agenttesla | d5de496be1535d0b8d9c8f57087e9ae2a26aaf7c33c2ddca65b3231dc3b2460b

Analysis

max time kernel
118s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29-11-2022 17:24

Target

SWIFT copy.29112022.Pdf.exe
Size

745KB
MD5

5f400bae896422a69db460a4507fd657
SHA1

e90b7c431d34b39bef8492de7fb987f51c3fb804
SHA256

d5de496be1535d0b8d9c8f57087e9ae2a26aaf7c33c2ddca65b3231dc3b2460b
SHA512

7e54192c570d2a7fe7700d69bd782173dfe41dc102afceffbda47207d4bfcb80783f7c70bf9666e287ccbcf413bf482aeb321fe559ba7b75ae43416b0feee643
SSDEEP

12288:ZYn2P8Ai1FDasqS6/0kz0z63eR7J/ZmhOQQVvedp:qn20t1Ffl+0kzAttq62

Score

10^/10

Family

agenttesla

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/736-138-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

Processes:

SWIFT copy.29112022.Pdf.exe

description pid process target process

PID 4364 set thread context of 736 4364 SWIFT copy.29112022.Pdf.exe SWIFT copy.29112022.Pdf.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

SWIFT copy.29112022.Pdf.exe

pid process

736 SWIFT copy.29112022.Pdf.exe
736 SWIFT copy.29112022.Pdf.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

SWIFT copy.29112022.Pdf.exe

description pid process

Token: SeDebugPrivilege 736 SWIFT copy.29112022.Pdf.exe

description	pid	process	target process
PID 4364 set thread context of 736	4364	SWIFT copy.29112022.Pdf.exe	SWIFT copy.29112022.Pdf.exe

pid	process
736	SWIFT copy.29112022.Pdf.exe
736	SWIFT copy.29112022.Pdf.exe

description	pid	process
Token: SeDebugPrivilege	736	SWIFT copy.29112022.Pdf.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

SWIFT copy.29112022.Pdf.exe

description	pid	process	target process
PID 4364 wrote to memory of 736	4364	SWIFT copy.29112022.Pdf.exe	SWIFT copy.29112022.Pdf.exe
PID 4364 wrote to memory of 736	4364	SWIFT copy.29112022.Pdf.exe	SWIFT copy.29112022.Pdf.exe
PID 4364 wrote to memory of 736	4364	SWIFT copy.29112022.Pdf.exe	SWIFT copy.29112022.Pdf.exe
PID 4364 wrote to memory of 736	4364	SWIFT copy.29112022.Pdf.exe	SWIFT copy.29112022.Pdf.exe
PID 4364 wrote to memory of 736	4364	SWIFT copy.29112022.Pdf.exe	SWIFT copy.29112022.Pdf.exe
PID 4364 wrote to memory of 736	4364	SWIFT copy.29112022.Pdf.exe	SWIFT copy.29112022.Pdf.exe
PID 4364 wrote to memory of 736	4364	SWIFT copy.29112022.Pdf.exe	SWIFT copy.29112022.Pdf.exe
PID 4364 wrote to memory of 736	4364	SWIFT copy.29112022.Pdf.exe	SWIFT copy.29112022.Pdf.exe

memory/736-137-0x0000000000000000-mapping.dmp

Download
memory/736-138-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/736-139-0x00000000060A0000-0x0000000006106000-memory.dmp

Filesize
408KB

Download
memory/4364-132-0x0000000000EF0000-0x0000000000FB0000-memory.dmp

Filesize
768KB

Download
memory/4364-133-0x0000000006060000-0x0000000006604000-memory.dmp

Filesize
5.6MB

Download
memory/4364-134-0x0000000005970000-0x0000000005A02000-memory.dmp

Filesize
584KB

Download
memory/4364-135-0x0000000005960000-0x000000000596A000-memory.dmp

Filesize
40KB

Download
memory/4364-136-0x0000000008430000-0x00000000084CC000-memory.dmp

Filesize
624KB

Download