agenttesla | d1e71b7c7104d2e883617d0412e9ab6a67f6577765141655542400b99461bff9

Analysis

max time kernel
89s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
29-11-2022 13:59

Target

IsI1k3cWYIHjiSY.exe
Size

912KB
MD5

aa16d0032f7bbdb5882996f8a4b2b598
SHA1

7cfb835b0649726524ead9b043f206e348f9b34e
SHA256

d1e71b7c7104d2e883617d0412e9ab6a67f6577765141655542400b99461bff9
SHA512

e98ece293e800c81f0523327498c5afd53743b951dd21e90e1d6ed2b80753636ee19d0b8957ce74b36451bbb4880c4da1e149257bb252362e6ce95e4f050b556
SSDEEP

12288:IqunqU+ceCVCLUoytxa+387Ct2NiSD2Aml7j0lOW1Ddzoa1cfN:ruhCLlc87X7D2olL1DdEPf

Score

10^/10

Family

agenttesla

https://api.telegram.org/bot5015424630:AAHYFU1sKtYqSORHBErFCWNjJz1TpXKj30w/sendDocument

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla payload 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1880-63-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1880-64-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1880-65-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1880-66-0x000000000043762E-mapping.dmp	family_agenttesla
behavioral1/memory/1880-68-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1880-70-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

Processes:

IsI1k3cWYIHjiSY.exe

description pid process target process

PID 1716 set thread context of 1880 1716 IsI1k3cWYIHjiSY.exe IsI1k3cWYIHjiSY.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

IsI1k3cWYIHjiSY.exe

pid process

1880 IsI1k3cWYIHjiSY.exe
1880 IsI1k3cWYIHjiSY.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

IsI1k3cWYIHjiSY.exe

description pid process

Token: SeDebugPrivilege 1880 IsI1k3cWYIHjiSY.exe

description	pid	process	target process
PID 1716 set thread context of 1880	1716	IsI1k3cWYIHjiSY.exe	IsI1k3cWYIHjiSY.exe

pid	process
1880	IsI1k3cWYIHjiSY.exe
1880	IsI1k3cWYIHjiSY.exe

description	pid	process
Token: SeDebugPrivilege	1880	IsI1k3cWYIHjiSY.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

IsI1k3cWYIHjiSY.exe

description	pid	process	target process
PID 1716 wrote to memory of 1880	1716	IsI1k3cWYIHjiSY.exe	IsI1k3cWYIHjiSY.exe
PID 1716 wrote to memory of 1880	1716	IsI1k3cWYIHjiSY.exe	IsI1k3cWYIHjiSY.exe
PID 1716 wrote to memory of 1880	1716	IsI1k3cWYIHjiSY.exe	IsI1k3cWYIHjiSY.exe
PID 1716 wrote to memory of 1880	1716	IsI1k3cWYIHjiSY.exe	IsI1k3cWYIHjiSY.exe
PID 1716 wrote to memory of 1880	1716	IsI1k3cWYIHjiSY.exe	IsI1k3cWYIHjiSY.exe
PID 1716 wrote to memory of 1880	1716	IsI1k3cWYIHjiSY.exe	IsI1k3cWYIHjiSY.exe
PID 1716 wrote to memory of 1880	1716	IsI1k3cWYIHjiSY.exe	IsI1k3cWYIHjiSY.exe
PID 1716 wrote to memory of 1880	1716	IsI1k3cWYIHjiSY.exe	IsI1k3cWYIHjiSY.exe
PID 1716 wrote to memory of 1880	1716	IsI1k3cWYIHjiSY.exe	IsI1k3cWYIHjiSY.exe

memory/1716-54-0x0000000000D80000-0x0000000000E6A000-memory.dmp

Filesize
936KB

Download
memory/1716-55-0x00000000765B1000-0x00000000765B3000-memory.dmp

Filesize
8KB

Download
memory/1716-56-0x0000000000310000-0x0000000000326000-memory.dmp

Filesize
88KB

Download
memory/1716-57-0x0000000000330000-0x000000000033E000-memory.dmp

Filesize
56KB

Download
memory/1716-58-0x0000000005710000-0x00000000057A8000-memory.dmp

Filesize
608KB

Download
memory/1716-59-0x0000000004270000-0x00000000042CE000-memory.dmp

Filesize
376KB

Download
memory/1880-60-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1880-61-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1880-63-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1880-64-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1880-65-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1880-66-0x000000000043762E-mapping.dmp

Download
memory/1880-68-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1880-70-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download