agenttesla | 9bf192a23eeb844b6e8b01c41d085d1c2bfb576653732d99d7468571f1a28fb5

Analysis

max time kernel
113s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 16:59

Target

po.exe
Size

1.2MB
MD5

9f47406520b38e4f56e23574dd77f25b
SHA1

08b429e3c04ee8ab3dee4f767538e1d7402e9d83
SHA256

9bf192a23eeb844b6e8b01c41d085d1c2bfb576653732d99d7468571f1a28fb5
SHA512

93bcb463ebf88daf2fcdfcea2e2e79afdf3376f5fe36fd24ec1f622eaad2a4079749a15ba9ff0c9d7e0034ecb4b4362b7b5b06c01ebd2edb9983415b71a1cbf3
SSDEEP

12288:/ZwVYsZ1DX/VDJtV7WtfpC2wsRaq5ldSupauq7ovqVxRAmszPE/aHLwLKWF/JeDD:/SVYkEgsRaqHcHUELGPyYL8KK6je

Score

10^/10

Family

agenttesla

https://api.telegram.org/bot5088709131:AAFHCIxHU907RAI3XEaH2G6LgE9wrdrAgI0/sendDocument

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla payload 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1620-63-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1620-64-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1620-66-0x000000000043787E-mapping.dmp	family_agenttesla
behavioral1/memory/1620-65-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1620-68-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1620-70-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

Processes:

po.exe

description pid process target process

PID 2012 set thread context of 1620 2012 po.exe po.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

po.exe

pid process

1620 po.exe
1620 po.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

po.exe

description pid process

Token: SeDebugPrivilege 1620 po.exe

description	pid	process	target process
PID 2012 set thread context of 1620	2012	po.exe	po.exe

pid	process
1620	po.exe
1620	po.exe

description	pid	process
Token: SeDebugPrivilege	1620	po.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

po.exe

description	pid	process	target process
PID 2012 wrote to memory of 1620	2012	po.exe	po.exe
PID 2012 wrote to memory of 1620	2012	po.exe	po.exe
PID 2012 wrote to memory of 1620	2012	po.exe	po.exe
PID 2012 wrote to memory of 1620	2012	po.exe	po.exe
PID 2012 wrote to memory of 1620	2012	po.exe	po.exe
PID 2012 wrote to memory of 1620	2012	po.exe	po.exe
PID 2012 wrote to memory of 1620	2012	po.exe	po.exe
PID 2012 wrote to memory of 1620	2012	po.exe	po.exe
PID 2012 wrote to memory of 1620	2012	po.exe	po.exe

memory/1620-64-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1620-63-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1620-70-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1620-68-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1620-65-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1620-61-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1620-66-0x000000000043787E-mapping.dmp

Download
memory/1620-60-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2012-55-0x0000000076391000-0x0000000076393000-memory.dmp

Filesize
8KB

Download
memory/2012-54-0x0000000000F40000-0x0000000001070000-memory.dmp

Filesize
1.2MB

Download
memory/2012-59-0x0000000007F50000-0x0000000007FCA000-memory.dmp

Filesize
488KB

Download
memory/2012-58-0x0000000007DF0000-0x0000000007EA2000-memory.dmp

Filesize
712KB

Download
memory/2012-57-0x0000000000380000-0x000000000038C000-memory.dmp

Filesize
48KB

Download
memory/2012-56-0x00000000003D0000-0x00000000003E8000-memory.dmp

Filesize
96KB

Download