agenttesla | 756ba5dbbdeb25bbd2fbab5f1fb58d9928f25e1be1ce3c608d8433eb69df298d

General

Target

756ba5dbbdeb25bbd2fbab5f1fb58d9928f25e1be1ce3c608d8433eb69df298d.exe
Size

771KB
MD5

8952e566dc30b2b0928253d3d066463d
SHA1

41c507fa1dba4e479f7db844b661ac130b8e907d
SHA256

756ba5dbbdeb25bbd2fbab5f1fb58d9928f25e1be1ce3c608d8433eb69df298d
SHA512

03dd400dc5217ce847934eaa6095204487fba4dddfc4c86bc4f7222d493702a798e9238c092fc4325dde1c46131e74ee65415d9c5ef24bc17407becca5004335

Score

10^/10

Family

agenttesla

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Meta Stealer Stealer
Meta Stealer steals passwords stored in browsers, written in C++.
stealer metastealer

AgentTesla Payload 1 IoCs

resource	yara_rule
behavioral2/memory/1624-141-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1396 set thread context of 1624	1396	756ba5dbbdeb25bbd2fbab5f1fb58d9928f25e1be1ce3c608d8433eb69df298d.exe	93

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1624	756ba5dbbdeb25bbd2fbab5f1fb58d9928f25e1be1ce3c608d8433eb69df298d.exe
1624	756ba5dbbdeb25bbd2fbab5f1fb58d9928f25e1be1ce3c608d8433eb69df298d.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1624	756ba5dbbdeb25bbd2fbab5f1fb58d9928f25e1be1ce3c608d8433eb69df298d.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1396 wrote to memory of 1624	1396	756ba5dbbdeb25bbd2fbab5f1fb58d9928f25e1be1ce3c608d8433eb69df298d.exe	93
PID 1396 wrote to memory of 1624	1396	756ba5dbbdeb25bbd2fbab5f1fb58d9928f25e1be1ce3c608d8433eb69df298d.exe	93
PID 1396 wrote to memory of 1624	1396	756ba5dbbdeb25bbd2fbab5f1fb58d9928f25e1be1ce3c608d8433eb69df298d.exe	93
PID 1396 wrote to memory of 1624	1396	756ba5dbbdeb25bbd2fbab5f1fb58d9928f25e1be1ce3c608d8433eb69df298d.exe	93
PID 1396 wrote to memory of 1624	1396	756ba5dbbdeb25bbd2fbab5f1fb58d9928f25e1be1ce3c608d8433eb69df298d.exe	93
PID 1396 wrote to memory of 1624	1396	756ba5dbbdeb25bbd2fbab5f1fb58d9928f25e1be1ce3c608d8433eb69df298d.exe	93
PID 1396 wrote to memory of 1624	1396	756ba5dbbdeb25bbd2fbab5f1fb58d9928f25e1be1ce3c608d8433eb69df298d.exe	93
PID 1396 wrote to memory of 1624	1396	756ba5dbbdeb25bbd2fbab5f1fb58d9928f25e1be1ce3c608d8433eb69df298d.exe	93

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\756ba5dbbdeb25bbd2fbab5f1fb58d9928f25e1be1ce3c608d8433eb69df298d.exe.log

Filesize
1KB

MD5
6f8f3a9a57cb30e686d3355e656031e0

SHA1
acccd6befb1a2f40e662280bc5182e086a0d079b

SHA256
283586e83b25099a5698cb9caf9c594a37060d11e0f55c81bb9c6d4f728448ea

SHA512
8f11d645ff4f8d5b1c45b06eb52cd45319659255306d60e80e33abfd04b9e3b1164679f11a8a23bd493e4b3f6b9841d70e553a01835eeaf6035b4d05e4fd7b54

Download Submit
memory/1396-134-0x0000000000590000-0x0000000000658000-memory.dmp

Filesize
800KB

Download
memory/1396-135-0x000000000AA70000-0x000000000B014000-memory.dmp

Filesize
5.6MB

Download
memory/1396-136-0x000000000A4C0000-0x000000000A552000-memory.dmp

Filesize
584KB

Download
memory/1396-137-0x000000000A650000-0x000000000A65A000-memory.dmp

Filesize
40KB

Download
memory/1396-138-0x000000000CEA0000-0x000000000D3CC000-memory.dmp

Filesize
5.2MB

Download
memory/1396-139-0x000000000D640000-0x000000000D6DC000-memory.dmp

Filesize
624KB

Download
memory/1624-141-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1624-143-0x00000000064C0000-0x0000000006526000-memory.dmp

Filesize
408KB

Download