agenttesla | 7cffd8eb6866547d175295072b7f1b180467a29b537da3ede1f2c3ebe11c7aaf

Analysis

max time kernel
117s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/09/2022, 21:59

Target

Packing list.exe
Size

720KB
MD5

664062762de8fdfb381268ae566f3d9e
SHA1

d9f2cbd717f700fe9046f947f62fa9d906b3d46f
SHA256

7cffd8eb6866547d175295072b7f1b180467a29b537da3ede1f2c3ebe11c7aaf
SHA512

66dc66420565f1b4b2b34a6b5dff7c1dfda6ac9fb65a12738066d866abf8e91afc462d94d1f9c51d9b00bb6158819d69b17aa47787bfa98a5e93168174bb611a
SSDEEP

12288:TRbG5h7Tu3XDG2g9YIDz+gbldEevK1pisp2VDPrv/ugwyu4CkrOP7Vg:dG5d4G2UpZdEeC1pispaDDHugwv412h

Score

10^/10

Family

agenttesla

https://api.telegram.org/bot5056459562:AAHQW9wJvHEkQsnxuML0xV3IDA6-DUuUNFI/sendDocument

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla payload 6 IoCs

resource	yara_rule
behavioral1/memory/1220-63-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1220-64-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1220-66-0x00000000004370BE-mapping.dmp	family_agenttesla
behavioral1/memory/1220-65-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1220-68-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1220-70-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	Packing list.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 836 set thread context of 1220	836	Packing list.exe	27

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1220	Packing list.exe
1220	Packing list.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1220	Packing list.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 836 wrote to memory of 1220	836	Packing list.exe	27
PID 836 wrote to memory of 1220	836	Packing list.exe	27
PID 836 wrote to memory of 1220	836	Packing list.exe	27
PID 836 wrote to memory of 1220	836	Packing list.exe	27
PID 836 wrote to memory of 1220	836	Packing list.exe	27
PID 836 wrote to memory of 1220	836	Packing list.exe	27
PID 836 wrote to memory of 1220	836	Packing list.exe	27
PID 836 wrote to memory of 1220	836	Packing list.exe	27
PID 836 wrote to memory of 1220	836	Packing list.exe	27

memory/836-54-0x0000000010930000-0x00000000109E8000-memory.dmp

Filesize
736KB

Download
memory/836-55-0x0000000075071000-0x0000000075073000-memory.dmp

Filesize
8KB

Download
memory/836-56-0x0000000000840000-0x000000000085A000-memory.dmp

Filesize
104KB

Download
memory/836-57-0x00000000004F0000-0x00000000004FC000-memory.dmp

Filesize
48KB

Download
memory/836-58-0x00000000055B0000-0x000000000563C000-memory.dmp

Filesize
560KB

Download
memory/836-59-0x0000000004690000-0x00000000046CC000-memory.dmp

Filesize
240KB

Download
memory/1220-60-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1220-61-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1220-63-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1220-64-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1220-65-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1220-68-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1220-70-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download