agenttesla | 1df092429106169d98c1c3bd918900295a2e9558d875cea936f4d3b9f69760de

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 22:23

Target

157129b0c7406fabd854ad47ec9f9dcb.exe
Size

321KB
MD5

157129b0c7406fabd854ad47ec9f9dcb
SHA1

78e2ad3d031c0578c4fa79193a2fc1fc37f05d84
SHA256

1df092429106169d98c1c3bd918900295a2e9558d875cea936f4d3b9f69760de
SHA512

6e8be79650ccfbcf42ba87ae38cd40e2fa118a65f7031e537aca9964d0ff0779959f1aa6dc0c3e2f6a8364086703cc1f45dcefe4fcf44dc2926fdf78fbc4d88c
SSDEEP

6144:4vetkcunIg36lBrAJ4zw4MN6BT/rGVL62IxobVV2gpr3:4veC3I2WpAazHzTg7bmU

Score

10^/10

Family

agenttesla

https://api.telegram.org/bot1850887036:AAH6KBVsKQqY803XMNw1ISD7pOs58OpZSho/sendDocument

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla payload 3 IoCs

resource	yara_rule
behavioral1/memory/2320-3-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/2320-5-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/2320-7-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2152 set thread context of 2320	2152	157129b0c7406fabd854ad47ec9f9dcb.exe	28

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2320	MSBuild.exe
2320	MSBuild.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2152	157129b0c7406fabd854ad47ec9f9dcb.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2320	MSBuild.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2152 wrote to memory of 2320	2152	157129b0c7406fabd854ad47ec9f9dcb.exe	28
PID 2152 wrote to memory of 2320	2152	157129b0c7406fabd854ad47ec9f9dcb.exe	28
PID 2152 wrote to memory of 2320	2152	157129b0c7406fabd854ad47ec9f9dcb.exe	28
PID 2152 wrote to memory of 2320	2152	157129b0c7406fabd854ad47ec9f9dcb.exe	28
PID 2152 wrote to memory of 2320	2152	157129b0c7406fabd854ad47ec9f9dcb.exe	28
PID 2320 wrote to memory of 2692	2320	MSBuild.exe	29
PID 2320 wrote to memory of 2692	2320	MSBuild.exe	29
PID 2320 wrote to memory of 2692	2320	MSBuild.exe	29
PID 2320 wrote to memory of 2692	2320	MSBuild.exe	29

memory/2152-1-0x0000000000260000-0x0000000000360000-memory.dmp

Filesize
1024KB

Download
memory/2152-2-0x0000000000080000-0x0000000000082000-memory.dmp

Filesize
8KB

Download
memory/2320-3-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2320-5-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2320-7-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2320-8-0x00000000747F0000-0x0000000074D9B000-memory.dmp

Filesize
5.7MB

Download
memory/2320-9-0x00000000747F0000-0x0000000074D9B000-memory.dmp

Filesize
5.7MB

Download
memory/2320-10-0x0000000000320000-0x0000000000360000-memory.dmp

Filesize
256KB

Download
memory/2320-12-0x00000000747F0000-0x0000000074D9B000-memory.dmp

Filesize
5.7MB

Download
memory/2320-13-0x0000000000320000-0x0000000000360000-memory.dmp

Filesize
256KB

Download
memory/2692-11-0x0000000002700000-0x0000000002701000-memory.dmp

Filesize
4KB

Download