agenttesla | b4f5ab297be81516ae9c0cd602d0bcab9050c8321b5675dc1ddbfa99be09f9af

Analysis

max time kernel
50s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
20/09/2022, 08:00

Target

PO-20945321002 & PO-20945321004.exe
Size

209KB
MD5

1148c85897a1e993f4eb0f08be37ec0b
SHA1

fc6cd75c16babd85ff8df1b4e0fa5edd361758e8
SHA256

b4f5ab297be81516ae9c0cd602d0bcab9050c8321b5675dc1ddbfa99be09f9af
SHA512

5e191cd8bda0d9944771fd17f6dd90f3ad18d1b137ae11fd061562820642f5a9fc0006f3e1ebfba3a1856ef5cce7bfdf609310d2486fb5bb98a38ffbdb075488
SSDEEP

6144:U0M9XCwEB3fGQZjtrjYqZjZ3aTItQYFQwjgTG:U0MlCwEB3+gjtXYs93aYMa

Score

10^/10

Family

agenttesla

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla payload 6 IoCs

resource	yara_rule
behavioral1/memory/1744-60-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1744-61-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1744-62-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1744-63-0x0000000000436C4E-mapping.dmp	family_agenttesla
behavioral1/memory/1744-65-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1744-67-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1952 set thread context of 1744	1952	PO-20945321002 & PO-20945321004.exe	28

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1744	cvtres.exe
1744	cvtres.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1744	cvtres.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1952 wrote to memory of 1744	1952	PO-20945321002 & PO-20945321004.exe	28
PID 1952 wrote to memory of 1744	1952	PO-20945321002 & PO-20945321004.exe	28
PID 1952 wrote to memory of 1744	1952	PO-20945321002 & PO-20945321004.exe	28
PID 1952 wrote to memory of 1744	1952	PO-20945321002 & PO-20945321004.exe	28
PID 1952 wrote to memory of 1744	1952	PO-20945321002 & PO-20945321004.exe	28
PID 1952 wrote to memory of 1744	1952	PO-20945321002 & PO-20945321004.exe	28
PID 1952 wrote to memory of 1744	1952	PO-20945321002 & PO-20945321004.exe	28
PID 1952 wrote to memory of 1744	1952	PO-20945321002 & PO-20945321004.exe	28
PID 1952 wrote to memory of 1744	1952	PO-20945321002 & PO-20945321004.exe	28

memory/1744-57-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1744-58-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1744-60-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1744-61-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1744-62-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1744-65-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1744-67-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1744-68-0x00000000758C1000-0x00000000758C3000-memory.dmp

Filesize
8KB

Download
memory/1952-54-0x00000000010A0000-0x00000000010DA000-memory.dmp

Filesize
232KB

Download
memory/1952-55-0x00000000001F0000-0x00000000001FC000-memory.dmp

Filesize
48KB

Download
memory/1952-56-0x0000000000200000-0x0000000000208000-memory.dmp

Filesize
32KB

Download