agenttesla | 5b21c86b9de84ff5e939274857c29b41b02702727c7b7841ca4ee287c5deaeb5

Analysis

max time kernel
76s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
27-09-2022 06:56

Target

d924c3be13557a3311b4a10b25a6595e.exe
Size

976KB
MD5

d924c3be13557a3311b4a10b25a6595e
SHA1

32ef1ac74c08fb76ed23c0932df90a7df83d2e5f
SHA256

5b21c86b9de84ff5e939274857c29b41b02702727c7b7841ca4ee287c5deaeb5
SHA512

88d2deef4a8bf48fb89f11f76c5c582ee9aeb91cf617cd6c805dd59adaee042bbb74a5da3c5dde9e14892f8dc440be315a41ddf6ca3c78adc73b6faed07fd2e7
SSDEEP

12288:rIo2Bq4pembekgtVfmoeyxoADqjJ5nFKxtaJwY8NHGjy6yWmkihczFh4PzFueoc:rIfBCmAt4dyIjrFKEx

Score

10^/10

Family

agenttesla

https://api.telegram.org/bot5015424630:AAHYFU1sKtYqSORHBErFCWNjJz1TpXKj30w/sendDocument

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla payload 6 IoCs

resource	yara_rule
behavioral1/memory/820-63-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/820-64-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/820-65-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/820-66-0x000000000043762E-mapping.dmp	family_agenttesla
behavioral1/memory/820-68-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/820-70-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1736 set thread context of 820	1736	d924c3be13557a3311b4a10b25a6595e.exe	28

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
820	d924c3be13557a3311b4a10b25a6595e.exe
820	d924c3be13557a3311b4a10b25a6595e.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	820	d924c3be13557a3311b4a10b25a6595e.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1736 wrote to memory of 820	1736	d924c3be13557a3311b4a10b25a6595e.exe	28
PID 1736 wrote to memory of 820	1736	d924c3be13557a3311b4a10b25a6595e.exe	28
PID 1736 wrote to memory of 820	1736	d924c3be13557a3311b4a10b25a6595e.exe	28
PID 1736 wrote to memory of 820	1736	d924c3be13557a3311b4a10b25a6595e.exe	28
PID 1736 wrote to memory of 820	1736	d924c3be13557a3311b4a10b25a6595e.exe	28
PID 1736 wrote to memory of 820	1736	d924c3be13557a3311b4a10b25a6595e.exe	28
PID 1736 wrote to memory of 820	1736	d924c3be13557a3311b4a10b25a6595e.exe	28
PID 1736 wrote to memory of 820	1736	d924c3be13557a3311b4a10b25a6595e.exe	28
PID 1736 wrote to memory of 820	1736	d924c3be13557a3311b4a10b25a6595e.exe	28

memory/820-64-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/820-65-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/820-70-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/820-68-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/820-66-0x000000000043762E-mapping.dmp

Download
memory/820-61-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/820-60-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/820-63-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1736-55-0x0000000075DA1000-0x0000000075DA3000-memory.dmp

Filesize
8KB

Download
memory/1736-54-0x0000000000980000-0x0000000000A7A000-memory.dmp

Filesize
1000KB

Download
memory/1736-59-0x0000000000830000-0x000000000086C000-memory.dmp

Filesize
240KB

Download
memory/1736-58-0x0000000005160000-0x00000000051E0000-memory.dmp

Filesize
512KB

Download
memory/1736-57-0x0000000004D85000-0x0000000004D96000-memory.dmp

Filesize
68KB

Download
memory/1736-56-0x00000000003F0000-0x0000000000410000-memory.dmp

Filesize
128KB

Download
memory/1736-71-0x0000000004D85000-0x0000000004D96000-memory.dmp

Filesize
68KB

Download