agenttesla | 759b0bf83a7cbc7ab0e88fcf11428e36ee8f1e5b61b55344408829529c0d4210

Analysis

max time kernel
237s
max time network
273s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
28-11-2022 07:34

Target

Halkbank.exe
Size

610KB
MD5

3b3a8ec84050161f9f4c9fcbbc51f72d
SHA1

119b127ea5dcb49fe30ad6061e46fc0c3685cdeb
SHA256

759b0bf83a7cbc7ab0e88fcf11428e36ee8f1e5b61b55344408829529c0d4210
SHA512

93e0ab32482c74c86ef17de6a75dc12544a57a427942e854d84efbd964491a1a50b38aec22b141c2ebd819c96fc991ad595a1f52f008a829859b468f14ca6b0a
SSDEEP

12288:2WO+/pbKbfhpdnkUjoHP6ktw6NSj0+7aPG8WDs:2W5bKNpdkUjIP6jZ0vmo

Score

10^/10

Family

agenttesla

https://api.telegram.org/bot5792996127:AAEo0wCCYZp60yQsf_X1P7t-T5AAK5KPYXY/

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Suspicious use of SetThreadContext 1 IoCs

Processes:

Halkbank.exe

description pid process target process

PID 1824 set thread context of 1052 1824 Halkbank.exe Halkbank.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

Halkbank.exe

pid process

1824 Halkbank.exe
1824 Halkbank.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Halkbank.exeHalkbank.exe

description pid process

Token: SeDebugPrivilege 1824 Halkbank.exe
Token: SeDebugPrivilege 1052 Halkbank.exe

description	pid	process	target process
PID 1824 set thread context of 1052	1824	Halkbank.exe	Halkbank.exe

pid	process
1824	Halkbank.exe
1824	Halkbank.exe

description	pid	process
Token: SeDebugPrivilege	1824	Halkbank.exe
Token: SeDebugPrivilege	1052	Halkbank.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

Halkbank.exe

description	pid	process	target process
PID 1824 wrote to memory of 1052	1824	Halkbank.exe	Halkbank.exe
PID 1824 wrote to memory of 1052	1824	Halkbank.exe	Halkbank.exe
PID 1824 wrote to memory of 1052	1824	Halkbank.exe	Halkbank.exe
PID 1824 wrote to memory of 1052	1824	Halkbank.exe	Halkbank.exe
PID 1824 wrote to memory of 1052	1824	Halkbank.exe	Halkbank.exe
PID 1824 wrote to memory of 1052	1824	Halkbank.exe	Halkbank.exe
PID 1824 wrote to memory of 1052	1824	Halkbank.exe	Halkbank.exe
PID 1824 wrote to memory of 1052	1824	Halkbank.exe	Halkbank.exe

C:\Users\Admin\AppData\Local\Temp\Halkbank.exe
"C:\Users\Admin\AppData\Local\Temp\Halkbank.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1052

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Halkbank.exe.log
Filesize
1KB

MD5
8ec831f3e3a3f77e4a7b9cd32b48384c

SHA1
d83f09fd87c5bd86e045873c231c14836e76a05c

SHA256
7667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982

SHA512
26bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3

Download Submit
memory/1052-137-0x0000000000000000-mapping.dmp

Download
memory/1052-138-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1824-132-0x0000000000060000-0x00000000000FE000-memory.dmp

Filesize
632KB

Download
memory/1824-133-0x0000000004FC0000-0x0000000005564000-memory.dmp

Filesize
5.6MB

Download
memory/1824-134-0x0000000004AF0000-0x0000000004B82000-memory.dmp

Filesize
584KB

Download
memory/1824-135-0x0000000004AB0000-0x0000000004ABA000-memory.dmp

Filesize
40KB

Download
memory/1824-136-0x0000000006E50000-0x0000000006EEC000-memory.dmp

Filesize
624KB

Download