agenttesla | 40e3874685cffae1f24a18f5c6c9a5a85866860cb87056ecca32f78603ee333d

General

Target

40e3874685cffae1f24a18f5c6c9a5a85866860cb87056ecca32f78603ee333d.exe
Size

745KB
MD5

90a2b052ea5d791938b4c4cb7f3ec803
SHA1

e2a171e90049f33ad34491b702a7b1d5bdbe15df
SHA256

40e3874685cffae1f24a18f5c6c9a5a85866860cb87056ecca32f78603ee333d
SHA512

2544f5b16f452a364db3dd94b74ea87ca5b35b99a1d96bff6e9a028ff6d45268e235f647e40b1b7c0daad260f0919629c2d7758cbd984b5399969cab100670fd

Score

10^/10

Family

agenttesla

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Meta Stealer Stealer
Meta Stealer steals passwords stored in browsers, written in C++.
stealer metastealer

AgentTesla Payload 1 IoCs

resource	yara_rule
behavioral2/memory/1832-137-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5068 set thread context of 1832	5068	40e3874685cffae1f24a18f5c6c9a5a85866860cb87056ecca32f78603ee333d.exe	79

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1832	40e3874685cffae1f24a18f5c6c9a5a85866860cb87056ecca32f78603ee333d.exe
1832	40e3874685cffae1f24a18f5c6c9a5a85866860cb87056ecca32f78603ee333d.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1832	40e3874685cffae1f24a18f5c6c9a5a85866860cb87056ecca32f78603ee333d.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5068 wrote to memory of 1832	5068	40e3874685cffae1f24a18f5c6c9a5a85866860cb87056ecca32f78603ee333d.exe	79
PID 5068 wrote to memory of 1832	5068	40e3874685cffae1f24a18f5c6c9a5a85866860cb87056ecca32f78603ee333d.exe	79
PID 5068 wrote to memory of 1832	5068	40e3874685cffae1f24a18f5c6c9a5a85866860cb87056ecca32f78603ee333d.exe	79
PID 5068 wrote to memory of 1832	5068	40e3874685cffae1f24a18f5c6c9a5a85866860cb87056ecca32f78603ee333d.exe	79
PID 5068 wrote to memory of 1832	5068	40e3874685cffae1f24a18f5c6c9a5a85866860cb87056ecca32f78603ee333d.exe	79
PID 5068 wrote to memory of 1832	5068	40e3874685cffae1f24a18f5c6c9a5a85866860cb87056ecca32f78603ee333d.exe	79
PID 5068 wrote to memory of 1832	5068	40e3874685cffae1f24a18f5c6c9a5a85866860cb87056ecca32f78603ee333d.exe	79
PID 5068 wrote to memory of 1832	5068	40e3874685cffae1f24a18f5c6c9a5a85866860cb87056ecca32f78603ee333d.exe	79

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\40e3874685cffae1f24a18f5c6c9a5a85866860cb87056ecca32f78603ee333d.exe.log

Filesize
1KB

MD5
6f8f3a9a57cb30e686d3355e656031e0

SHA1
acccd6befb1a2f40e662280bc5182e086a0d079b

SHA256
283586e83b25099a5698cb9caf9c594a37060d11e0f55c81bb9c6d4f728448ea

SHA512
8f11d645ff4f8d5b1c45b06eb52cd45319659255306d60e80e33abfd04b9e3b1164679f11a8a23bd493e4b3f6b9841d70e553a01835eeaf6035b4d05e4fd7b54

Download Submit
memory/1832-137-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1832-139-0x0000000006730000-0x0000000006796000-memory.dmp

Filesize
408KB

Download
memory/5068-130-0x0000000000BC0000-0x0000000000C80000-memory.dmp

Filesize
768KB

Download
memory/5068-131-0x000000000A290000-0x000000000A834000-memory.dmp

Filesize
5.6MB

Download
memory/5068-132-0x0000000005800000-0x0000000005892000-memory.dmp

Filesize
584KB

Download
memory/5068-133-0x00000000057E0000-0x00000000057EA000-memory.dmp

Filesize
40KB

Download
memory/5068-134-0x0000000009110000-0x000000000963C000-memory.dmp

Filesize
5.2MB

Download
memory/5068-135-0x0000000009000000-0x000000000909C000-memory.dmp

Filesize
624KB

Download