agenttesla | a1480ab1090748ce893678eb891dffb2b82ee87484e5b585f620926e2c3724ef

Analysis

max time kernel
187s
max time network
221s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
06-12-2022 07:00

Target

DhlShipmentDetails06Dec.exe
Size

861KB
MD5

ccbd57fed0acd03f1a2fa975a5e2378c
SHA1

97174258a45c52001ebbddbb8efaf9f485a83321
SHA256

a1480ab1090748ce893678eb891dffb2b82ee87484e5b585f620926e2c3724ef
SHA512

a0bbb47958f248d718fa22ec4bb565cafc1e330c1058ca991c9d110019fc9a679dc43d38533b7915e04b259517df78444ee4eb47bfd0269604cdf7d38515217f
SSDEEP

12288:OcGjmaLGqW2oKPlcqL9DHnMU1l9i0OL/O2TfpV+CUu6StKRgKZ/nXt7virmWhlG1:lsoq3oKOqRDnMUtnODr3RUu6S8

Score

10^/10

Family

agenttesla

https://api.telegram.org/bot5702698141:AAH3zArxBJTzE6y3KAwr-22tBuWNisJ3iEg/

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Suspicious use of SetThreadContext 1 IoCs

Processes:

DhlShipmentDetails06Dec.exe

description pid process target process

PID 1952 set thread context of 2148 1952 DhlShipmentDetails06Dec.exe DhlShipmentDetails06Dec.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

DhlShipmentDetails06Dec.exe

pid process

2148 DhlShipmentDetails06Dec.exe
2148 DhlShipmentDetails06Dec.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

DhlShipmentDetails06Dec.exe

description pid process

Token: SeDebugPrivilege 2148 DhlShipmentDetails06Dec.exe

description	pid	process	target process
PID 1952 set thread context of 2148	1952	DhlShipmentDetails06Dec.exe	DhlShipmentDetails06Dec.exe

pid	process
2148	DhlShipmentDetails06Dec.exe
2148	DhlShipmentDetails06Dec.exe

description	pid	process
Token: SeDebugPrivilege	2148	DhlShipmentDetails06Dec.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

DhlShipmentDetails06Dec.exe

description	pid	process	target process
PID 1952 wrote to memory of 2148	1952	DhlShipmentDetails06Dec.exe	DhlShipmentDetails06Dec.exe
PID 1952 wrote to memory of 2148	1952	DhlShipmentDetails06Dec.exe	DhlShipmentDetails06Dec.exe
PID 1952 wrote to memory of 2148	1952	DhlShipmentDetails06Dec.exe	DhlShipmentDetails06Dec.exe
PID 1952 wrote to memory of 2148	1952	DhlShipmentDetails06Dec.exe	DhlShipmentDetails06Dec.exe
PID 1952 wrote to memory of 2148	1952	DhlShipmentDetails06Dec.exe	DhlShipmentDetails06Dec.exe
PID 1952 wrote to memory of 2148	1952	DhlShipmentDetails06Dec.exe	DhlShipmentDetails06Dec.exe
PID 1952 wrote to memory of 2148	1952	DhlShipmentDetails06Dec.exe	DhlShipmentDetails06Dec.exe
PID 1952 wrote to memory of 2148	1952	DhlShipmentDetails06Dec.exe	DhlShipmentDetails06Dec.exe

memory/1952-132-0x0000000000140000-0x000000000021E000-memory.dmp

Filesize
888KB

Download
memory/1952-133-0x0000000005140000-0x00000000056E4000-memory.dmp

Filesize
5.6MB

Download
memory/1952-134-0x0000000004C30000-0x0000000004CC2000-memory.dmp

Filesize
584KB

Download
memory/1952-135-0x0000000004DD0000-0x0000000004DDA000-memory.dmp

Filesize
40KB

Download
memory/1952-136-0x0000000006FB0000-0x000000000704C000-memory.dmp

Filesize
624KB

Download
memory/2148-137-0x0000000000000000-mapping.dmp

Download
memory/2148-138-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2148-139-0x0000000005ED0000-0x0000000005F36000-memory.dmp

Filesize
408KB

Download