agenttesla | 5272b3b2d315dc3995cb0b4855874ddbcf596f793f1c1799ddc3a0d6e066bf56

Analysis

max time kernel
164s
max time network
178s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
11/01/2024, 01:30

Target

5272b3b2d315dc3995cb0b4855874ddbcf596f793f1c1799ddc3a0d6e066bf56.exe
Size

970KB
MD5

7b3e0bda717f1b51c2ecca91afb1e1af
SHA1

eb12fc514cddd536d17838fc34b071dcc5d85d9f
SHA256

5272b3b2d315dc3995cb0b4855874ddbcf596f793f1c1799ddc3a0d6e066bf56
SHA512

b4bf6bccb2b8aa76284582f0f15ae216c8c1ab96b23575cd67ba8d7d3ed421a2456f9457cec299f947136a93f893b1844546fc0291d088ea6da41a7234128f06
SSDEEP

24576:gOONF/sGMa1cHYOh7Xs5CAHsRYheFDnasCu90qtg/:DeUGMiczh7OtH2YgFDnlPK

Score

10^/10

Family

agenttesla

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3256 set thread context of 4552	3256	5272b3b2d315dc3995cb0b4855874ddbcf596f793f1c1799ddc3a0d6e066bf56.exe	106

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3256 wrote to memory of 4552	3256	5272b3b2d315dc3995cb0b4855874ddbcf596f793f1c1799ddc3a0d6e066bf56.exe	106
PID 3256 wrote to memory of 4552	3256	5272b3b2d315dc3995cb0b4855874ddbcf596f793f1c1799ddc3a0d6e066bf56.exe	106
PID 3256 wrote to memory of 4552	3256	5272b3b2d315dc3995cb0b4855874ddbcf596f793f1c1799ddc3a0d6e066bf56.exe	106
PID 3256 wrote to memory of 4552	3256	5272b3b2d315dc3995cb0b4855874ddbcf596f793f1c1799ddc3a0d6e066bf56.exe	106
PID 3256 wrote to memory of 4552	3256	5272b3b2d315dc3995cb0b4855874ddbcf596f793f1c1799ddc3a0d6e066bf56.exe	106
PID 3256 wrote to memory of 4552	3256	5272b3b2d315dc3995cb0b4855874ddbcf596f793f1c1799ddc3a0d6e066bf56.exe	106
PID 3256 wrote to memory of 4552	3256	5272b3b2d315dc3995cb0b4855874ddbcf596f793f1c1799ddc3a0d6e066bf56.exe	106
PID 3256 wrote to memory of 4552	3256	5272b3b2d315dc3995cb0b4855874ddbcf596f793f1c1799ddc3a0d6e066bf56.exe	106

C:\Users\Admin\AppData\Local\Temp\5272b3b2d315dc3995cb0b4855874ddbcf596f793f1c1799ddc3a0d6e066bf56.exe
"C:\Users\Admin\AppData\Local\Temp\5272b3b2d315dc3995cb0b4855874ddbcf596f793f1c1799ddc3a0d6e066bf56.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3256
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
  2⤵
  PID:4552

memory/3256-6-0x0000000005A10000-0x0000000005A2A000-memory.dmp

Filesize
104KB

Download
memory/3256-13-0x0000000074D60000-0x0000000075510000-memory.dmp

Filesize
7.7MB

Download
memory/3256-2-0x0000000074D60000-0x0000000075510000-memory.dmp

Filesize
7.7MB

Download
memory/3256-3-0x00000000033D0000-0x00000000033E0000-memory.dmp

Filesize
64KB

Download
memory/3256-4-0x00000000033D0000-0x00000000033E0000-memory.dmp

Filesize
64KB

Download
memory/3256-5-0x0000000003420000-0x0000000003428000-memory.dmp

Filesize
32KB

Download
memory/3256-8-0x0000000005B70000-0x0000000005C22000-memory.dmp

Filesize
712KB

Download
memory/3256-0-0x0000000074D60000-0x0000000075510000-memory.dmp

Filesize
7.7MB

Download
memory/3256-1-0x0000000000E30000-0x0000000000F28000-memory.dmp

Filesize
992KB

Download
memory/3256-9-0x00000000061F0000-0x0000000006794000-memory.dmp

Filesize
5.6MB

Download
memory/3256-7-0x00000000033C0000-0x00000000033C8000-memory.dmp

Filesize
32KB

Download
memory/4552-11-0x0000000074D60000-0x0000000075510000-memory.dmp

Filesize
7.7MB

Download
memory/4552-10-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4552-14-0x00000000055C0000-0x00000000055D0000-memory.dmp

Filesize
64KB

Download