory/1656-58-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla
behavioral1/memory/1656-60-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla
behavioral1/memory/1656-61-0x0000000000447FCE-mapping.dmp	family_agenttesla
behavioral1/memory/1656-63-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

Processes:

Purchase Order - 8279018110.exe

description pid process target process

PID 1868 set thread context of 1656 1868 Purchase Order - 8279018110.exe Purchase Order - 8279018110.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

Purchase Order - 8279018110.exe

pid process

1868 Purchase Order - 8279018110.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Purchase Order - 8279018110.exe

description pid process

Token: SeDebugPrivilege 1868 Purchase Order - 8279018110.exe

description	pid	process	target process
PID 1868 set thread context of 1656	1868	Purchase Order - 8279018110.exe	Purchase Order - 8279018110.exe

pid	process
1868	Purchase Order - 8279018110.exe

description	pid	process
Token: SeDebugPrivilege	1868	Purchase Order - 8279018110.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

Purchase Order - 8279018110.exe

description	pid	process	target process
PID 1868 wrote to memory of 1444	1868	Purchase Order - 8279018110.exe	Purchase Order - 8279018110.exe
PID 1868 wrote to memory of 1444	1868	Purchase Order - 8279018110.exe	Purchase Order - 8279018110.exe
PID 1868 wrote to memory of 1444	1868	Purchase Order - 8279018110.exe	Purchase Order - 8279018110.exe
PID 1868 wrote to memory of 1444	1868	Purchase Order - 8279018110.exe	Purchase Order - 8279018110.exe
PID 1868 wrote to memory of 1656	1868	Purchase Order - 8279018110.exe	Purchase Order - 8279018110.exe
PID 1868 wrote to memory of 1656	1868	Purchase Order - 8279018110.exe	Purchase Order - 8279018110.exe
PID 1868 wrote to memory of 1656	1868	Purchase Order - 8279018110.exe	Purchase Order - 8279018110.exe
PID 1868 wrote to memory of 1656	1868	Purchase Order - 8279018110.exe	Purchase Order - 8279018110.exe
PID 1868 wrote to memory of 1656	1868	Purchase Order - 8279018110.exe	Purchase Order - 8279018110.exe
PID 1868 wrote to memory of 1656	1868	Purchase Order - 8279018110.exe	Purchase Order - 8279018110.exe
PID 1868 wrote to memory of 1656	1868	Purchase Order - 8279018110.exe	Purchase Order - 8279018110.exe
PID 1868 wrote to memory of 1656	1868	Purchase Order - 8279018110.exe	Purchase Order - 8279018110.exe
PID 1868 wrote to memory of 1656	1868	Purchase Order - 8279018110.exe	Purchase Order - 8279018110.exe

C:\Users\Admin\AppData\Local\Temp\Purchase Order - 8279018110.exe
"C:\Users\Admin\AppData\Local\Temp\Purchase Order - 8279018110.exe"
2⤵
PID:1444

C:\Users\Admin\AppData\Local\Temp\Purchase Order - 8279018110.exe
"C:\Users\Admin\AppData\Local\Temp\Purchase Order - 8279018110.exe"
2⤵
PID:1656

memory/1656-56-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1656-55-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1656-59-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1656-58-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1656-60-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1656-61-0x0000000000447FCE-mapping.dmp

Download
memory/1656-63-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1868-54-0x0000000075841000-0x0000000075843000-memory.dmp

Filesize
8KB

Download
memory/1868-65-0x0000000074720000-0x0000000074CCB000-memory.dmp

Filesize
5.7MB

Download