agenttesla | 2b039083a9e548e1c460253147e6e5e63cb99a65b0013e590a1ee473ec4206b7

General

Target

2b039083a9e548e1c460253147e6e5e63cb99a65b0013e590a1ee473ec4206b7.exe
Size

236KB
MD5

8c7bc7e61faceb3faf8afea62e41fd9d
SHA1

fc7450a56ac5275bd2d33cc1e238f636d72f79d6
SHA256

2b039083a9e548e1c460253147e6e5e63cb99a65b0013e590a1ee473ec4206b7
SHA512

a724bde23cf4964f8b4a47addacfbf764d1eaba7b3ce00c708d3617794d5a25e295b4f8dbda0053a234cdddd59c2d32b834774dc4bde64e260c56f4be68191a9
SSDEEP

6144:KlhbRfzK+zLRkk88/ATEMYMF5NdAS0t0:MFe2/+RYSj2

Score

10^/10

Family

agenttesla

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla payload 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1168-62-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1168-63-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1168-64-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1168-65-0x00000000004374CE-mapping.dmp	family_agenttesla
behavioral1/memory/1168-67-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1168-69-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

Processes:

2b039083a9e548e1c460253147e6e5e63cb99a65b0013e590a1ee473ec4206b7.exe

description	pid	process	target process
PID 1884 set thread context of 1168	1884	2b039083a9e548e1c460253147e6e5e63cb99a65b0013e590a1ee473ec4206b7.exe	RegAsm.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

RegAsm.exe

pid process

1168 RegAsm.exe
1168 RegAsm.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RegAsm.exe

description pid process

Token: SeDebugPrivilege 1168 RegAsm.exe

pid	process
1168	RegAsm.exe
1168	RegAsm.exe

description	pid	process
Token: SeDebugPrivilege	1168	RegAsm.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

2b039083a9e548e1c460253147e6e5e63cb99a65b0013e590a1ee473ec4206b7.exe

description	pid	process	target process
PID 1884 wrote to memory of 1168	1884	2b039083a9e548e1c460253147e6e5e63cb99a65b0013e590a1ee473ec4206b7.exe	RegAsm.exe
PID 1884 wrote to memory of 1168	1884	2b039083a9e548e1c460253147e6e5e63cb99a65b0013e590a1ee473ec4206b7.exe	RegAsm.exe
PID 1884 wrote to memory of 1168	1884	2b039083a9e548e1c460253147e6e5e63cb99a65b0013e590a1ee473ec4206b7.exe	RegAsm.exe
PID 1884 wrote to memory of 1168	1884	2b039083a9e548e1c460253147e6e5e63cb99a65b0013e590a1ee473ec4206b7.exe	RegAsm.exe
PID 1884 wrote to memory of 1168	1884	2b039083a9e548e1c460253147e6e5e63cb99a65b0013e590a1ee473ec4206b7.exe	RegAsm.exe
PID 1884 wrote to memory of 1168	1884	2b039083a9e548e1c460253147e6e5e63cb99a65b0013e590a1ee473ec4206b7.exe	RegAsm.exe
PID 1884 wrote to memory of 1168	1884	2b039083a9e548e1c460253147e6e5e63cb99a65b0013e590a1ee473ec4206b7.exe	RegAsm.exe
PID 1884 wrote to memory of 1168	1884	2b039083a9e548e1c460253147e6e5e63cb99a65b0013e590a1ee473ec4206b7.exe	RegAsm.exe
PID 1884 wrote to memory of 1168	1884	2b039083a9e548e1c460253147e6e5e63cb99a65b0013e590a1ee473ec4206b7.exe	RegAsm.exe
PID 1884 wrote to memory of 1168	1884	2b039083a9e548e1c460253147e6e5e63cb99a65b0013e590a1ee473ec4206b7.exe	RegAsm.exe
PID 1884 wrote to memory of 1168	1884	2b039083a9e548e1c460253147e6e5e63cb99a65b0013e590a1ee473ec4206b7.exe	RegAsm.exe
PID 1884 wrote to memory of 1168	1884	2b039083a9e548e1c460253147e6e5e63cb99a65b0013e590a1ee473ec4206b7.exe	RegAsm.exe

memory/1168-64-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1168-63-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1168-70-0x0000000075E31000-0x0000000075E33000-memory.dmp

Filesize
8KB

Download
memory/1168-69-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1168-67-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1168-59-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1168-62-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1168-60-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1168-65-0x00000000004374CE-mapping.dmp

Download
memory/1884-54-0x00000000009A0000-0x00000000009DC000-memory.dmp

Filesize
240KB

Download
memory/1884-55-0x00000000003A0000-0x00000000003A8000-memory.dmp

Filesize
32KB

Download
memory/1884-58-0x0000000000430000-0x0000000000438000-memory.dmp

Filesize
32KB

Download
memory/1884-57-0x0000000000410000-0x000000000041C000-memory.dmp

Filesize
48KB

Download
memory/1884-56-0x00000000003F0000-0x00000000003F6000-memory.dmp

Filesize
24KB

Download