agenttesla | 21c2a89d7532be43315dd9fcd99c2df41a756deab3197df2adcc6e82f46c074f

Analysis

max time kernel
141s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231127-en
resource tags

arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system
submitted
13-12-2023 01:40

Target

21c2a89d7532be43315dd9fcd99c2df41a756deab3197df2adcc6e82f46c074f.exe
Size

51KB
MD5

7620ca719f502b7ca1d57d3c8a6992c7
SHA1

0548b3aa9ac9fc1781797e6717fa2b8d64309b0e
SHA256

21c2a89d7532be43315dd9fcd99c2df41a756deab3197df2adcc6e82f46c074f
SHA512

e855fa6c133191d0fc9e12fe146160e4d600fb9adb5ae498b70077695a46432856fe5ded034058957c711c507ace1ae07245075b86b006692073e42824e867f5
SSDEEP

768:88vmj2dB9pR016DBvV1I/Ptw9wyjeBw2MuDGEPAMxkE9s:88zB9pC16V91I9ryjeuj2xps

Score

10^/10

Family

agenttesla

https://api.telegram.org/bot6548288330:AAGA-b1ojgiCCinc5YQor8R1kxgez4hPFpM/

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Suspicious use of SetThreadContext 1 IoCs

Processes:

21c2a89d7532be43315dd9fcd99c2df41a756deab3197df2adcc6e82f46c074f.exe

description	pid	process	target process
PID 812 set thread context of 216	812	21c2a89d7532be43315dd9fcd99c2df41a756deab3197df2adcc6e82f46c074f.exe	aspnet_compiler.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2924 216 WerFault.exe aspnet_compiler.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

aspnet_compiler.exe

pid process

216 aspnet_compiler.exe
216 aspnet_compiler.exe

pid	pid_target	process	target process
2924	216	WerFault.exe	aspnet_compiler.exe

pid	process
216	aspnet_compiler.exe
216	aspnet_compiler.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

21c2a89d7532be43315dd9fcd99c2df41a756deab3197df2adcc6e82f46c074f.exeaspnet_compiler.exe

description	pid	process
Token: SeDebugPrivilege	812	21c2a89d7532be43315dd9fcd99c2df41a756deab3197df2adcc6e82f46c074f.exe
Token: SeDebugPrivilege	216	aspnet_compiler.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

21c2a89d7532be43315dd9fcd99c2df41a756deab3197df2adcc6e82f46c074f.exe

description	pid	process	target process
PID 812 wrote to memory of 216	812	21c2a89d7532be43315dd9fcd99c2df41a756deab3197df2adcc6e82f46c074f.exe	aspnet_compiler.exe
PID 812 wrote to memory of 216	812	21c2a89d7532be43315dd9fcd99c2df41a756deab3197df2adcc6e82f46c074f.exe	aspnet_compiler.exe
PID 812 wrote to memory of 216	812	21c2a89d7532be43315dd9fcd99c2df41a756deab3197df2adcc6e82f46c074f.exe	aspnet_compiler.exe
PID 812 wrote to memory of 216	812	21c2a89d7532be43315dd9fcd99c2df41a756deab3197df2adcc6e82f46c074f.exe	aspnet_compiler.exe
PID 812 wrote to memory of 216	812	21c2a89d7532be43315dd9fcd99c2df41a756deab3197df2adcc6e82f46c074f.exe	aspnet_compiler.exe
PID 812 wrote to memory of 216	812	21c2a89d7532be43315dd9fcd99c2df41a756deab3197df2adcc6e82f46c074f.exe	aspnet_compiler.exe
PID 812 wrote to memory of 216	812	21c2a89d7532be43315dd9fcd99c2df41a756deab3197df2adcc6e82f46c074f.exe	aspnet_compiler.exe
PID 812 wrote to memory of 216	812	21c2a89d7532be43315dd9fcd99c2df41a756deab3197df2adcc6e82f46c074f.exe	aspnet_compiler.exe

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 216 -s 1416
3⤵
- Program crash
PID:2924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 216 -ip 216
1⤵
PID:5064

memory/216-4-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/216-6-0x0000000075020000-0x00000000757D0000-memory.dmp

Filesize
7.7MB

Download
memory/216-8-0x00000000053F0000-0x0000000005994000-memory.dmp

Filesize
5.6MB

Download
memory/216-9-0x0000000004E20000-0x0000000004E30000-memory.dmp

Filesize
64KB

Download
memory/216-10-0x0000000004EB0000-0x0000000004F16000-memory.dmp

Filesize
408KB

Download
memory/216-11-0x0000000075020000-0x00000000757D0000-memory.dmp

Filesize
7.7MB

Download
memory/812-0-0x00000000005B0000-0x00000000005BE000-memory.dmp

Filesize
56KB

Download
memory/812-1-0x0000000075020000-0x00000000757D0000-memory.dmp

Filesize
7.7MB

Download
memory/812-2-0x0000000007500000-0x0000000007510000-memory.dmp

Filesize
64KB

Download
memory/812-3-0x0000000002AF0000-0x0000000002AFA000-memory.dmp

Filesize
40KB

Download
memory/812-7-0x0000000075020000-0x00000000757D0000-memory.dmp

Filesize
7.7MB

Download