agenttesla | eeb4319818959c111beae9f0bd038991b41a9294c50700c6390ce9fe5490fb74

Analysis

Target

Payment Copy.exe
Size

447KB
MD5

6ad7d8bf86c04715891b54cd2fe4a3de
SHA1

01417971637c349319d11de98c48f92c3eab6d50
SHA256

637b72e82538b767707282db37c0f960aa60c72e3c44c76ecaf232a9c105bf41
SHA512

79945668bec8fc41fd54169117aee755c74fae765398d92c2afccf45ed4e326a799015cb2cdf107618a4681648ad2246820916d37e57411f3c776c5bc88c6e35

Score

10^/10

Family

agenttesla

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2816-136-0x0000000000400000-0x0000000000452000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

Processes:

Payment Copy.exe

description pid process target process

PID 4040 set thread context of 2816 4040 Payment Copy.exe Payment Copy.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

Payment Copy.exePayment Copy.exe

pid process

4040 Payment Copy.exe
2816 Payment Copy.exe
2816 Payment Copy.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Payment Copy.exePayment Copy.exe

description pid process

Token: SeDebugPrivilege 4040 Payment Copy.exe
Token: SeDebugPrivilege 2816 Payment Copy.exe

description	pid	process	target process
PID 4040 set thread context of 2816	4040	Payment Copy.exe	Payment Copy.exe

description	pid	process
Token: SeDebugPrivilege	4040	Payment Copy.exe
Token: SeDebugPrivilege	2816	Payment Copy.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

Payment Copy.exe

description	pid	process	target process
PID 4040 wrote to memory of 2816	4040	Payment Copy.exe	Payment Copy.exe
PID 4040 wrote to memory of 2816	4040	Payment Copy.exe	Payment Copy.exe
PID 4040 wrote to memory of 2816	4040	Payment Copy.exe	Payment Copy.exe
PID 4040 wrote to memory of 2816	4040	Payment Copy.exe	Payment Copy.exe
PID 4040 wrote to memory of 2816	4040	Payment Copy.exe	Payment Copy.exe
PID 4040 wrote to memory of 2816	4040	Payment Copy.exe	Payment Copy.exe
PID 4040 wrote to memory of 2816	4040	Payment Copy.exe	Payment Copy.exe
PID 4040 wrote to memory of 2816	4040	Payment Copy.exe	Payment Copy.exe

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Payment Copy.exe.log
Filesize
1KB

MD5
8ec831f3e3a3f77e4a7b9cd32b48384c

SHA1
d83f09fd87c5bd86e045873c231c14836e76a05c

SHA256
7667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982

SHA512
26bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3

Download Submit
memory/2816-135-0x0000000000000000-mapping.dmp

Download
memory/2816-136-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/2816-138-0x00000000064E0000-0x0000000006546000-memory.dmp

Filesize
408KB

Download
memory/4040-130-0x0000000000C80000-0x0000000000CF4000-memory.dmp

Filesize
464KB

Download
memory/4040-131-0x0000000005B70000-0x0000000006114000-memory.dmp

Filesize
5.6MB

Download
memory/4040-132-0x0000000005680000-0x0000000005712000-memory.dmp

Filesize
584KB

Download
memory/4040-133-0x0000000005AB0000-0x0000000005ABA000-memory.dmp

Filesize
40KB

Download
memory/4040-134-0x0000000007F50000-0x0000000007FEC000-memory.dmp

Filesize
624KB

Download