agenttesla | ec90aedf80763b313c646fd0c62b4a7f627d3df787416e562d276e76022bc857

Analysis

max time kernel
248s
max time network
310s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
05-12-2022 11:13

Target

Payment.exe
Size

584KB
MD5

a158bd528300b85b97ceabdb5ce89ec7
SHA1

291341762d795899609f283ec1acdb4ac2bc6a6f
SHA256

ec90aedf80763b313c646fd0c62b4a7f627d3df787416e562d276e76022bc857
SHA512

96d61cc09f96a126f9b3b39556b87c1baf47b58d28c4b5192647a8b9aa1121a1f5fe2306aacc6491eef3442959701c207207e2976699efc0a71e22fd851c5781
SSDEEP

12288:xeqKCgTod2M+g0EiQ4/Bv3h3MaUZ9KtaS2OgiotlMDXthPaasNLMl9jq:MqKsh02C7MVwf2O3otlk9Rs5k9j

Score

10^/10

Family

agenttesla

https://api.telegram.org/bot5083863399:AAH9g72QTdN88jNOd6_tBrE8gEd-FpXnfHE/sendDocument

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4640-139-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

Processes:

Payment.exe

description pid process target process

PID 2792 set thread context of 4640 2792 Payment.exe Payment.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

Payment.exe

pid process

4640 Payment.exe
4640 Payment.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Payment.exe

description pid process

Token: SeDebugPrivilege 4640 Payment.exe

description	pid	process	target process
PID 2792 set thread context of 4640	2792	Payment.exe	Payment.exe

pid	process
4640	Payment.exe
4640	Payment.exe

description	pid	process
Token: SeDebugPrivilege	4640	Payment.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

Payment.exe

description	pid	process	target process
PID 2792 wrote to memory of 4640	2792	Payment.exe	Payment.exe
PID 2792 wrote to memory of 4640	2792	Payment.exe	Payment.exe
PID 2792 wrote to memory of 4640	2792	Payment.exe	Payment.exe
PID 2792 wrote to memory of 4640	2792	Payment.exe	Payment.exe
PID 2792 wrote to memory of 4640	2792	Payment.exe	Payment.exe
PID 2792 wrote to memory of 4640	2792	Payment.exe	Payment.exe
PID 2792 wrote to memory of 4640	2792	Payment.exe	Payment.exe
PID 2792 wrote to memory of 4640	2792	Payment.exe	Payment.exe

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Payment.exe.log
Filesize
1KB

MD5
b57b1ea0e9817bd8c90747e991b77447

SHA1
df63d993dd8b356c2aa8bdd5fed4ead467d0ef1f

SHA256
af13b787c47fa267cbca28ec758f254d5407c5a418fb86fff25ce5aec8b0f99c

SHA512
31e8ed3d1f8a3050b53e2b54ded1cde057ab76da28785347ba45a24535974207b14cb7f54f620f6e3a6e679705d7349005d7c29170d988c09c071c852cde621c

Download Submit
memory/2792-132-0x0000000000130000-0x00000000001C2000-memory.dmp

Filesize
584KB

Download
memory/2792-133-0x00000000050A0000-0x0000000005644000-memory.dmp

Filesize
5.6MB

Download
memory/2792-134-0x0000000004B90000-0x0000000004C22000-memory.dmp

Filesize
584KB

Download
memory/2792-135-0x0000000005650000-0x00000000057F6000-memory.dmp

Filesize
1.6MB

Download
memory/2792-136-0x0000000004D20000-0x0000000004D2A000-memory.dmp

Filesize
40KB

Download
memory/2792-137-0x00000000070D0000-0x000000000716C000-memory.dmp

Filesize
624KB

Download
memory/4640-138-0x0000000000000000-mapping.dmp

Download
memory/4640-139-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download