agenttesla | 190469774e832bee578dd5ea4349878063b86eedca8b77f1efec51af20cd1ce7

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
24/05/2024, 07:52

Target

190469774e832bee578dd5ea4349878063b86eedca8b77f1efec51af20cd1ce7.exe
Size

1020KB
MD5

9bd9e74ec90979f70c3e6ceead15aa5a
SHA1

3e945f971d078852a63db6cbf2698e82700c2f35
SHA256

190469774e832bee578dd5ea4349878063b86eedca8b77f1efec51af20cd1ce7
SHA512

4362f80e3db045ed6898e225e740f72ec09b4dd8b4752d0323aaac3892d84e2c032eaaca7598f8d04651a44705249a05db9d52299d017a3b8232afc59eb5e928
SSDEEP

24576:bAHnh+eWsN3skA4RV1Hom2KXMmHacoB1S4Pg65:2h+ZkldoPK8YacoB1PP9

Score

10^/10

Family

agenttesla

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 404 set thread context of 4076	404	190469774e832bee578dd5ea4349878063b86eedca8b77f1efec51af20cd1ce7.exe	85

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4076	RegSvcs.exe
4076	RegSvcs.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
404	190469774e832bee578dd5ea4349878063b86eedca8b77f1efec51af20cd1ce7.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4076	RegSvcs.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
404	190469774e832bee578dd5ea4349878063b86eedca8b77f1efec51af20cd1ce7.exe
404	190469774e832bee578dd5ea4349878063b86eedca8b77f1efec51af20cd1ce7.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
404	190469774e832bee578dd5ea4349878063b86eedca8b77f1efec51af20cd1ce7.exe
404	190469774e832bee578dd5ea4349878063b86eedca8b77f1efec51af20cd1ce7.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 404 wrote to memory of 4076	404	190469774e832bee578dd5ea4349878063b86eedca8b77f1efec51af20cd1ce7.exe	85
PID 404 wrote to memory of 4076	404	190469774e832bee578dd5ea4349878063b86eedca8b77f1efec51af20cd1ce7.exe	85
PID 404 wrote to memory of 4076	404	190469774e832bee578dd5ea4349878063b86eedca8b77f1efec51af20cd1ce7.exe	85
PID 404 wrote to memory of 4076	404	190469774e832bee578dd5ea4349878063b86eedca8b77f1efec51af20cd1ce7.exe	85

memory/404-10-0x00000000040A0000-0x00000000040A4000-memory.dmp

Filesize
16KB

Download
memory/4076-11-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4076-12-0x0000000074CAE000-0x0000000074CAF000-memory.dmp

Filesize
4KB

Download
memory/4076-13-0x0000000006040000-0x00000000065E4000-memory.dmp

Filesize
5.6MB

Download
memory/4076-14-0x0000000005A90000-0x0000000005AF6000-memory.dmp

Filesize
408KB

Download
memory/4076-15-0x0000000074CA0000-0x0000000075450000-memory.dmp

Filesize
7.7MB

Download
memory/4076-16-0x0000000006950000-0x00000000069A0000-memory.dmp

Filesize
320KB

Download
memory/4076-17-0x0000000006A40000-0x0000000006AD2000-memory.dmp

Filesize
584KB

Download
memory/4076-18-0x00000000069E0000-0x00000000069EA000-memory.dmp

Filesize
40KB

Download
memory/4076-19-0x0000000074CAE000-0x0000000074CAF000-memory.dmp

Filesize
4KB

Download
memory/4076-20-0x0000000074CA0000-0x0000000075450000-memory.dmp

Filesize
7.7MB

Download