agenttesla | e1e2efb1c4ca047cdc08cd33831f0b466eac9d25c479a7a435aef672726efb8f

Analysis

max time kernel
3s
max time network
15s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29-03-2024 05:08

Target

StealLoaderSIAL.exe
Size

25.0MB
MD5

d0df1b4b1807afe39497ccdad8acd48b
SHA1

be392a0e771803b0ac8cec4060ca35c481431bcc
SHA256

e1e2efb1c4ca047cdc08cd33831f0b466eac9d25c479a7a435aef672726efb8f
SHA512

05cc5c97db77eb5e004ad2a7c82b06c6dbffc83c36829a55ea2cddc722475acb17ebfaf3c7acc976fd6ea4c9410893f5222186f4680a2085e33c615816d89365
SSDEEP

393216:AtpjoQb6pkFGB51P2Bb1ksn7O3x33ftDt5TG08:AfcDpeGibxn7OVv53h8

Score

10^/10

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2824-5-0x000000001E660000-0x000000001E856000-memory.dmp	family_agenttesla

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

StealLoaderSIAL.exe

pid process

2824 StealLoaderSIAL.exe
2824 StealLoaderSIAL.exe

pid	process
2824	StealLoaderSIAL.exe
2824	StealLoaderSIAL.exe

C:\Users\Admin\AppData\Local\Temp\StealLoaderSIAL.exe
"C:\Users\Admin\AppData\Local\Temp\StealLoaderSIAL.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2824

memory/2824-0-0x00007FFB08FE0000-0x00007FFB09AA1000-memory.dmp

Filesize
10.8MB

Download
memory/2824-1-0x0000000000D40000-0x00000000032EE000-memory.dmp

Filesize
37.7MB

Download
memory/2824-2-0x0000000005350000-0x0000000005351000-memory.dmp

Filesize
4KB

Download
memory/2824-3-0x000000001E080000-0x000000001E090000-memory.dmp

Filesize
64KB

Download
memory/2824-4-0x000000001E290000-0x000000001E4E8000-memory.dmp

Filesize
2.3MB

Download
memory/2824-5-0x000000001E660000-0x000000001E856000-memory.dmp

Filesize
2.0MB

Download
memory/2824-6-0x0000000005390000-0x00000000053A2000-memory.dmp

Filesize
72KB

Download
memory/2824-7-0x000000001E080000-0x000000001E090000-memory.dmp

Filesize
64KB

Download