agenttesla | b7964a89e6a2241d174412de89aefa5cea84f723413cdfe5b2ad6aec40e7a54d

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 22:10

Target

0540fa5ba6c78d6001e586d360588bfd.exe
Size

474KB
MD5

0540fa5ba6c78d6001e586d360588bfd
SHA1

72a1d34b9eb3721b758bd9ea619877a061bd3783
SHA256

b7964a89e6a2241d174412de89aefa5cea84f723413cdfe5b2ad6aec40e7a54d
SHA512

38aee223015a55a5fe99af3dce002befffd78faed0bc1a3d35135e7675f7f0b2b850d09f4fbe29308a475c9858be45052cb07ca7381303159904cbd3ed5e9642
SSDEEP

12288:dfo25r7EhN5s6XgsMkllOCBJhs0tGwYLnbWtV/aEw2qR5jAuORm:dfo25r7EhN5s6X/xE0inOV/n585E/4

Score

10^/10

Family

agenttesla

https://api.telegram.org/bot1734005980:AAERmgFyWDBh9hMP57ANBsWcWNSrihi2F_A/sendDocument

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla payload 4 IoCs

resource	yara_rule
behavioral1/memory/1992-3-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1992-5-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1992-7-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1992-9-0x0000000002190000-0x00000000021D0000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2396 set thread context of 1992	2396	0540fa5ba6c78d6001e586d360588bfd.exe	28

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1992	MSBuild.exe
1992	MSBuild.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2396	0540fa5ba6c78d6001e586d360588bfd.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1992	MSBuild.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2396 wrote to memory of 1992	2396	0540fa5ba6c78d6001e586d360588bfd.exe	28
PID 2396 wrote to memory of 1992	2396	0540fa5ba6c78d6001e586d360588bfd.exe	28
PID 2396 wrote to memory of 1992	2396	0540fa5ba6c78d6001e586d360588bfd.exe	28
PID 2396 wrote to memory of 1992	2396	0540fa5ba6c78d6001e586d360588bfd.exe	28
PID 2396 wrote to memory of 1992	2396	0540fa5ba6c78d6001e586d360588bfd.exe	28
PID 1992 wrote to memory of 2536	1992	MSBuild.exe	29
PID 1992 wrote to memory of 2536	1992	MSBuild.exe	29
PID 1992 wrote to memory of 2536	1992	MSBuild.exe	29
PID 1992 wrote to memory of 2536	1992	MSBuild.exe	29

memory/1992-3-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1992-5-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1992-7-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1992-8-0x00000000748F0000-0x0000000074E9B000-memory.dmp

Filesize
5.7MB

Download
memory/1992-9-0x0000000002190000-0x00000000021D0000-memory.dmp

Filesize
256KB

Download
memory/1992-10-0x00000000748F0000-0x0000000074E9B000-memory.dmp

Filesize
5.7MB

Download
memory/1992-13-0x0000000002190000-0x00000000021D0000-memory.dmp

Filesize
256KB

Download
memory/1992-12-0x00000000748F0000-0x0000000074E9B000-memory.dmp

Filesize
5.7MB

Download
memory/2396-1-0x00000000002F0000-0x00000000003F0000-memory.dmp

Filesize
1024KB

Download
memory/2396-2-0x0000000000130000-0x0000000000132000-memory.dmp

Filesize
8KB

Download
memory/2536-11-0x0000000000330000-0x0000000000331000-memory.dmp

Filesize
4KB

Download