agenttesla | 1fe84fb18ac571783c60a204adf2ad5a852d75ddbbbff29ba49a3f62e626ca09

General

Target

1fe84fb18ac571783c60a204adf2ad5a852d75ddbbbff29ba49a3f62e626ca09.exe
Size

957KB
MD5

938c2703939dda11b234257eda92c8dc
SHA1

e4e1f38e72ec376437ebca8eee716ca3c143adf0
SHA256

1fe84fb18ac571783c60a204adf2ad5a852d75ddbbbff29ba49a3f62e626ca09
SHA512

db5d486619a82c183dbaeaf8037980f7ac35a3b0d94c62c733ab16a29eda5cc9aaa113db225dd4b8a55e7b3741d620e8e98a699be11992aa96afd76338eaffa8

Score

10^/10

Family

agenttesla

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Meta Stealer Stealer
Meta Stealer steals passwords stored in browsers, written in C++.
stealer metastealer

AgentTesla Payload 1 IoCs

resource	yara_rule
behavioral2/memory/1756-137-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
44	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3372 set thread context of 1756	3372	1fe84fb18ac571783c60a204adf2ad5a852d75ddbbbff29ba49a3f62e626ca09.exe	88

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3372	1fe84fb18ac571783c60a204adf2ad5a852d75ddbbbff29ba49a3f62e626ca09.exe
1756	1fe84fb18ac571783c60a204adf2ad5a852d75ddbbbff29ba49a3f62e626ca09.exe
1756	1fe84fb18ac571783c60a204adf2ad5a852d75ddbbbff29ba49a3f62e626ca09.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3372	1fe84fb18ac571783c60a204adf2ad5a852d75ddbbbff29ba49a3f62e626ca09.exe
Token: SeDebugPrivilege	1756	1fe84fb18ac571783c60a204adf2ad5a852d75ddbbbff29ba49a3f62e626ca09.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3372 wrote to memory of 1756	3372	1fe84fb18ac571783c60a204adf2ad5a852d75ddbbbff29ba49a3f62e626ca09.exe	88
PID 3372 wrote to memory of 1756	3372	1fe84fb18ac571783c60a204adf2ad5a852d75ddbbbff29ba49a3f62e626ca09.exe	88
PID 3372 wrote to memory of 1756	3372	1fe84fb18ac571783c60a204adf2ad5a852d75ddbbbff29ba49a3f62e626ca09.exe	88
PID 3372 wrote to memory of 1756	3372	1fe84fb18ac571783c60a204adf2ad5a852d75ddbbbff29ba49a3f62e626ca09.exe	88
PID 3372 wrote to memory of 1756	3372	1fe84fb18ac571783c60a204adf2ad5a852d75ddbbbff29ba49a3f62e626ca09.exe	88
PID 3372 wrote to memory of 1756	3372	1fe84fb18ac571783c60a204adf2ad5a852d75ddbbbff29ba49a3f62e626ca09.exe	88
PID 3372 wrote to memory of 1756	3372	1fe84fb18ac571783c60a204adf2ad5a852d75ddbbbff29ba49a3f62e626ca09.exe	88
PID 3372 wrote to memory of 1756	3372	1fe84fb18ac571783c60a204adf2ad5a852d75ddbbbff29ba49a3f62e626ca09.exe	88

memory/1756-137-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1756-138-0x0000000006630000-0x0000000006696000-memory.dmp

Filesize
408KB

Download
memory/3372-130-0x0000000000D60000-0x0000000000E56000-memory.dmp

Filesize
984KB

Download
memory/3372-131-0x0000000008090000-0x0000000008634000-memory.dmp

Filesize
5.6MB

Download
memory/3372-132-0x0000000007B90000-0x0000000007C22000-memory.dmp

Filesize
584KB

Download
memory/3372-133-0x0000000007C50000-0x0000000007C5A000-memory.dmp

Filesize
40KB

Download
memory/3372-134-0x000000000A5E0000-0x000000000AB0C000-memory.dmp

Filesize
5.2MB

Download
memory/3372-135-0x000000000AD20000-0x000000000ADBC000-memory.dmp

Filesize
624KB

Download