agenttesla | 8d810fbd4a4f89f075f6a69784928c8d4b4c5b549ed32606d5522790d062d474

Analysis

max time kernel
204s
max time network
207s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 14:40

Target

Purchase order.exe
Size

699KB
MD5

71473173f728c0ae8c921000619d3950
SHA1

dca46a8b23db8f8556858ec18a71a4ef4be9df60
SHA256

c042e3d59aa2845f1812cd9b172946cfb60207f81f8faa7350446140ff6b4549
SHA512

f07f46b1459bc2db3a65a473d055e655e2e8f98443feb5274e6ba0a3873f4f7a13a2fbd59ac5e261649fc525cfdbe58271bf7f1977ac2838072152245e697e19
SSDEEP

12288:2jcWtGDCBpQW7LFc2lI1tmPSbouyoN9bkvzAt08CyqXT:zGBpxB0tmPSNVUCSXT

Score

10^/10

Family

agenttesla

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Suspicious use of SetThreadContext 1 IoCs

Processes:

Purchase order.exe

description pid process target process

PID 4776 set thread context of 2188 4776 Purchase order.exe Purchase order.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

Purchase order.exe

pid process

2188 Purchase order.exe
2188 Purchase order.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Purchase order.exe

description pid process

Token: SeDebugPrivilege 2188 Purchase order.exe

description	pid	process	target process
PID 4776 set thread context of 2188	4776	Purchase order.exe	Purchase order.exe

pid	process
2188	Purchase order.exe
2188	Purchase order.exe

description	pid	process
Token: SeDebugPrivilege	2188	Purchase order.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

Purchase order.exe

description	pid	process	target process
PID 4776 wrote to memory of 2188	4776	Purchase order.exe	Purchase order.exe
PID 4776 wrote to memory of 2188	4776	Purchase order.exe	Purchase order.exe
PID 4776 wrote to memory of 2188	4776	Purchase order.exe	Purchase order.exe
PID 4776 wrote to memory of 2188	4776	Purchase order.exe	Purchase order.exe
PID 4776 wrote to memory of 2188	4776	Purchase order.exe	Purchase order.exe
PID 4776 wrote to memory of 2188	4776	Purchase order.exe	Purchase order.exe
PID 4776 wrote to memory of 2188	4776	Purchase order.exe	Purchase order.exe
PID 4776 wrote to memory of 2188	4776	Purchase order.exe	Purchase order.exe

memory/2188-138-0x0000000000000000-mapping.dmp

Download
memory/2188-139-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2188-140-0x0000000005AC0000-0x0000000005B26000-memory.dmp

Filesize
408KB

Download
memory/4776-132-0x0000000000190000-0x0000000000246000-memory.dmp

Filesize
728KB

Download
memory/4776-133-0x0000000005340000-0x00000000058E4000-memory.dmp

Filesize
5.6MB

Download
memory/4776-134-0x0000000004C70000-0x0000000004D02000-memory.dmp

Filesize
584KB

Download
memory/4776-135-0x0000000004C00000-0x0000000004C0A000-memory.dmp

Filesize
40KB

Download
memory/4776-136-0x0000000005120000-0x00000000052C6000-memory.dmp

Filesize
1.6MB

Download
memory/4776-137-0x0000000007340000-0x00000000073DC000-memory.dmp

Filesize
624KB

Download