agenttesla | 5c63633ca6215a64a9f504580e17a9968636d66dcf44c062a876d25c1326ac09

General

Target

5c63633ca6215a64a9f504580e17a9968636d66dcf44c062a876d25c1326ac09.exe
Size

765KB
MD5

771ca382a7507d9f3fe65644662ac9d4
SHA1

002bc72cb2cc25c0d3d2489af70a76fa690d2215
SHA256

5c63633ca6215a64a9f504580e17a9968636d66dcf44c062a876d25c1326ac09
SHA512

4d7f888572116aa20872795c0a5e7766dc9d0aba9a07193080c7521bdd9689d99e7f2325364c33fdb4d56a4fbc0b29d944e258a2c0d3aacaa8071df3e7aeff54

Score

10^/10

Family

agenttesla

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Meta Stealer Stealer
Meta Stealer steals passwords stored in browsers, written in C++.
stealer metastealer

AgentTesla Payload 1 IoCs

resource	yara_rule
behavioral2/memory/4360-141-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2704 set thread context of 4360	2704	5c63633ca6215a64a9f504580e17a9968636d66dcf44c062a876d25c1326ac09.exe	93

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4360	5c63633ca6215a64a9f504580e17a9968636d66dcf44c062a876d25c1326ac09.exe
4360	5c63633ca6215a64a9f504580e17a9968636d66dcf44c062a876d25c1326ac09.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4360	5c63633ca6215a64a9f504580e17a9968636d66dcf44c062a876d25c1326ac09.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2704 wrote to memory of 4360	2704	5c63633ca6215a64a9f504580e17a9968636d66dcf44c062a876d25c1326ac09.exe	93
PID 2704 wrote to memory of 4360	2704	5c63633ca6215a64a9f504580e17a9968636d66dcf44c062a876d25c1326ac09.exe	93
PID 2704 wrote to memory of 4360	2704	5c63633ca6215a64a9f504580e17a9968636d66dcf44c062a876d25c1326ac09.exe	93
PID 2704 wrote to memory of 4360	2704	5c63633ca6215a64a9f504580e17a9968636d66dcf44c062a876d25c1326ac09.exe	93
PID 2704 wrote to memory of 4360	2704	5c63633ca6215a64a9f504580e17a9968636d66dcf44c062a876d25c1326ac09.exe	93
PID 2704 wrote to memory of 4360	2704	5c63633ca6215a64a9f504580e17a9968636d66dcf44c062a876d25c1326ac09.exe	93
PID 2704 wrote to memory of 4360	2704	5c63633ca6215a64a9f504580e17a9968636d66dcf44c062a876d25c1326ac09.exe	93
PID 2704 wrote to memory of 4360	2704	5c63633ca6215a64a9f504580e17a9968636d66dcf44c062a876d25c1326ac09.exe	93

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\5c63633ca6215a64a9f504580e17a9968636d66dcf44c062a876d25c1326ac09.exe.log

Filesize
1KB

MD5
6f8f3a9a57cb30e686d3355e656031e0

SHA1
acccd6befb1a2f40e662280bc5182e086a0d079b

SHA256
283586e83b25099a5698cb9caf9c594a37060d11e0f55c81bb9c6d4f728448ea

SHA512
8f11d645ff4f8d5b1c45b06eb52cd45319659255306d60e80e33abfd04b9e3b1164679f11a8a23bd493e4b3f6b9841d70e553a01835eeaf6035b4d05e4fd7b54

Download Submit
memory/2704-134-0x0000000000610000-0x00000000006D6000-memory.dmp

Filesize
792KB

Download
memory/2704-135-0x000000000AAB0000-0x000000000B054000-memory.dmp

Filesize
5.6MB

Download
memory/2704-136-0x000000000A540000-0x000000000A5D2000-memory.dmp

Filesize
584KB

Download
memory/2704-137-0x000000000A6D0000-0x000000000A6DA000-memory.dmp

Filesize
40KB

Download
memory/2704-138-0x000000000CE90000-0x000000000D3BC000-memory.dmp

Filesize
5.2MB

Download
memory/2704-139-0x000000000D540000-0x000000000D5DC000-memory.dmp

Filesize
624KB

Download
memory/4360-141-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4360-143-0x0000000005880000-0x00000000058E6000-memory.dmp

Filesize
408KB

Download