agenttesla | 6f0f753471141fc3b2946e7a56a35b74accf24d74382cac8027ddd835bd1ba04

Analysis

max time kernel
107s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
10/10/2022, 11:39

Target

6f0f753471141fc3b2946e7a56a35b74accf24d74382cac8027ddd835bd1ba04.exe
Size

978KB
MD5

3095ea704287de6610fd95d0f0f2e926
SHA1

0a8ebbe160a334f8014d6a27111f35f18019d85e
SHA256

6f0f753471141fc3b2946e7a56a35b74accf24d74382cac8027ddd835bd1ba04
SHA512

319e6c5f6ffdf3436ca0b2d23371c8c40ca6435e30fe2f708746a4b048538df2052a803fb4b41d7728df55e2a75a0dc9ed37c6698dc05ead35fb55166fb8bbd7
SSDEEP

12288:/sX5y5GLGQsGvxEWet20qWJOSHG0bvZvgfkQnMpomnORJ3xkZ9/9iL4KRaQ8OOSu:/fvGvgt20qWUx0bhTpoOOzxkZ9/H

Score

10^/10

Family

agenttesla

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla payload 6 IoCs

resource	yara_rule
behavioral1/memory/1576-63-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1576-64-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1576-65-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1576-66-0x000000000043760E-mapping.dmp	family_agenttesla
behavioral1/memory/1576-68-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1576-70-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1972 set thread context of 1576	1972	6f0f753471141fc3b2946e7a56a35b74accf24d74382cac8027ddd835bd1ba04.exe	28

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1576	6f0f753471141fc3b2946e7a56a35b74accf24d74382cac8027ddd835bd1ba04.exe
1576	6f0f753471141fc3b2946e7a56a35b74accf24d74382cac8027ddd835bd1ba04.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1576	6f0f753471141fc3b2946e7a56a35b74accf24d74382cac8027ddd835bd1ba04.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 1576	1972	6f0f753471141fc3b2946e7a56a35b74accf24d74382cac8027ddd835bd1ba04.exe	28
PID 1972 wrote to memory of 1576	1972	6f0f753471141fc3b2946e7a56a35b74accf24d74382cac8027ddd835bd1ba04.exe	28
PID 1972 wrote to memory of 1576	1972	6f0f753471141fc3b2946e7a56a35b74accf24d74382cac8027ddd835bd1ba04.exe	28
PID 1972 wrote to memory of 1576	1972	6f0f753471141fc3b2946e7a56a35b74accf24d74382cac8027ddd835bd1ba04.exe	28
PID 1972 wrote to memory of 1576	1972	6f0f753471141fc3b2946e7a56a35b74accf24d74382cac8027ddd835bd1ba04.exe	28
PID 1972 wrote to memory of 1576	1972	6f0f753471141fc3b2946e7a56a35b74accf24d74382cac8027ddd835bd1ba04.exe	28
PID 1972 wrote to memory of 1576	1972	6f0f753471141fc3b2946e7a56a35b74accf24d74382cac8027ddd835bd1ba04.exe	28
PID 1972 wrote to memory of 1576	1972	6f0f753471141fc3b2946e7a56a35b74accf24d74382cac8027ddd835bd1ba04.exe	28
PID 1972 wrote to memory of 1576	1972	6f0f753471141fc3b2946e7a56a35b74accf24d74382cac8027ddd835bd1ba04.exe	28

memory/1576-64-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1576-65-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1576-70-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1576-61-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1576-60-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1576-63-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1576-68-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1972-55-0x0000000075501000-0x0000000075503000-memory.dmp

Filesize
8KB

Download
memory/1972-54-0x0000000000A10000-0x0000000000B0A000-memory.dmp

Filesize
1000KB

Download
memory/1972-59-0x00000000041C0000-0x00000000041FC000-memory.dmp

Filesize
240KB

Download
memory/1972-58-0x0000000005600000-0x0000000005696000-memory.dmp

Filesize
600KB

Download
memory/1972-57-0x00000000003C0000-0x00000000003CC000-memory.dmp

Filesize
48KB

Download
memory/1972-56-0x00000000003B0000-0x00000000003C4000-memory.dmp

Filesize
80KB

Download