agenttesla | 877dcc901ba5abacac399a8f33ccaffa321eb4306a3a10f16fa9a2d183374cd7

Analysis

max time kernel
30s
max time network
32s
platform
windows7_x64
resource
win7-20230621-en
resource tags

arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system
submitted
29-06-2023 06:56

Target

file.exe
Size

463KB
MD5

1a2cfd318c11427f0ce1b0cfac83480f
SHA1

4bdcf9570cb252ee93e8da3888a70d7825e65a1b
SHA256

877dcc901ba5abacac399a8f33ccaffa321eb4306a3a10f16fa9a2d183374cd7
SHA512

538156ee42e32fee0d0bdaf5d6e1587ff9422036d7503237498d2f613218d4ddaec3733afa0e9d224c4fb1d50032ff12c806fc72343695a74267e659b464981e
SSDEEP

12288:uIFAplx5LmAFNaxAqm/OMqgcG2IWIvvwZUN9XPc8l51VGWAxX3dkcWCiFoG5:OtfNaxAqm/OMqgcG2IWIvvwZUvPc8vec

Score

10^/10

Family

agenttesla

https://api.telegram.org/bot6186587654:AAGCfYz_-Ywr0jS403I82r-XCvl_CsLT1L0/

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1300 set thread context of 1940	1300	file.exe	29

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1816	1940	WerFault.exe	29

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1300	file.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1300	file.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 1300 wrote to memory of 1376	1300	file.exe	28
PID 1300 wrote to memory of 1376	1300	file.exe	28
PID 1300 wrote to memory of 1376	1300	file.exe	28
PID 1300 wrote to memory of 1940	1300	file.exe	29
PID 1300 wrote to memory of 1940	1300	file.exe	29
PID 1300 wrote to memory of 1940	1300	file.exe	29
PID 1300 wrote to memory of 1940	1300	file.exe	29
PID 1300 wrote to memory of 1940	1300	file.exe	29
PID 1300 wrote to memory of 1940	1300	file.exe	29
PID 1300 wrote to memory of 1940	1300	file.exe	29
PID 1300 wrote to memory of 1940	1300	file.exe	29
PID 1300 wrote to memory of 1940	1300	file.exe	29
PID 1300 wrote to memory of 1940	1300	file.exe	29
PID 1300 wrote to memory of 1940	1300	file.exe	29
PID 1300 wrote to memory of 1940	1300	file.exe	29
PID 1940 wrote to memory of 1816	1940	SetupUtility.exe	30
PID 1940 wrote to memory of 1816	1940	SetupUtility.exe	30
PID 1940 wrote to memory of 1816	1940	SetupUtility.exe	30
PID 1940 wrote to memory of 1816	1940	SetupUtility.exe	30

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1300
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe"
  2⤵
  PID:1376
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\SetupUtility.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\SetupUtility.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1940
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1940 -s 168
    3⤵
    - Program crash
    PID:1816

memory/1300-54-0x0000000001290000-0x0000000001308000-memory.dmp

Filesize
480KB

Download
memory/1300-55-0x0000000001210000-0x0000000001290000-memory.dmp

Filesize
512KB

Download
memory/1940-56-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download