agenttesla | a76005636f6f5096c0aecf68fe0c83d56ef42c0e922c2afe453e70f976738a8a

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
04-12-2023 17:00

Target

a76005636f6f5096c0aecf68fe0c83d56ef42c0e922c2afe453e70f976738a8a.exe
Size

3.3MB
MD5

8d3407cb7c82a85b0dc31dcde6dc3298
SHA1

3f8a08a505235e8b04231d77b2af908e295b5b40
SHA256

a76005636f6f5096c0aecf68fe0c83d56ef42c0e922c2afe453e70f976738a8a
SHA512

9a318e7da37f1ec4efd45ceb070bbfcbc92146109443ff9d83a63115da31e82554f73f9ff11c5dcdb2343e87bdb31f167c77dfdd9e52ecd24e14404da24fd1a7
SSDEEP

49152:HzWb0gLtLvX0SEoPbTsy1inPboImC9Chm5CsBrLbJBOniCqdo3ye:Hzi0gLtL/0TojxYDo9CN5CsIm

Score

10^/10

Family

agenttesla

https://api.telegram.org/bot5168654140:AAE_I-CRa2apQXXWxhBTEaeIEr1Ln5pw69s/

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Suspicious use of SetThreadContext 1 IoCs

Processes:

a76005636f6f5096c0aecf68fe0c83d56ef42c0e922c2afe453e70f976738a8a.exe

description	pid	process	target process
PID 2876 set thread context of 2740	2876	a76005636f6f5096c0aecf68fe0c83d56ef42c0e922c2afe453e70f976738a8a.exe	CasPol.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

CasPol.exe

pid process

2740 CasPol.exe
2740 CasPol.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

CasPol.exe

description pid process

Token: SeDebugPrivilege 2740 CasPol.exe

pid	process
2740	CasPol.exe
2740	CasPol.exe

description	pid	process
Token: SeDebugPrivilege	2740	CasPol.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

a76005636f6f5096c0aecf68fe0c83d56ef42c0e922c2afe453e70f976738a8a.exe

description	pid	process	target process
PID 2876 wrote to memory of 2740	2876	a76005636f6f5096c0aecf68fe0c83d56ef42c0e922c2afe453e70f976738a8a.exe	CasPol.exe
PID 2876 wrote to memory of 2740	2876	a76005636f6f5096c0aecf68fe0c83d56ef42c0e922c2afe453e70f976738a8a.exe	CasPol.exe
PID 2876 wrote to memory of 2740	2876	a76005636f6f5096c0aecf68fe0c83d56ef42c0e922c2afe453e70f976738a8a.exe	CasPol.exe
PID 2876 wrote to memory of 2740	2876	a76005636f6f5096c0aecf68fe0c83d56ef42c0e922c2afe453e70f976738a8a.exe	CasPol.exe
PID 2876 wrote to memory of 2740	2876	a76005636f6f5096c0aecf68fe0c83d56ef42c0e922c2afe453e70f976738a8a.exe	CasPol.exe
PID 2876 wrote to memory of 2740	2876	a76005636f6f5096c0aecf68fe0c83d56ef42c0e922c2afe453e70f976738a8a.exe	CasPol.exe
PID 2876 wrote to memory of 2740	2876	a76005636f6f5096c0aecf68fe0c83d56ef42c0e922c2afe453e70f976738a8a.exe	CasPol.exe
PID 2876 wrote to memory of 2740	2876	a76005636f6f5096c0aecf68fe0c83d56ef42c0e922c2afe453e70f976738a8a.exe	CasPol.exe
PID 2876 wrote to memory of 2740	2876	a76005636f6f5096c0aecf68fe0c83d56ef42c0e922c2afe453e70f976738a8a.exe	CasPol.exe

memory/2740-7-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2740-17-0x0000000004C00000-0x0000000004C40000-memory.dmp

Filesize
256KB

Download
memory/2740-16-0x0000000074150000-0x000000007483E000-memory.dmp

Filesize
6.9MB

Download
memory/2740-15-0x0000000004C00000-0x0000000004C40000-memory.dmp

Filesize
256KB

Download
memory/2740-14-0x0000000074150000-0x000000007483E000-memory.dmp

Filesize
6.9MB

Download
memory/2740-13-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2740-11-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2876-4-0x0000000000270000-0x00000000002B0000-memory.dmp

Filesize
256KB

Download
memory/2876-9-0x00000000741D0000-0x00000000748BE000-memory.dmp

Filesize
6.9MB

Download
memory/2876-10-0x0000000000270000-0x00000000002B0000-memory.dmp

Filesize
256KB

Download
memory/2876-6-0x0000000000C50000-0x0000000000C6A000-memory.dmp

Filesize
104KB

Download
memory/2876-5-0x0000000005F70000-0x000000000627C000-memory.dmp

Filesize
3.0MB

Download
memory/2876-0-0x0000000000CC0000-0x000000000101A000-memory.dmp

Filesize
3.4MB

Download
memory/2876-3-0x0000000000270000-0x00000000002B0000-memory.dmp

Filesize
256KB

Download
memory/2876-2-0x0000000000270000-0x00000000002B0000-memory.dmp

Filesize
256KB

Download
memory/2876-1-0x00000000741D0000-0x00000000748BE000-memory.dmp

Filesize
6.9MB

Download