agenttesla | 2fefed764eb9ca3c0cc6ad7dffae6e080112d064b524c8c5e6c8cd0ea7cdb7e6

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
25-04-2024 01:11

Target

2fefed764eb9ca3c0cc6ad7dffae6e080112d064b524c8c5e6c8cd0ea7cdb7e6.exe
Size

997KB
MD5

f2ff134ac606cda442f0e495f84b2c1e
SHA1

3a61d9ce77d4a1853138bb18f08c0ba2794947d1
SHA256

2fefed764eb9ca3c0cc6ad7dffae6e080112d064b524c8c5e6c8cd0ea7cdb7e6
SHA512

6093e06f80c586b4ab8d8009049aa87bee9cae453fdfcd3bcf0c6c92bec25875341b8c4058713d1159548f39efb3c09a718cd94eadab4b066021973df11fe2db
SSDEEP

24576:zUsP3Lwt/h/uLevUebSsMAWRNdXyfEQNBej7kvQ6g8KYt+Z3:AxhV9bwAWRNMffvWkvdgdF

Score

10^/10

Family

agenttesla

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Suspicious use of SetThreadContext 1 IoCs

Processes:

2fefed764eb9ca3c0cc6ad7dffae6e080112d064b524c8c5e6c8cd0ea7cdb7e6.exe

description	pid	process	target process
PID 3796 set thread context of 668	3796	2fefed764eb9ca3c0cc6ad7dffae6e080112d064b524c8c5e6c8cd0ea7cdb7e6.exe	CasPol.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

CasPol.exe

pid process

668 CasPol.exe
668 CasPol.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

CasPol.exe

description pid process

Token: SeDebugPrivilege 668 CasPol.exe

pid	process
668	CasPol.exe
668	CasPol.exe

description	pid	process
Token: SeDebugPrivilege	668	CasPol.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

2fefed764eb9ca3c0cc6ad7dffae6e080112d064b524c8c5e6c8cd0ea7cdb7e6.exe

description	pid	process	target process
PID 3796 wrote to memory of 668	3796	2fefed764eb9ca3c0cc6ad7dffae6e080112d064b524c8c5e6c8cd0ea7cdb7e6.exe	CasPol.exe
PID 3796 wrote to memory of 668	3796	2fefed764eb9ca3c0cc6ad7dffae6e080112d064b524c8c5e6c8cd0ea7cdb7e6.exe	CasPol.exe
PID 3796 wrote to memory of 668	3796	2fefed764eb9ca3c0cc6ad7dffae6e080112d064b524c8c5e6c8cd0ea7cdb7e6.exe	CasPol.exe
PID 3796 wrote to memory of 668	3796	2fefed764eb9ca3c0cc6ad7dffae6e080112d064b524c8c5e6c8cd0ea7cdb7e6.exe	CasPol.exe
PID 3796 wrote to memory of 668	3796	2fefed764eb9ca3c0cc6ad7dffae6e080112d064b524c8c5e6c8cd0ea7cdb7e6.exe	CasPol.exe
PID 3796 wrote to memory of 668	3796	2fefed764eb9ca3c0cc6ad7dffae6e080112d064b524c8c5e6c8cd0ea7cdb7e6.exe	CasPol.exe
PID 3796 wrote to memory of 668	3796	2fefed764eb9ca3c0cc6ad7dffae6e080112d064b524c8c5e6c8cd0ea7cdb7e6.exe	CasPol.exe
PID 3796 wrote to memory of 668	3796	2fefed764eb9ca3c0cc6ad7dffae6e080112d064b524c8c5e6c8cd0ea7cdb7e6.exe	CasPol.exe

memory/668-7-0x00000000053D0000-0x00000000053E0000-memory.dmp

Filesize
64KB

Download
memory/668-10-0x0000000006300000-0x0000000006350000-memory.dmp

Filesize
320KB

Download
memory/668-15-0x0000000006720000-0x000000000672A000-memory.dmp

Filesize
40KB

Download
memory/668-14-0x0000000006770000-0x0000000006802000-memory.dmp

Filesize
584KB

Download
memory/668-13-0x00000000053D0000-0x00000000053E0000-memory.dmp

Filesize
64KB

Download
memory/668-5-0x0000000074BD0000-0x0000000075380000-memory.dmp

Filesize
7.7MB

Download
memory/668-12-0x0000000074BD0000-0x0000000075380000-memory.dmp

Filesize
7.7MB

Download
memory/668-6-0x00000000057D0000-0x0000000005D74000-memory.dmp

Filesize
5.6MB

Download
memory/668-4-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/668-11-0x00000000063F0000-0x000000000648C000-memory.dmp

Filesize
624KB

Download
memory/668-8-0x00000000053E0000-0x0000000005446000-memory.dmp

Filesize
408KB

Download
memory/3796-9-0x00007FFFB0800000-0x00007FFFB12C1000-memory.dmp

Filesize
10.8MB

Download
memory/3796-1-0x00007FFFB0800000-0x00007FFFB12C1000-memory.dmp

Filesize
10.8MB

Download
memory/3796-0-0x000002CF12F90000-0x000002CF12FFC000-memory.dmp

Filesize
432KB

Download
memory/3796-3-0x000002CF14CC0000-0x000002CF14D56000-memory.dmp

Filesize
600KB

Download
memory/3796-2-0x000002CF14C90000-0x000002CF14CA0000-memory.dmp

Filesize
64KB

Download