agenttesla | 2c0e84875dd9890e215197a4d3d51cfafaeb40c0a41b29781b228e03de2aba35

General

Target

Advice.exe
Size

753KB
MD5

751532ac5635d8c77a474df541c780d9
SHA1

d7a962a32cafae1e791d2f896d0c9bb6ae0384d0
SHA256

ef176faa1d186e67f9ab559b32c35dcfe874bef49156ebcd414d5c032ec2f55a
SHA512

4a32296e5b02d8a6cf5c839ec0425231bde4d4d51dc92030c4fd658c6da11cc49521523a9547e40d658146b0a703ac04d12d2df2f78f25c2863d28a7a8fcb474
SSDEEP

12288:939riVwf3iJ+HN3TFfIKXKH0oKnkishvwWqWogZWhwOANLw/y/9Zu/E9jtgmdbtb:9Nriy/fTFfyRIA2R59Ntjk

Score

10^/10

Family

agenttesla

C2

https://api.telegram.org/bot1900392974:AAEB_yGGlWksNcNC4Dg08OgUSlmDON2w098/sendDocument

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla payload 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/612-63-0x0000000000090000-0x00000000000CC000-memory.dmp	family_agenttesla
behavioral1/memory/612-64-0x0000000000090000-0x00000000000CC000-memory.dmp	family_agenttesla
behavioral1/memory/520-70-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/520-71-0x000000000043772E-mapping.dmp	family_agenttesla
behavioral1/memory/520-75-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/520-73-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

Processes:

Advice.exe

description pid process target process

PID 1688 set thread context of 520 1688 Advice.exe RegAsm.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

Advice.exeRegAsm.exe

pid process

1688 Advice.exe
1688 Advice.exe
1688 Advice.exe
520 RegAsm.exe
520 RegAsm.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Advice.exeRegAsm.exe

description pid process

Token: SeDebugPrivilege 1688 Advice.exe
Token: SeDebugPrivilege 520 RegAsm.exe

description	pid	process	target process
PID 1688 set thread context of 520	1688	Advice.exe	RegAsm.exe

description	pid	process
Token: SeDebugPrivilege	1688	Advice.exe
Token: SeDebugPrivilege	520	RegAsm.exe

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

Advice.exe

description	pid	process	target process
PID 1688 wrote to memory of 612	1688	Advice.exe	RegAsm.exe
PID 1688 wrote to memory of 612	1688	Advice.exe	RegAsm.exe
PID 1688 wrote to memory of 612	1688	Advice.exe	RegAsm.exe
PID 1688 wrote to memory of 612	1688	Advice.exe	RegAsm.exe
PID 1688 wrote to memory of 612	1688	Advice.exe	RegAsm.exe
PID 1688 wrote to memory of 612	1688	Advice.exe	RegAsm.exe
PID 1688 wrote to memory of 612	1688	Advice.exe	RegAsm.exe
PID 1688 wrote to memory of 612	1688	Advice.exe	RegAsm.exe
PID 1688 wrote to memory of 612	1688	Advice.exe	RegAsm.exe
PID 1688 wrote to memory of 612	1688	Advice.exe	RegAsm.exe
PID 1688 wrote to memory of 612	1688	Advice.exe	RegAsm.exe
PID 1688 wrote to memory of 612	1688	Advice.exe	RegAsm.exe
PID 1688 wrote to memory of 520	1688	Advice.exe	RegAsm.exe
PID 1688 wrote to memory of 520	1688	Advice.exe	RegAsm.exe
PID 1688 wrote to memory of 520	1688	Advice.exe	RegAsm.exe
PID 1688 wrote to memory of 520	1688	Advice.exe	RegAsm.exe
PID 1688 wrote to memory of 520	1688	Advice.exe	RegAsm.exe
PID 1688 wrote to memory of 520	1688	Advice.exe	RegAsm.exe
PID 1688 wrote to memory of 520	1688	Advice.exe	RegAsm.exe
PID 1688 wrote to memory of 520	1688	Advice.exe	RegAsm.exe
PID 1688 wrote to memory of 520	1688	Advice.exe	RegAsm.exe
PID 1688 wrote to memory of 520	1688	Advice.exe	RegAsm.exe
PID 1688 wrote to memory of 520	1688	Advice.exe	RegAsm.exe
PID 1688 wrote to memory of 520	1688	Advice.exe	RegAsm.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
PID:612

memory/520-70-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/520-73-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/520-75-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/520-71-0x000000000043772E-mapping.dmp

Download
memory/612-64-0x0000000000090000-0x00000000000CC000-memory.dmp

Filesize
240KB

Download
memory/612-60-0x0000000000090000-0x00000000000CC000-memory.dmp

Filesize
240KB

Download
memory/612-61-0x0000000000090000-0x00000000000CC000-memory.dmp

Filesize
240KB

Download
memory/612-63-0x0000000000090000-0x00000000000CC000-memory.dmp

Filesize
240KB

Download
memory/1688-59-0x0000000000710000-0x0000000000716000-memory.dmp

Filesize
24KB

Download
memory/1688-54-0x0000000001290000-0x0000000001352000-memory.dmp

Filesize
776KB

Download
memory/1688-58-0x0000000001040000-0x000000000105A000-memory.dmp

Filesize
104KB

Download
memory/1688-57-0x0000000000760000-0x0000000000778000-memory.dmp

Filesize
96KB

Download
memory/1688-56-0x00000000006B0000-0x00000000006E0000-memory.dmp

Filesize
192KB

Download
memory/1688-55-0x00000000763F1000-0x00000000763F3000-memory.dmp

Filesize
8KB

Download