agenttesla | 3a535814023d01b99aec8e98e291a9e96dec22036f6ddf32155f47e5e4af93b4

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 04:48

Target

$PLUGINSDIR/evnlygoa.dll
Size

16KB
MD5

8ed79ba21eea27180585788ff0b88c1a
SHA1

d5b9a67e668262fa857c13531dcc2be76d87bbae
SHA256

0f9d6c7dd90cbcfef51b5917e214f5e75b8fc10f25ff46deb6f6d304f1e4afe6
SHA512

b2289f8c59885cd23941a8dfd00bfb018af5c9b926726362157c5a5b257b42b59a6e48ccb9ab7cfa45b190ac244617a7bfdc34ff8eb04f8ba840613f0d925dbc
SSDEEP

192:pkDqveVwq3/xTQqf8giRokjJMYHYLDFWGqgroe/DD8IiCeJ2/20mCKG1IyZ:q24wq35TR8pocYL0zED8kae221Iy

Score

10^/10

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla payload 1 IoCs

resource	yara_rule
behavioral3/memory/1616-3-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2084 set thread context of 1616	2084	rundll32.exe	32

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1648 wrote to memory of 2084	1648	rundll32.exe	31
PID 1648 wrote to memory of 2084	1648	rundll32.exe	31
PID 1648 wrote to memory of 2084	1648	rundll32.exe	31
PID 1648 wrote to memory of 2084	1648	rundll32.exe	31
PID 1648 wrote to memory of 2084	1648	rundll32.exe	31
PID 1648 wrote to memory of 2084	1648	rundll32.exe	31
PID 1648 wrote to memory of 2084	1648	rundll32.exe	31
PID 2084 wrote to memory of 1616	2084	rundll32.exe	32
PID 2084 wrote to memory of 1616	2084	rundll32.exe	32
PID 2084 wrote to memory of 1616	2084	rundll32.exe	32
PID 2084 wrote to memory of 1616	2084	rundll32.exe	32
PID 2084 wrote to memory of 1616	2084	rundll32.exe	32
PID 2084 wrote to memory of 1616	2084	rundll32.exe	32
PID 2084 wrote to memory of 1616	2084	rundll32.exe	32
PID 2084 wrote to memory of 1616	2084	rundll32.exe	32
PID 2084 wrote to memory of 1616	2084	rundll32.exe	32
PID 2084 wrote to memory of 1616	2084	rundll32.exe	32
PID 2084 wrote to memory of 1616	2084	rundll32.exe	32
PID 2084 wrote to memory of 1616	2084	rundll32.exe	32
PID 2084 wrote to memory of 1616	2084	rundll32.exe	32
PID 2084 wrote to memory of 1616	2084	rundll32.exe	32

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\evnlygoa.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1648
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\evnlygoa.dll,#1
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2084
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\evnlygoa.dll,#1
    3⤵
    PID:1616

memory/1616-3-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/2084-0-0x0000000074C20000-0x0000000074C29000-memory.dmp

Filesize
36KB

Download
memory/2084-2-0x0000000074C20000-0x0000000074C29000-memory.dmp

Filesize
36KB

Download
memory/2084-1-0x0000000074C10000-0x0000000074C19000-memory.dmp

Filesize
36KB

Download
memory/2084-7-0x0000000074C10000-0x0000000074C19000-memory.dmp

Filesize
36KB

Download
memory/2084-6-0x0000000074C20000-0x0000000074C29000-memory.dmp

Filesize
36KB

Download