agenttesla | 63f6d9e02b303e2062153d062ebc15c5ea7e05e36e5b92e48f60730c782fc9bb

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
04-12-2023 16:56

Target

tmpx3vyntn0.exe
Size

266KB
MD5

992892eea003d621f694547d2284e39f
SHA1

7bf5627a0c7ec6d62578c9a95862c2ec4c3cabb6
SHA256

63f6d9e02b303e2062153d062ebc15c5ea7e05e36e5b92e48f60730c782fc9bb
SHA512

3e8237eb59fea1cd601cf5ca9d5b2fe7cb2cd7474e534f1315a0354f2d64300cb6b03944e80fe73fff60168dbe64cb82eec2ad0067b7a1346c4a0032dec5f8fa
SSDEEP

6144:mnSDik95vQ2vov1+QNRFH0Wm0jydwJxSHiiyV+9gffIxmk5:Dik95vNvov1+QLJ0Wm0LSJyqg3Ixm

Score

10^/10

Family

agenttesla

https://api.telegram.org/bot6609066655:AAFvSlYuljpA1ReJkQXiHiJh0XH1Axk0H-A/

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Suspicious use of SetThreadContext 1 IoCs

Processes:

tmpx3vyntn0.exe

description pid process target process

PID 2512 set thread context of 2672 2512 tmpx3vyntn0.exe tmpx3vyntn0.exe

description	pid	process	target process
PID 2512 set thread context of 2672	2512	tmpx3vyntn0.exe	tmpx3vyntn0.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

tmpx3vyntn0.exe

description	pid	process	target process
PID 2512 wrote to memory of 2672	2512	tmpx3vyntn0.exe	tmpx3vyntn0.exe
PID 2512 wrote to memory of 2672	2512	tmpx3vyntn0.exe	tmpx3vyntn0.exe
PID 2512 wrote to memory of 2672	2512	tmpx3vyntn0.exe	tmpx3vyntn0.exe
PID 2512 wrote to memory of 2672	2512	tmpx3vyntn0.exe	tmpx3vyntn0.exe
PID 2512 wrote to memory of 2672	2512	tmpx3vyntn0.exe	tmpx3vyntn0.exe
PID 2512 wrote to memory of 2672	2512	tmpx3vyntn0.exe	tmpx3vyntn0.exe
PID 2512 wrote to memory of 2672	2512	tmpx3vyntn0.exe	tmpx3vyntn0.exe
PID 2512 wrote to memory of 2672	2512	tmpx3vyntn0.exe	tmpx3vyntn0.exe
PID 2512 wrote to memory of 2672	2512	tmpx3vyntn0.exe	tmpx3vyntn0.exe

C:\Users\Admin\AppData\Local\Temp\tmpx3vyntn0.exe
"C:\Users\Admin\AppData\Local\Temp\tmpx3vyntn0.exe"
2⤵
PID:2672

memory/2512-0-0x00000000003C0000-0x0000000000408000-memory.dmp

Filesize
288KB

Download
memory/2512-1-0x0000000073EB0000-0x000000007459E000-memory.dmp

Filesize
6.9MB

Download
memory/2512-2-0x0000000000760000-0x00000000007A0000-memory.dmp

Filesize
256KB

Download
memory/2512-4-0x00000000004B0000-0x00000000004B1000-memory.dmp

Filesize
4KB

Download
memory/2512-14-0x0000000073EB0000-0x000000007459E000-memory.dmp

Filesize
6.9MB

Download
memory/2672-3-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2672-6-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2672-8-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2672-9-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2672-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2672-12-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2672-15-0x00000000003C0000-0x00000000003C0000-memory.dmp

Download