agenttesla | 9bf192a23eeb844b6e8b01c41d085d1c2bfb576653732d99d7468571f1a28fb5

Analysis

max time kernel
160s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 16:59

Target

po.exe
Size

1.2MB
MD5

9f47406520b38e4f56e23574dd77f25b
SHA1

08b429e3c04ee8ab3dee4f767538e1d7402e9d83
SHA256

9bf192a23eeb844b6e8b01c41d085d1c2bfb576653732d99d7468571f1a28fb5
SHA512

93bcb463ebf88daf2fcdfcea2e2e79afdf3376f5fe36fd24ec1f622eaad2a4079749a15ba9ff0c9d7e0034ecb4b4362b7b5b06c01ebd2edb9983415b71a1cbf3
SSDEEP

12288:/ZwVYsZ1DX/VDJtV7WtfpC2wsRaq5ldSupauq7ovqVxRAmszPE/aHLwLKWF/JeDD:/SVYkEgsRaqHcHUELGPyYL8KK6je

Score

10^/10

Family

agenttesla

https://api.telegram.org/bot5088709131:AAFHCIxHU907RAI3XEaH2G6LgE9wrdrAgI0/sendDocument

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4388-138-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

Processes:

po.exe

description pid process target process

PID 4800 set thread context of 4388 4800 po.exe po.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

po.exe

pid process

4388 po.exe
4388 po.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

po.exe

description pid process

Token: SeDebugPrivilege 4388 po.exe

description	pid	process	target process
PID 4800 set thread context of 4388	4800	po.exe	po.exe

pid	process
4388	po.exe
4388	po.exe

description	pid	process
Token: SeDebugPrivilege	4388	po.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

po.exe

description	pid	process	target process
PID 4800 wrote to memory of 4388	4800	po.exe	po.exe
PID 4800 wrote to memory of 4388	4800	po.exe	po.exe
PID 4800 wrote to memory of 4388	4800	po.exe	po.exe
PID 4800 wrote to memory of 4388	4800	po.exe	po.exe
PID 4800 wrote to memory of 4388	4800	po.exe	po.exe
PID 4800 wrote to memory of 4388	4800	po.exe	po.exe
PID 4800 wrote to memory of 4388	4800	po.exe	po.exe
PID 4800 wrote to memory of 4388	4800	po.exe	po.exe

memory/4388-137-0x0000000000000000-mapping.dmp

Download
memory/4388-138-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4388-139-0x0000000005CA0000-0x0000000005D06000-memory.dmp

Filesize
408KB

Download
memory/4800-132-0x0000000000870000-0x00000000009A0000-memory.dmp

Filesize
1.2MB

Download
memory/4800-133-0x0000000005970000-0x0000000005F14000-memory.dmp

Filesize
5.6MB

Download
memory/4800-134-0x00000000053C0000-0x0000000005452000-memory.dmp

Filesize
584KB

Download
memory/4800-135-0x0000000005310000-0x000000000531A000-memory.dmp

Filesize
40KB

Download
memory/4800-136-0x0000000001250000-0x00000000012EC000-memory.dmp

Filesize
624KB

Download