agenttesla | eb2e0f62387030188e1b87223d6e8ffe1ee84e32de7ef96f2a12bd130e1edb7e

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220718-en
resource tags

arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system
submitted
24-07-2022 14:30

Target

eb2e0f62387030188e1b87223d6e8ffe1ee84e32de7ef96f2a12bd130e1edb7e.exe
Size

864KB
MD5

ce5e96b39981d01e8b5026c544eedd30
SHA1

48b72467afc59a542bceb7ecb9163956c3293469
SHA256

eb2e0f62387030188e1b87223d6e8ffe1ee84e32de7ef96f2a12bd130e1edb7e
SHA512

8ea178d2c0c427b84c029765818de8a2c4666f6ef3e8c25165106c88634cc7aff1c82c7dedc448f4028d8262683c4cda728a3a9b695df1876334cfa9e8f05909

Score

10^/10

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla payload 1 IoCs

resource	yara_rule
behavioral1/memory/1764-68-0x00000000023B0000-0x0000000002414000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 540 set thread context of 1764	540	eb2e0f62387030188e1b87223d6e8ffe1ee84e32de7ef96f2a12bd130e1edb7e.exe	28

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2044	1764	WerFault.exe	28

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
540	eb2e0f62387030188e1b87223d6e8ffe1ee84e32de7ef96f2a12bd130e1edb7e.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 540 wrote to memory of 1764	540	eb2e0f62387030188e1b87223d6e8ffe1ee84e32de7ef96f2a12bd130e1edb7e.exe	28
PID 540 wrote to memory of 1764	540	eb2e0f62387030188e1b87223d6e8ffe1ee84e32de7ef96f2a12bd130e1edb7e.exe	28
PID 540 wrote to memory of 1764	540	eb2e0f62387030188e1b87223d6e8ffe1ee84e32de7ef96f2a12bd130e1edb7e.exe	28
PID 540 wrote to memory of 1764	540	eb2e0f62387030188e1b87223d6e8ffe1ee84e32de7ef96f2a12bd130e1edb7e.exe	28
PID 1764 wrote to memory of 2044	1764	eb2e0f62387030188e1b87223d6e8ffe1ee84e32de7ef96f2a12bd130e1edb7e.exe	29
PID 1764 wrote to memory of 2044	1764	eb2e0f62387030188e1b87223d6e8ffe1ee84e32de7ef96f2a12bd130e1edb7e.exe	29
PID 1764 wrote to memory of 2044	1764	eb2e0f62387030188e1b87223d6e8ffe1ee84e32de7ef96f2a12bd130e1edb7e.exe	29
PID 1764 wrote to memory of 2044	1764	eb2e0f62387030188e1b87223d6e8ffe1ee84e32de7ef96f2a12bd130e1edb7e.exe	29

memory/540-61-0x00000000777C0000-0x0000000077940000-memory.dmp

Filesize
1.5MB

Download
memory/540-57-0x00000000758D1000-0x00000000758D3000-memory.dmp

Filesize
8KB

Download
memory/540-56-0x0000000000370000-0x0000000000377000-memory.dmp

Filesize
28KB

Download
memory/540-59-0x0000000000370000-0x0000000000377000-memory.dmp

Filesize
28KB

Download
memory/540-60-0x00000000775E0000-0x0000000077789000-memory.dmp

Filesize
1.7MB

Download
memory/1764-63-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1764-65-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/1764-68-0x00000000023B0000-0x0000000002414000-memory.dmp

Filesize
400KB

Download
memory/1764-72-0x00000000775E0000-0x0000000077789000-memory.dmp

Filesize
1.7MB

Download
memory/1764-73-0x00000000777C0000-0x0000000077940000-memory.dmp

Filesize
1.5MB

Download
memory/1764-74-0x00000000001B0000-0x00000000001B7000-memory.dmp

Filesize
28KB

Download