agenttesla | 8f3295bfd93ef5affb09b0f2c5ccde4aa33b0c94c117cbfb4b09045fe6201d3e

Analysis

max time kernel
91s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30-09-2022 13:13

Target

Payment copy_00000988.PDF.exe
Size

822KB
MD5

21ab035bf0bb26fed935ca7265045272
SHA1

9091f79f60c8a52e7f75e6055363a32bea28b833
SHA256

2f33e37286a03dee0a89bbac812d166203e5ddb1f6c2571110a08690a0df1bd0
SHA512

79cee8569eaa5d96b7781c2852da45539c8db3892c0d8d97b665bae722b32ea4bc8a3f511399888ba7a002a7ee633f7e4f97c9249aa101ce77c35c97a5fc8232
SSDEEP

12288:I2iNJOLvLwo41Giv3Z2HfAZWM7dPJC1g+GU27ZUZUk7MHJ6:I1CLwo4YikHfAZR7Cg+n4UZZoH

Score

10^/10

Family

agenttesla

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla payload 6 IoCs

Processes:

resource	yara_rule
behavioral3/memory/1032-63-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral3/memory/1032-64-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral3/memory/1032-65-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral3/memory/1032-66-0x0000000000436C5E-mapping.dmp	family_agenttesla
behavioral3/memory/1032-68-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral3/memory/1032-70-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

Processes:

Payment copy_00000988.PDF.exe

description pid process target process

PID 1112 set thread context of 1032 1112 Payment copy_00000988.PDF.exe MSBuild.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

MSBuild.exe

pid process

1032 MSBuild.exe
1032 MSBuild.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

MSBuild.exe

description pid process

Token: SeDebugPrivilege 1032 MSBuild.exe

description	pid	process	target process
PID 1112 set thread context of 1032	1112	Payment copy_00000988.PDF.exe	MSBuild.exe

pid	process
1032	MSBuild.exe
1032	MSBuild.exe

description	pid	process
Token: SeDebugPrivilege	1032	MSBuild.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

Payment copy_00000988.PDF.exe

description	pid	process	target process
PID 1112 wrote to memory of 1032	1112	Payment copy_00000988.PDF.exe	MSBuild.exe
PID 1112 wrote to memory of 1032	1112	Payment copy_00000988.PDF.exe	MSBuild.exe
PID 1112 wrote to memory of 1032	1112	Payment copy_00000988.PDF.exe	MSBuild.exe
PID 1112 wrote to memory of 1032	1112	Payment copy_00000988.PDF.exe	MSBuild.exe
PID 1112 wrote to memory of 1032	1112	Payment copy_00000988.PDF.exe	MSBuild.exe
PID 1112 wrote to memory of 1032	1112	Payment copy_00000988.PDF.exe	MSBuild.exe
PID 1112 wrote to memory of 1032	1112	Payment copy_00000988.PDF.exe	MSBuild.exe
PID 1112 wrote to memory of 1032	1112	Payment copy_00000988.PDF.exe	MSBuild.exe
PID 1112 wrote to memory of 1032	1112	Payment copy_00000988.PDF.exe	MSBuild.exe

memory/1032-64-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1032-63-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1032-70-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1032-68-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1032-66-0x0000000000436C5E-mapping.dmp

Download
memory/1032-61-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1032-65-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1032-60-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1112-55-0x0000000074D61000-0x0000000074D63000-memory.dmp

Filesize
8KB

Download
memory/1112-54-0x0000000000A60000-0x0000000000B34000-memory.dmp

Filesize
848KB

Download
memory/1112-59-0x0000000002030000-0x000000000206C000-memory.dmp

Filesize
240KB

Download
memory/1112-58-0x00000000055E0000-0x0000000005674000-memory.dmp

Filesize
592KB

Download
memory/1112-57-0x0000000000A40000-0x0000000000A4C000-memory.dmp

Filesize
48KB

Download
memory/1112-56-0x0000000000700000-0x0000000000714000-memory.dmp

Filesize
80KB

Download