agenttesla | 67ff4cfecd67b7a1117b8335087755a032e153276de2778230959443aabaf0ec

General

Target

30% Swift Scan0076567865.exe
Size

441KB
MD5

50baadd2a4a1bc7d69ac0075f570696a
SHA1

a1d41eea1ec6fd8db97e3a0866d75cd20a84b3a7
SHA256

cbfc08ab907fa89fcf4921c6824a84f112324ff1acaa63934774bba8d98f2b01
SHA512

bec5e3ddc5dd384dbd6541e7f27eee8365fc1555bfdccea56635701e3102e560a337f76b6025cc51880c2129faf5bc8f845ce5cea29ab920a6afc060f567106e

Score

10^/10

Family

agenttesla

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3252-135-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

Processes:

30% Swift Scan0076567865.exe

description pid process target process

PID 2700 set thread context of 3252 2700 30% Swift Scan0076567865.exe 30% Swift Scan0076567865.exe

description	pid	process	target process
PID 2700 set thread context of 3252	2700	30% Swift Scan0076567865.exe	30% Swift Scan0076567865.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

Processes:

30% Swift Scan0076567865.exe30% Swift Scan0076567865.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

30% Swift Scan0076567865.exe30% Swift Scan0076567865.exe

description pid process

Token: SeDebugPrivilege 2700 30% Swift Scan0076567865.exe
Token: SeDebugPrivilege 3252 30% Swift Scan0076567865.exe

description	pid	process
Token: SeDebugPrivilege	2700	30% Swift Scan0076567865.exe
Token: SeDebugPrivilege	3252	30% Swift Scan0076567865.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

30% Swift Scan0076567865.exe

description	pid	process	target process
PID 2700 wrote to memory of 1272	2700	30% Swift Scan0076567865.exe	30% Swift Scan0076567865.exe
PID 2700 wrote to memory of 1272	2700	30% Swift Scan0076567865.exe	30% Swift Scan0076567865.exe
PID 2700 wrote to memory of 1272	2700	30% Swift Scan0076567865.exe	30% Swift Scan0076567865.exe
PID 2700 wrote to memory of 3252	2700	30% Swift Scan0076567865.exe	30% Swift Scan0076567865.exe
PID 2700 wrote to memory of 3252	2700	30% Swift Scan0076567865.exe	30% Swift Scan0076567865.exe
PID 2700 wrote to memory of 3252	2700	30% Swift Scan0076567865.exe	30% Swift Scan0076567865.exe
PID 2700 wrote to memory of 3252	2700	30% Swift Scan0076567865.exe	30% Swift Scan0076567865.exe
PID 2700 wrote to memory of 3252	2700	30% Swift Scan0076567865.exe	30% Swift Scan0076567865.exe
PID 2700 wrote to memory of 3252	2700	30% Swift Scan0076567865.exe	30% Swift Scan0076567865.exe
PID 2700 wrote to memory of 3252	2700	30% Swift Scan0076567865.exe	30% Swift Scan0076567865.exe
PID 2700 wrote to memory of 3252	2700	30% Swift Scan0076567865.exe	30% Swift Scan0076567865.exe

C:\Users\Admin\AppData\Local\Temp\30% Swift Scan0076567865.exe
"C:\Users\Admin\AppData\Local\Temp\30% Swift Scan0076567865.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2700
- C:\Users\Admin\AppData\Local\Temp\30% Swift Scan0076567865.exe
  "{path}"
  2⤵
  PID:1272
- C:\Users\Admin\AppData\Local\Temp\30% Swift Scan0076567865.exe
  "{path}"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3252

memory/1272-133-0x0000000000000000-mapping.dmp

Download
memory/2700-130-0x0000000000950000-0x00000000009C4000-memory.dmp

Filesize
464KB

Download
memory/2700-131-0x00000000056C0000-0x000000000575C000-memory.dmp

Filesize
624KB

Download
memory/2700-132-0x0000000005800000-0x0000000005892000-memory.dmp

Filesize
584KB

Download
memory/3252-134-0x0000000000000000-mapping.dmp

Download
memory/3252-135-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/3252-136-0x0000000005E50000-0x00000000063F4000-memory.dmp

Filesize
5.6MB

Download
memory/3252-137-0x0000000005DE0000-0x0000000005E46000-memory.dmp

Filesize
408KB

Download