agenttesla | 09523cd3fc0e17afce188feba581f69856f02b8712f3fc3dc8820bcddb38d14c

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
17/04/2024, 14:12

Target

b8aeea3f7ef70b323830b29a881aa47ffe63cd2e6109bbcc1412ca3a0de7ceff.exe
Size

330KB
MD5

f06c2933e107c821c0f1ce5189e00afe
SHA1

57178d398c17b35ab813606f3d663b79c273a8da
SHA256

b8aeea3f7ef70b323830b29a881aa47ffe63cd2e6109bbcc1412ca3a0de7ceff
SHA512

415f3b6fc8158ceef1808763418c70441460d714e0737a18c4578cf50c9fce3fa8e3f9a4a74f969191087c19d7b21603f5f35379e56271fdc011492181aa662b
SSDEEP

6144:KIimSUgVG/HLWUjVViBFGwkD5G8Sr36u2OT1/1RqPC8+IQFsy:pSdg/HLW40gNmBT1OC8+I

Score

10^/10

Family

agenttesla

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2880 set thread context of 2948	2880	b8aeea3f7ef70b323830b29a881aa47ffe63cd2e6109bbcc1412ca3a0de7ceff.exe	28

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2880 wrote to memory of 2948	2880	b8aeea3f7ef70b323830b29a881aa47ffe63cd2e6109bbcc1412ca3a0de7ceff.exe	28
PID 2880 wrote to memory of 2948	2880	b8aeea3f7ef70b323830b29a881aa47ffe63cd2e6109bbcc1412ca3a0de7ceff.exe	28
PID 2880 wrote to memory of 2948	2880	b8aeea3f7ef70b323830b29a881aa47ffe63cd2e6109bbcc1412ca3a0de7ceff.exe	28
PID 2880 wrote to memory of 2948	2880	b8aeea3f7ef70b323830b29a881aa47ffe63cd2e6109bbcc1412ca3a0de7ceff.exe	28
PID 2880 wrote to memory of 2948	2880	b8aeea3f7ef70b323830b29a881aa47ffe63cd2e6109bbcc1412ca3a0de7ceff.exe	28
PID 2880 wrote to memory of 2948	2880	b8aeea3f7ef70b323830b29a881aa47ffe63cd2e6109bbcc1412ca3a0de7ceff.exe	28
PID 2880 wrote to memory of 2948	2880	b8aeea3f7ef70b323830b29a881aa47ffe63cd2e6109bbcc1412ca3a0de7ceff.exe	28
PID 2880 wrote to memory of 2948	2880	b8aeea3f7ef70b323830b29a881aa47ffe63cd2e6109bbcc1412ca3a0de7ceff.exe	28
PID 2880 wrote to memory of 2948	2880	b8aeea3f7ef70b323830b29a881aa47ffe63cd2e6109bbcc1412ca3a0de7ceff.exe	28

C:\Users\Admin\AppData\Local\Temp\b8aeea3f7ef70b323830b29a881aa47ffe63cd2e6109bbcc1412ca3a0de7ceff.exe
"C:\Users\Admin\AppData\Local\Temp\b8aeea3f7ef70b323830b29a881aa47ffe63cd2e6109bbcc1412ca3a0de7ceff.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2880
- C:\Users\Admin\AppData\Local\Temp\b8aeea3f7ef70b323830b29a881aa47ffe63cd2e6109bbcc1412ca3a0de7ceff.exe
  "C:\Users\Admin\AppData\Local\Temp\b8aeea3f7ef70b323830b29a881aa47ffe63cd2e6109bbcc1412ca3a0de7ceff.exe"
  2⤵
  PID:2948

memory/2880-0-0x00000000003E0000-0x0000000000438000-memory.dmp

Filesize
352KB

Download
memory/2880-1-0x0000000074470000-0x0000000074B5E000-memory.dmp

Filesize
6.9MB

Download
memory/2880-2-0x0000000001F30000-0x0000000001F70000-memory.dmp

Filesize
256KB

Download
memory/2880-4-0x00000000005D0000-0x00000000005D1000-memory.dmp

Filesize
4KB

Download
memory/2880-15-0x0000000074470000-0x0000000074B5E000-memory.dmp

Filesize
6.9MB

Download
memory/2948-3-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2948-6-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2948-13-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2948-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2948-9-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2948-8-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download