agenttesla | 26c6d24ee5848f492e88c10c0bb9d7a03b18ddba15646112511be69523d0a19f

Analysis

max time kernel
140s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231127-en
resource tags

arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system
submitted
07-12-2023 19:24

Target

26c6d24ee5848f492e88c10c0bb9d7a03b18ddba15646112511be69523d0a19fexe.exe
Size

649KB
MD5

31c508e7ee5ba7d370208aa235fd9ad8
SHA1

51cabb342d313b86c4a2d8e6e86857af63b26334
SHA256

26c6d24ee5848f492e88c10c0bb9d7a03b18ddba15646112511be69523d0a19f
SHA512

dfdc3ddb27eb91b3838341f586a6d59eaebe5fcf0794a5272999984dbee226392f6b9632e501b550ae736bef91f766f46230ea9ce6876cc753ed8b6c96e8bc4f
SSDEEP

12288:R11QaueH5q+q1JHBl4LWLpBSNKsnoKP5EnxWzyghHX+PHVmF3E8URQN:R1zq3rwQgNZnofWzycHAmF0Y

Score

10^/10

Credentials

Family

agenttesla

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2128 set thread context of 2616	2128	26c6d24ee5848f492e88c10c0bb9d7a03b18ddba15646112511be69523d0a19fexe.exe	103

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2128 wrote to memory of 2616	2128	26c6d24ee5848f492e88c10c0bb9d7a03b18ddba15646112511be69523d0a19fexe.exe	103
PID 2128 wrote to memory of 2616	2128	26c6d24ee5848f492e88c10c0bb9d7a03b18ddba15646112511be69523d0a19fexe.exe	103
PID 2128 wrote to memory of 2616	2128	26c6d24ee5848f492e88c10c0bb9d7a03b18ddba15646112511be69523d0a19fexe.exe	103
PID 2128 wrote to memory of 2616	2128	26c6d24ee5848f492e88c10c0bb9d7a03b18ddba15646112511be69523d0a19fexe.exe	103
PID 2128 wrote to memory of 2616	2128	26c6d24ee5848f492e88c10c0bb9d7a03b18ddba15646112511be69523d0a19fexe.exe	103
PID 2128 wrote to memory of 2616	2128	26c6d24ee5848f492e88c10c0bb9d7a03b18ddba15646112511be69523d0a19fexe.exe	103
PID 2128 wrote to memory of 2616	2128	26c6d24ee5848f492e88c10c0bb9d7a03b18ddba15646112511be69523d0a19fexe.exe	103
PID 2128 wrote to memory of 2616	2128	26c6d24ee5848f492e88c10c0bb9d7a03b18ddba15646112511be69523d0a19fexe.exe	103

C:\Users\Admin\AppData\Local\Temp\26c6d24ee5848f492e88c10c0bb9d7a03b18ddba15646112511be69523d0a19fexe.exe
"C:\Users\Admin\AppData\Local\Temp\26c6d24ee5848f492e88c10c0bb9d7a03b18ddba15646112511be69523d0a19fexe.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2128
- C:\Users\Admin\AppData\Local\Temp\26c6d24ee5848f492e88c10c0bb9d7a03b18ddba15646112511be69523d0a19fexe.exe
  "C:\Users\Admin\AppData\Local\Temp\26c6d24ee5848f492e88c10c0bb9d7a03b18ddba15646112511be69523d0a19fexe.exe"
  2⤵
  PID:2616

memory/2128-6-0x00000000052F0000-0x000000000530A000-memory.dmp

Filesize
104KB

Download
memory/2128-0-0x0000000075310000-0x0000000075AC0000-memory.dmp

Filesize
7.7MB

Download
memory/2128-2-0x00000000057C0000-0x0000000005D64000-memory.dmp

Filesize
5.6MB

Download
memory/2128-3-0x0000000005160000-0x00000000051F2000-memory.dmp

Filesize
584KB

Download
memory/2128-4-0x0000000005310000-0x0000000005320000-memory.dmp

Filesize
64KB

Download
memory/2128-5-0x0000000005230000-0x000000000523A000-memory.dmp

Filesize
40KB

Download
memory/2128-1-0x00000000006F0000-0x0000000000798000-memory.dmp

Filesize
672KB

Download
memory/2128-7-0x0000000005790000-0x0000000005798000-memory.dmp

Filesize
32KB

Download
memory/2128-8-0x00000000057A0000-0x00000000057AA000-memory.dmp

Filesize
40KB

Download
memory/2128-9-0x00000000067A0000-0x000000000681E000-memory.dmp

Filesize
504KB

Download
memory/2128-10-0x0000000008DE0000-0x0000000008E7C000-memory.dmp

Filesize
624KB

Download
memory/2128-13-0x0000000075310000-0x0000000075AC0000-memory.dmp

Filesize
7.7MB

Download
memory/2616-11-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download