agenttesla | 357d3065cb574914e898ff1871a430f39de44d5dd73e47a986bbda5930ccbb67

General

Target

357d3065cb574914e898ff1871a430f39de44d5dd73e47a986bbda5930ccbb67.exe
Size

898KB
MD5

6fa623fed0d9696248aa78dca2f94352
SHA1

1e8fa22b557f36b671eac10573f631011e99ed83
SHA256

357d3065cb574914e898ff1871a430f39de44d5dd73e47a986bbda5930ccbb67
SHA512

ac2f72dd2793c5e79880e5f6c73aee9e2b0460d493a25a33664858aa4c62f01cf6ac006a0d8fc6534225900875fc2b377964533652dc18a26b4c2020cf0457d5

Score

10^/10

Family

agenttesla

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Meta Stealer Stealer
Meta Stealer steals passwords stored in browsers, written in C++.
stealer metastealer

AgentTesla Payload 1 IoCs

resource	yara_rule
behavioral2/memory/3328-141-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2280 set thread context of 3328	2280	357d3065cb574914e898ff1871a430f39de44d5dd73e47a986bbda5930ccbb67.exe	91

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3328	357d3065cb574914e898ff1871a430f39de44d5dd73e47a986bbda5930ccbb67.exe
3328	357d3065cb574914e898ff1871a430f39de44d5dd73e47a986bbda5930ccbb67.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3328	357d3065cb574914e898ff1871a430f39de44d5dd73e47a986bbda5930ccbb67.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2280 wrote to memory of 3328	2280	357d3065cb574914e898ff1871a430f39de44d5dd73e47a986bbda5930ccbb67.exe	91
PID 2280 wrote to memory of 3328	2280	357d3065cb574914e898ff1871a430f39de44d5dd73e47a986bbda5930ccbb67.exe	91
PID 2280 wrote to memory of 3328	2280	357d3065cb574914e898ff1871a430f39de44d5dd73e47a986bbda5930ccbb67.exe	91
PID 2280 wrote to memory of 3328	2280	357d3065cb574914e898ff1871a430f39de44d5dd73e47a986bbda5930ccbb67.exe	91
PID 2280 wrote to memory of 3328	2280	357d3065cb574914e898ff1871a430f39de44d5dd73e47a986bbda5930ccbb67.exe	91
PID 2280 wrote to memory of 3328	2280	357d3065cb574914e898ff1871a430f39de44d5dd73e47a986bbda5930ccbb67.exe	91
PID 2280 wrote to memory of 3328	2280	357d3065cb574914e898ff1871a430f39de44d5dd73e47a986bbda5930ccbb67.exe	91
PID 2280 wrote to memory of 3328	2280	357d3065cb574914e898ff1871a430f39de44d5dd73e47a986bbda5930ccbb67.exe	91

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:5088

memory/2280-134-0x0000000000E90000-0x0000000000F76000-memory.dmp

Filesize
920KB

Download
memory/2280-135-0x0000000005FE0000-0x0000000006584000-memory.dmp

Filesize
5.6MB

Download
memory/2280-136-0x0000000005920000-0x00000000059B2000-memory.dmp

Filesize
584KB

Download
memory/2280-137-0x00000000059C0000-0x00000000059CA000-memory.dmp

Filesize
40KB

Download
memory/2280-138-0x0000000009590000-0x0000000009ABC000-memory.dmp

Filesize
5.2MB

Download
memory/2280-139-0x0000000009F70000-0x000000000A00C000-memory.dmp

Filesize
624KB

Download
memory/3328-141-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3328-142-0x0000000006270000-0x00000000062D6000-memory.dmp

Filesize
408KB

Download