agenttesla | d325d9ecd5d7b1e7871de63f0807aa53457f82985845a9a6a4e45c0102a9fa69

Analysis

max time kernel
187s
max time network
185s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
07-12-2022 13:36

Target

d325d9ecd5d7b1e7871de63f0807aa53457f82985845a9a6a4e45c0102a9fa69.exe
Size

492KB
MD5

09e1a3c55cbb5301bd7fd0999cc4258b
SHA1

2cd3da7a201961bf063246579b11fcbad5774994
SHA256

d325d9ecd5d7b1e7871de63f0807aa53457f82985845a9a6a4e45c0102a9fa69
SHA512

1b8021949803303619b91964551a72d986ac703c36c1db336c636cf529e8cf26a4161c1f382f27f33ca7675e8f9667dc4c6b0670c50d824d37083dbbadcdcbe8
SSDEEP

12288:g/64ce865hvybcRrJz2nHp31swuzv8LUpIvn:gpce865U4Rtk11s1T8D/

Score

10^/10

Family

agenttesla

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Suspicious use of SetThreadContext 1 IoCs

Processes:

d325d9ecd5d7b1e7871de63f0807aa53457f82985845a9a6a4e45c0102a9fa69.exe

description	pid	process	target process
PID 5084 set thread context of 2640	5084	d325d9ecd5d7b1e7871de63f0807aa53457f82985845a9a6a4e45c0102a9fa69.exe	CasPol.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

CasPol.exe

pid process

2640 CasPol.exe
2640 CasPol.exe

pid	process
2640	CasPol.exe
2640	CasPol.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

d325d9ecd5d7b1e7871de63f0807aa53457f82985845a9a6a4e45c0102a9fa69.exeCasPol.exe

description	pid	process
Token: SeDebugPrivilege	5084	d325d9ecd5d7b1e7871de63f0807aa53457f82985845a9a6a4e45c0102a9fa69.exe
Token: SeDebugPrivilege	2640	CasPol.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

d325d9ecd5d7b1e7871de63f0807aa53457f82985845a9a6a4e45c0102a9fa69.exe

description	pid	process	target process
PID 5084 wrote to memory of 2640	5084	d325d9ecd5d7b1e7871de63f0807aa53457f82985845a9a6a4e45c0102a9fa69.exe	CasPol.exe
PID 5084 wrote to memory of 2640	5084	d325d9ecd5d7b1e7871de63f0807aa53457f82985845a9a6a4e45c0102a9fa69.exe	CasPol.exe
PID 5084 wrote to memory of 2640	5084	d325d9ecd5d7b1e7871de63f0807aa53457f82985845a9a6a4e45c0102a9fa69.exe	CasPol.exe
PID 5084 wrote to memory of 2640	5084	d325d9ecd5d7b1e7871de63f0807aa53457f82985845a9a6a4e45c0102a9fa69.exe	CasPol.exe
PID 5084 wrote to memory of 2640	5084	d325d9ecd5d7b1e7871de63f0807aa53457f82985845a9a6a4e45c0102a9fa69.exe	CasPol.exe
PID 5084 wrote to memory of 2640	5084	d325d9ecd5d7b1e7871de63f0807aa53457f82985845a9a6a4e45c0102a9fa69.exe	CasPol.exe
PID 5084 wrote to memory of 2640	5084	d325d9ecd5d7b1e7871de63f0807aa53457f82985845a9a6a4e45c0102a9fa69.exe	CasPol.exe
PID 5084 wrote to memory of 2640	5084	d325d9ecd5d7b1e7871de63f0807aa53457f82985845a9a6a4e45c0102a9fa69.exe	CasPol.exe

memory/2640-135-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2640-136-0x0000000000437C6E-mapping.dmp

Download
memory/2640-138-0x0000000006010000-0x00000000065B4000-memory.dmp

Filesize
5.6MB

Download
memory/2640-139-0x0000000005B90000-0x0000000005C2C000-memory.dmp

Filesize
624KB

Download
memory/2640-140-0x0000000005FA0000-0x0000000006006000-memory.dmp

Filesize
408KB

Download
memory/5084-132-0x00000237716A0000-0x0000023771720000-memory.dmp

Filesize
512KB

Download
memory/5084-133-0x00007FFD83520000-0x00007FFD83FE1000-memory.dmp

Filesize
10.8MB

Download
memory/5084-134-0x00007FFD83520000-0x00007FFD83FE1000-memory.dmp

Filesize
10.8MB

Download
memory/5084-137-0x00007FFD83520000-0x00007FFD83FE1000-memory.dmp

Filesize
10.8MB

Download