agenttesla | ef176faa1d186e67f9ab559b32c35dcfe874bef49156ebcd414d5c032ec2f55a

General

Target

ef176faa1d186e67f9ab559b32c35dcfe874bef49156ebcd414d5c032ec2f55a.exe
Size

753KB
MD5

751532ac5635d8c77a474df541c780d9
SHA1

d7a962a32cafae1e791d2f896d0c9bb6ae0384d0
SHA256

ef176faa1d186e67f9ab559b32c35dcfe874bef49156ebcd414d5c032ec2f55a
SHA512

4a32296e5b02d8a6cf5c839ec0425231bde4d4d51dc92030c4fd658c6da11cc49521523a9547e40d658146b0a703ac04d12d2df2f78f25c2863d28a7a8fcb474
SSDEEP

12288:939riVwf3iJ+HN3TFfIKXKH0oKnkishvwWqWogZWhwOANLw/y/9Zu/E9jtgmdbtb:9Nriy/fTFfyRIA2R59Ntjk

Score

10^/10

Family

agenttesla

C2

https://api.telegram.org/bot1900392974:AAEB_yGGlWksNcNC4Dg08OgUSlmDON2w098/sendDocument

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla payload 6 IoCs

resource	yara_rule
behavioral1/memory/1016-63-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1016-64-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1016-65-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1016-66-0x000000000043772E-mapping.dmp	family_agenttesla
behavioral1/memory/1016-68-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1016-70-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1080 set thread context of 1016	1080	ef176faa1d186e67f9ab559b32c35dcfe874bef49156ebcd414d5c032ec2f55a.exe	28

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1080	ef176faa1d186e67f9ab559b32c35dcfe874bef49156ebcd414d5c032ec2f55a.exe
1080	ef176faa1d186e67f9ab559b32c35dcfe874bef49156ebcd414d5c032ec2f55a.exe
1016	RegAsm.exe
1016	RegAsm.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1080	ef176faa1d186e67f9ab559b32c35dcfe874bef49156ebcd414d5c032ec2f55a.exe
Token: SeDebugPrivilege	1016	RegAsm.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1080 wrote to memory of 1016	1080	ef176faa1d186e67f9ab559b32c35dcfe874bef49156ebcd414d5c032ec2f55a.exe	28
PID 1080 wrote to memory of 1016	1080	ef176faa1d186e67f9ab559b32c35dcfe874bef49156ebcd414d5c032ec2f55a.exe	28
PID 1080 wrote to memory of 1016	1080	ef176faa1d186e67f9ab559b32c35dcfe874bef49156ebcd414d5c032ec2f55a.exe	28
PID 1080 wrote to memory of 1016	1080	ef176faa1d186e67f9ab559b32c35dcfe874bef49156ebcd414d5c032ec2f55a.exe	28
PID 1080 wrote to memory of 1016	1080	ef176faa1d186e67f9ab559b32c35dcfe874bef49156ebcd414d5c032ec2f55a.exe	28
PID 1080 wrote to memory of 1016	1080	ef176faa1d186e67f9ab559b32c35dcfe874bef49156ebcd414d5c032ec2f55a.exe	28
PID 1080 wrote to memory of 1016	1080	ef176faa1d186e67f9ab559b32c35dcfe874bef49156ebcd414d5c032ec2f55a.exe	28
PID 1080 wrote to memory of 1016	1080	ef176faa1d186e67f9ab559b32c35dcfe874bef49156ebcd414d5c032ec2f55a.exe	28
PID 1080 wrote to memory of 1016	1080	ef176faa1d186e67f9ab559b32c35dcfe874bef49156ebcd414d5c032ec2f55a.exe	28
PID 1080 wrote to memory of 1016	1080	ef176faa1d186e67f9ab559b32c35dcfe874bef49156ebcd414d5c032ec2f55a.exe	28
PID 1080 wrote to memory of 1016	1080	ef176faa1d186e67f9ab559b32c35dcfe874bef49156ebcd414d5c032ec2f55a.exe	28
PID 1080 wrote to memory of 1016	1080	ef176faa1d186e67f9ab559b32c35dcfe874bef49156ebcd414d5c032ec2f55a.exe	28

memory/1016-64-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1016-63-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1016-70-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1016-68-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1016-66-0x000000000043772E-mapping.dmp

Download
memory/1016-61-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1016-65-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1016-60-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1080-55-0x0000000076411000-0x0000000076413000-memory.dmp

Filesize
8KB

Download
memory/1080-54-0x0000000001090000-0x0000000001152000-memory.dmp

Filesize
776KB

Download
memory/1080-59-0x00000000004F0000-0x00000000004F6000-memory.dmp

Filesize
24KB

Download
memory/1080-58-0x0000000000B00000-0x0000000000B1A000-memory.dmp

Filesize
104KB

Download
memory/1080-57-0x0000000000790000-0x00000000007A8000-memory.dmp

Filesize
96KB

Download
memory/1080-56-0x00000000004A0000-0x00000000004D0000-memory.dmp

Filesize
192KB

Download