agenttesla | 5da35ea88b86ff48676795109f73d0a0e1b3368ea68ec943d07612a8e8caaa26

Analysis

max time kernel
140s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
23/04/2024, 05:37

Target

RsKLvtCNnrkiaLu.exe
Size

704KB
MD5

a63c1e438213e8fe61cd6b4c6363211b
SHA1

1d94ca869d19c155d024dc9880d2441dfef22f05
SHA256

5da35ea88b86ff48676795109f73d0a0e1b3368ea68ec943d07612a8e8caaa26
SHA512

aa45a06303df8e4257b08e4ae62a1be84376629c23bef2f81102f4e647147be0ba48965f6069fba70149411e8ce3f003a3320ac738852b30035bb157d8166dbc
SSDEEP

12288:tXUvS1Z2ruliT2X/FvWoRDncMQocyyZViThGghSpyjJlXyVim3OR0FWCiQT:Sv/ClfFv3yD+hR6yjJlCVjLW/

Score

10^/10

Family

agenttesla

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3392 set thread context of 1956	3392	RsKLvtCNnrkiaLu.exe	105

Suspicious behavior: EnumeratesProcesses 17 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3392	RsKLvtCNnrkiaLu.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3392 wrote to memory of 1168	3392	RsKLvtCNnrkiaLu.exe	104
PID 3392 wrote to memory of 1168	3392	RsKLvtCNnrkiaLu.exe	104
PID 3392 wrote to memory of 1168	3392	RsKLvtCNnrkiaLu.exe	104
PID 3392 wrote to memory of 1956	3392	RsKLvtCNnrkiaLu.exe	105
PID 3392 wrote to memory of 1956	3392	RsKLvtCNnrkiaLu.exe	105
PID 3392 wrote to memory of 1956	3392	RsKLvtCNnrkiaLu.exe	105
PID 3392 wrote to memory of 1956	3392	RsKLvtCNnrkiaLu.exe	105
PID 3392 wrote to memory of 1956	3392	RsKLvtCNnrkiaLu.exe	105
PID 3392 wrote to memory of 1956	3392	RsKLvtCNnrkiaLu.exe	105
PID 3392 wrote to memory of 1956	3392	RsKLvtCNnrkiaLu.exe	105
PID 3392 wrote to memory of 1956	3392	RsKLvtCNnrkiaLu.exe	105

C:\Users\Admin\AppData\Local\Temp\RsKLvtCNnrkiaLu.exe
"C:\Users\Admin\AppData\Local\Temp\RsKLvtCNnrkiaLu.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3392
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:1168
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:1956

memory/1956-14-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3392-8-0x0000000004ED0000-0x0000000004EDE000-memory.dmp

Filesize
56KB

Download
memory/3392-11-0x000000000CD60000-0x000000000CDFC000-memory.dmp

Filesize
624KB

Download
memory/3392-3-0x0000000004BF0000-0x0000000004C82000-memory.dmp

Filesize
584KB

Download
memory/3392-4-0x0000000004D50000-0x0000000004D60000-memory.dmp

Filesize
64KB

Download
memory/3392-5-0x0000000004B90000-0x0000000004B9A000-memory.dmp

Filesize
40KB

Download
memory/3392-6-0x0000000005EB0000-0x0000000005F4E000-memory.dmp

Filesize
632KB

Download
memory/3392-2-0x0000000005100000-0x00000000056A4000-memory.dmp

Filesize
5.6MB

Download
memory/3392-9-0x0000000004EE0000-0x0000000004EF4000-memory.dmp

Filesize
80KB

Download
memory/3392-7-0x0000000004D10000-0x0000000004D28000-memory.dmp

Filesize
96KB

Download
memory/3392-10-0x0000000009C40000-0x0000000009CC2000-memory.dmp

Filesize
520KB

Download
memory/3392-0-0x00000000000D0000-0x0000000000186000-memory.dmp

Filesize
728KB

Download
memory/3392-12-0x0000000075350000-0x0000000075B00000-memory.dmp

Filesize
7.7MB

Download
memory/3392-13-0x0000000004D50000-0x0000000004D60000-memory.dmp

Filesize
64KB

Download
memory/3392-1-0x0000000075350000-0x0000000075B00000-memory.dmp

Filesize
7.7MB

Download
memory/3392-16-0x0000000075350000-0x0000000075B00000-memory.dmp

Filesize
7.7MB

Download