agenttesla | 7a1fb4cce19327a1cd6aecd31f14f0cb0a489e0d0a8329ae90517279bc11fd10

Analysis

max time kernel
57s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
27/09/2022, 20:13

Target

Payment PO-2062409102_GTE_2022.exe
Size

233KB
MD5

e81987197d93779970db5d289aa37a98
SHA1

9ea755dadf00a2305bde1813f05dd20c9d9739a5
SHA256

8c7a7cd8e6e436f78fffcb7fcdc970a98dbdb2fa8a784d81b3efd7c3fd4e25b1
SHA512

e102e6c653de57474f74d468cd489eed05336c1196bb007b2da4840df491391e620cd5d533ba3f1f01ec6edbf129005466ccb4565e97655e155c17b83fe78fb5
SSDEEP

6144:SGoH0faCCduMU9YrSVIxPLp7drKBKa5Wj:/MlVMVKs0PL9hKpw

Score

10^/10

Family

agenttesla

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla payload 6 IoCs

resource	yara_rule
behavioral1/memory/1528-62-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1528-63-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1528-64-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1528-65-0x0000000000436C4E-mapping.dmp	family_agenttesla
behavioral1/memory/1528-67-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1528-69-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1416 set thread context of 1528	1416	Payment PO-2062409102_GTE_2022.exe	26

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1528	cvtres.exe
1528	cvtres.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1528	cvtres.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1416 wrote to memory of 1528	1416	Payment PO-2062409102_GTE_2022.exe	26
PID 1416 wrote to memory of 1528	1416	Payment PO-2062409102_GTE_2022.exe	26
PID 1416 wrote to memory of 1528	1416	Payment PO-2062409102_GTE_2022.exe	26
PID 1416 wrote to memory of 1528	1416	Payment PO-2062409102_GTE_2022.exe	26
PID 1416 wrote to memory of 1528	1416	Payment PO-2062409102_GTE_2022.exe	26
PID 1416 wrote to memory of 1528	1416	Payment PO-2062409102_GTE_2022.exe	26
PID 1416 wrote to memory of 1528	1416	Payment PO-2062409102_GTE_2022.exe	26
PID 1416 wrote to memory of 1528	1416	Payment PO-2062409102_GTE_2022.exe	26
PID 1416 wrote to memory of 1528	1416	Payment PO-2062409102_GTE_2022.exe	26

memory/1416-54-0x00000000011E0000-0x000000000121A000-memory.dmp

Filesize
232KB

Download
memory/1416-55-0x0000000000980000-0x0000000000988000-memory.dmp

Filesize
32KB

Download
memory/1416-56-0x00000000009D0000-0x00000000009D6000-memory.dmp

Filesize
24KB

Download
memory/1416-57-0x0000000000820000-0x000000000082C000-memory.dmp

Filesize
48KB

Download
memory/1416-58-0x0000000000830000-0x0000000000838000-memory.dmp

Filesize
32KB

Download
memory/1528-59-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1528-60-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1528-62-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1528-63-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1528-64-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1528-67-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1528-69-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1528-70-0x0000000075E81000-0x0000000075E83000-memory.dmp

Filesize
8KB

Download