agenttesla | 052be6614bcd306afd888e6c858ea8530c22efd7dec64ea63dd15e2ca7448288

Analysis

max time kernel
152s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
13/10/2022, 11:43

Target
documentos DHL.exe
Size 1.1MB
Sample221013-nvj7wacff5
SHA256 052be6614bcd306afd888e6c858ea8530c22efd7dec64ea63dd15e2ca7448288
MD5 20165c7aec419c5a32d5be17e141e4eb
SHA1 1e355ff2707a72e3110e21cbac81edbfa7f42c5c
SHA512 a77d2e489e7330e59d89a7e49f7f7ae44bd4e577e4d602ef2542a918b243380a5e49164567e0a7dc865854145660d518cc9b6a2f36fa00c57690559f5e7bde50
SSDEEP 12288:ss9Ux0zPOM1zDyf1Zsogsemj0YMmPCLDtSNFM7UNhHjs/oQauc7QNK6qn03b0str:ssWCzPX5S1ZReVmqV4H
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4848 set thread context of 1904	4848	documentos DHL.exe	96

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4848	documentos DHL.exe
Token: SeDebugPrivilege	1904	documentos DHL.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4848 wrote to memory of 4304	4848	documentos DHL.exe	95
PID 4848 wrote to memory of 4304	4848	documentos DHL.exe	95
PID 4848 wrote to memory of 4304	4848	documentos DHL.exe	95
PID 4848 wrote to memory of 1904	4848	documentos DHL.exe	96
PID 4848 wrote to memory of 1904	4848	documentos DHL.exe	96
PID 4848 wrote to memory of 1904	4848	documentos DHL.exe	96
PID 4848 wrote to memory of 1904	4848	documentos DHL.exe	96
PID 4848 wrote to memory of 1904	4848	documentos DHL.exe	96
PID 4848 wrote to memory of 1904	4848	documentos DHL.exe	96
PID 4848 wrote to memory of 1904	4848	documentos DHL.exe	96
PID 4848 wrote to memory of 1904	4848	documentos DHL.exe	96

C:\Users\Admin\AppData\Local\Temp\documentos DHL.exe
"C:\Users\Admin\AppData\Local\Temp\documentos DHL.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4848
- C:\Users\Admin\AppData\Local\Temp\documentos DHL.exe
  "C:\Users\Admin\AppData\Local\Temp\documentos DHL.exe"
  2⤵
  PID:4304
- C:\Users\Admin\AppData\Local\Temp\documentos DHL.exe
  "C:\Users\Admin\AppData\Local\Temp\documentos DHL.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1904

documentos DHL.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\documentos DHL.exe.log
Size 1KB
SHA256 bd9d5e9f7fe6fcff17d873555d4077d15f7d6cdda1183e7f7d278b735ffe1fd7
MD5 e08f822522c617a40840c62e4b0fb45e
SHA1 ae516dca4da5234be6676d3f234c19ec55725be7
SHA512 894a7fb7bbc18ac6ba13378f58a7db80ad00d6080be9a66b01cae8e23e41d9d2d4cd53c1e20669356b73590c8a3ebfda4bdda3258f81240db56c4a81b7313fe4
MD5 SHA1 SHA512

Submit Download

memory/1904-140-0x0000000000400000-0x000000000043A000-memory.dmp

Download

memory/4848-132-0x0000000000090000-0x00000000001A4000-memory.dmp

Download

memory/4848-133-0x0000000007540000-0x0000000007AE4000-memory.dmp

Download

memory/4848-134-0x0000000007030000-0x00000000070C2000-memory.dmp

Download

memory/4848-135-0x00000000071D0000-0x00000000071DA000-memory.dmp

Download

memory/4848-136-0x0000000004C10000-0x0000000004CAC000-memory.dmp

Download

memory/4848-137-0x0000000000950000-0x00000000009B6000-memory.dmp

Download