agenttesla | eb2e0f62387030188e1b87223d6e8ffe1ee84e32de7ef96f2a12bd130e1edb7e

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220721-en
resource tags

arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
submitted
24-07-2022 14:30

Target

eb2e0f62387030188e1b87223d6e8ffe1ee84e32de7ef96f2a12bd130e1edb7e.exe
Size

864KB
MD5

ce5e96b39981d01e8b5026c544eedd30
SHA1

48b72467afc59a542bceb7ecb9163956c3293469
SHA256

eb2e0f62387030188e1b87223d6e8ffe1ee84e32de7ef96f2a12bd130e1edb7e
SHA512

8ea178d2c0c427b84c029765818de8a2c4666f6ef3e8c25165106c88634cc7aff1c82c7dedc448f4028d8262683c4cda728a3a9b695df1876334cfa9e8f05909

Score

10^/10

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla payload 1 IoCs

resource	yara_rule
behavioral2/memory/2244-142-0x0000000000060000-0x00000000000C4000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3628 set thread context of 2244	3628	eb2e0f62387030188e1b87223d6e8ffe1ee84e32de7ef96f2a12bd130e1edb7e.exe	80

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1728	2244	WerFault.exe	80
2132	2244	WerFault.exe	80

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3628	eb2e0f62387030188e1b87223d6e8ffe1ee84e32de7ef96f2a12bd130e1edb7e.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3628 wrote to memory of 2244	3628	eb2e0f62387030188e1b87223d6e8ffe1ee84e32de7ef96f2a12bd130e1edb7e.exe	80
PID 3628 wrote to memory of 2244	3628	eb2e0f62387030188e1b87223d6e8ffe1ee84e32de7ef96f2a12bd130e1edb7e.exe	80
PID 3628 wrote to memory of 2244	3628	eb2e0f62387030188e1b87223d6e8ffe1ee84e32de7ef96f2a12bd130e1edb7e.exe	80
PID 2244 wrote to memory of 1728	2244	eb2e0f62387030188e1b87223d6e8ffe1ee84e32de7ef96f2a12bd130e1edb7e.exe	83
PID 2244 wrote to memory of 1728	2244	eb2e0f62387030188e1b87223d6e8ffe1ee84e32de7ef96f2a12bd130e1edb7e.exe	83
PID 2244 wrote to memory of 1728	2244	eb2e0f62387030188e1b87223d6e8ffe1ee84e32de7ef96f2a12bd130e1edb7e.exe	83

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2244 -ip 2244
1⤵
PID:1376

memory/2244-146-0x0000000077500000-0x00000000776A3000-memory.dmp

Filesize
1.6MB

Download
memory/2244-145-0x00007FFC747F0000-0x00007FFC749E5000-memory.dmp

Filesize
2.0MB

Download
memory/2244-151-0x0000000077500000-0x00000000776A3000-memory.dmp

Filesize
1.6MB

Download
memory/2244-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2244-139-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/2244-142-0x0000000000060000-0x00000000000C4000-memory.dmp

Filesize
400KB

Download
memory/2244-149-0x0000000077500000-0x00000000776A3000-memory.dmp

Filesize
1.6MB

Download
memory/2244-148-0x00007FFC747F0000-0x00007FFC749E5000-memory.dmp

Filesize
2.0MB

Download
memory/2244-147-0x0000000000700000-0x0000000000707000-memory.dmp

Filesize
28KB

Download
memory/3628-132-0x00000000022F0000-0x00000000022F7000-memory.dmp

Filesize
28KB

Download
memory/3628-134-0x00007FFC747F0000-0x00007FFC749E5000-memory.dmp

Filesize
2.0MB

Download
memory/3628-135-0x00000000022F0000-0x00000000022F7000-memory.dmp

Filesize
28KB

Download
memory/3628-136-0x0000000077500000-0x00000000776A3000-memory.dmp

Filesize
1.6MB

Download