agenttesla | ecfe7056494cbc6dc0d572e3d2a7ead974f20cf5ad98bd237ad2d81a36f07cb7

Analysis

max time kernel
172s
max time network
180s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2022 05:19

Target

BANK NAME.exe
Size

663KB
MD5

3cbd0f4d5317fbe2027c49c21c4f7b24
SHA1

567601b9520f05e4dec7559212af1fd863e328a0
SHA256

ecfe7056494cbc6dc0d572e3d2a7ead974f20cf5ad98bd237ad2d81a36f07cb7
SHA512

b1cb18e5b72c4e383eaf49bf35ac941c27e072e5b5bb47f982c9b076afe2cbc5791b0f11e4b4be071196cd7ed44914bcb09e892d06641fd340d63651a2ef31bc
SSDEEP

12288:jWI3IvM3zrbETCl+BkGtahovqRz0oJi3ihsSbymQJOzKChpHskFgFwIyXCDL:qIYU376Cb4ahsqdHi3ihsSbmsWChxsk

Score

10^/10

Family

agenttesla

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Suspicious use of SetThreadContext 1 IoCs

Processes:

BANK NAME.exe

description pid process target process

PID 4420 set thread context of 4516 4420 BANK NAME.exe RegSvcs.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

BANK NAME.exeRegSvcs.exe

pid process

4420 BANK NAME.exe
4420 BANK NAME.exe
4516 RegSvcs.exe
4516 RegSvcs.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

BANK NAME.exeRegSvcs.exe

description pid process

Token: SeDebugPrivilege 4420 BANK NAME.exe
Token: SeDebugPrivilege 4516 RegSvcs.exe

description	pid	process	target process
PID 4420 set thread context of 4516	4420	BANK NAME.exe	RegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	4420	BANK NAME.exe
Token: SeDebugPrivilege	4516	RegSvcs.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

BANK NAME.exe

description	pid	process	target process
PID 4420 wrote to memory of 4312	4420	BANK NAME.exe	RegSvcs.exe
PID 4420 wrote to memory of 4312	4420	BANK NAME.exe	RegSvcs.exe
PID 4420 wrote to memory of 4312	4420	BANK NAME.exe	RegSvcs.exe
PID 4420 wrote to memory of 4516	4420	BANK NAME.exe	RegSvcs.exe
PID 4420 wrote to memory of 4516	4420	BANK NAME.exe	RegSvcs.exe
PID 4420 wrote to memory of 4516	4420	BANK NAME.exe	RegSvcs.exe
PID 4420 wrote to memory of 4516	4420	BANK NAME.exe	RegSvcs.exe
PID 4420 wrote to memory of 4516	4420	BANK NAME.exe	RegSvcs.exe
PID 4420 wrote to memory of 4516	4420	BANK NAME.exe	RegSvcs.exe
PID 4420 wrote to memory of 4516	4420	BANK NAME.exe	RegSvcs.exe
PID 4420 wrote to memory of 4516	4420	BANK NAME.exe	RegSvcs.exe

memory/4312-137-0x0000000000000000-mapping.dmp

Download
memory/4420-132-0x0000000000560000-0x000000000060C000-memory.dmp

Filesize
688KB

Download
memory/4420-133-0x00000000055C0000-0x0000000005B64000-memory.dmp

Filesize
5.6MB

Download
memory/4420-134-0x00000000052B0000-0x0000000005342000-memory.dmp

Filesize
584KB

Download
memory/4420-135-0x0000000005400000-0x000000000549C000-memory.dmp

Filesize
624KB

Download
memory/4420-136-0x00000000052A0000-0x00000000052AA000-memory.dmp

Filesize
40KB

Download
memory/4516-138-0x0000000000000000-mapping.dmp

Download
memory/4516-139-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4516-140-0x0000000005C60000-0x0000000005CC6000-memory.dmp

Filesize
408KB

Download