agenttesla | d777e07e8eb41600b4c53a06b94812c96afe898eefb00cdc6d867c884dfc951a

Analysis

max time kernel
188s
max time network
192s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 14:40

Target

PROFORMA INVOICE-021&024.exe
Size

790KB
MD5

043a4e8ecc28687716d84bd0e91558b2
SHA1

4292192ed5bf6475de6ab5160f6b7a3e0ea6fe28
SHA256

b74d3621bbd10bcf7512d3a54a9625ee1ebd11d4351dd54fdd8dce4f36ca57b9
SHA512

d5e4b3ac6ccaa4ad36253aa1da31e67bd9d60d46faff3dc1968a1410970ccb2a59d83a4ad873fd568ea77ba3a55f7c43136b209f0ef43395e8dd571a1f26dbca
SSDEEP

12288:rxwDU1ezM/uL99H+lxVbQ5t7s9PWQQZNFFCV5i8Ehb:dmA699MxVbQDo9wZNFFCVU9h

Score

10^/10

Family

agenttesla

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4276-138-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

Processes:

PROFORMA INVOICE-021&024.exe

description pid process target process

PID 4964 set thread context of 4276 4964 PROFORMA INVOICE-021&024.exe MSBuild.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

MSBuild.exe

pid process

4276 MSBuild.exe
4276 MSBuild.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

MSBuild.exe

description pid process

Token: SeDebugPrivilege 4276 MSBuild.exe

description	pid	process	target process
PID 4964 set thread context of 4276	4964	PROFORMA INVOICE-021&024.exe	MSBuild.exe

pid	process
4276	MSBuild.exe
4276	MSBuild.exe

description	pid	process
Token: SeDebugPrivilege	4276	MSBuild.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

PROFORMA INVOICE-021&024.exe

description	pid	process	target process
PID 4964 wrote to memory of 4276	4964	PROFORMA INVOICE-021&024.exe	MSBuild.exe
PID 4964 wrote to memory of 4276	4964	PROFORMA INVOICE-021&024.exe	MSBuild.exe
PID 4964 wrote to memory of 4276	4964	PROFORMA INVOICE-021&024.exe	MSBuild.exe
PID 4964 wrote to memory of 4276	4964	PROFORMA INVOICE-021&024.exe	MSBuild.exe
PID 4964 wrote to memory of 4276	4964	PROFORMA INVOICE-021&024.exe	MSBuild.exe
PID 4964 wrote to memory of 4276	4964	PROFORMA INVOICE-021&024.exe	MSBuild.exe
PID 4964 wrote to memory of 4276	4964	PROFORMA INVOICE-021&024.exe	MSBuild.exe
PID 4964 wrote to memory of 4276	4964	PROFORMA INVOICE-021&024.exe	MSBuild.exe

memory/4276-137-0x0000000000000000-mapping.dmp

Download
memory/4276-138-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4964-132-0x00000000006E0000-0x00000000007AC000-memory.dmp

Filesize
816KB

Download
memory/4964-133-0x0000000005690000-0x0000000005C34000-memory.dmp

Filesize
5.6MB

Download
memory/4964-134-0x0000000005180000-0x0000000005212000-memory.dmp

Filesize
584KB

Download
memory/4964-135-0x0000000005160000-0x000000000516A000-memory.dmp

Filesize
40KB

Download
memory/4964-136-0x00000000078A0000-0x000000000793C000-memory.dmp

Filesize
624KB

Download