agenttesla | d933840f4eab2f54bb39b15b97cf8a8509e1f8b6fe35b6bcbe3066bd6d7f6836

Analysis

max time kernel
120s
max time network
134s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16-04-2024 01:48

Target

Springhill Textile Ab- GAW24-46 img.exe
Size

1.0MB
MD5

71b5da5a28e71e5071becfe9b149f8ac
SHA1

9788d70b6efad78c9c159553296eae40daf90153
SHA256

3e6c0c4d3f37780d6cc07d9b57d36c74fc8de02d13e05ea51fca7b815cde8d59
SHA512

05079c1406bb1062d55ab9a013669253a6f589b0c6678e4336bc9bac64871ee41fd42dc802b69b1266d9385742b0674543dc075ea609a33a8ec23f9fc9ef63b1
SSDEEP

24576:h1qwOISG22mBss0Sykah91O7OyEQtr3cnmiS:ywzD22mBss0SykaY7OyEQtrMn7S

Score

10^/10

Family

agenttesla

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2368	Springhill Textile Ab- GAW24-46 img.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2368	Springhill Textile Ab- GAW24-46 img.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 3028	2368	Springhill Textile Ab- GAW24-46 img.exe	28
PID 2368 wrote to memory of 3028	2368	Springhill Textile Ab- GAW24-46 img.exe	28
PID 2368 wrote to memory of 3028	2368	Springhill Textile Ab- GAW24-46 img.exe	28
PID 2368 wrote to memory of 3028	2368	Springhill Textile Ab- GAW24-46 img.exe	28
PID 2368 wrote to memory of 3028	2368	Springhill Textile Ab- GAW24-46 img.exe	28
PID 2368 wrote to memory of 3028	2368	Springhill Textile Ab- GAW24-46 img.exe	28
PID 2368 wrote to memory of 3028	2368	Springhill Textile Ab- GAW24-46 img.exe	28

C:\Users\Admin\AppData\Local\Temp\Springhill Textile Ab- GAW24-46 img.exe
"C:\Users\Admin\AppData\Local\Temp\Springhill Textile Ab- GAW24-46 img.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
  2⤵
  PID:3028

memory/2368-0-0x0000000000180000-0x00000000001BE000-memory.dmp

Filesize
248KB

Download
memory/2368-1-0x000007FEF6210000-0x000007FEF6BFC000-memory.dmp

Filesize
9.9MB

Download
memory/2368-2-0x00000000020A0000-0x0000000002120000-memory.dmp

Filesize
512KB

Download
memory/2368-3-0x000000001AD30000-0x000000001ADFC000-memory.dmp

Filesize
816KB

Download
memory/2368-10-0x000007FEF6210000-0x000007FEF6BFC000-memory.dmp

Filesize
9.9MB

Download
memory/2368-11-0x00000000020A0000-0x0000000002120000-memory.dmp

Filesize
512KB

Download
memory/3028-4-0x0000000000400000-0x0000000000476000-memory.dmp

Filesize
472KB

Download
memory/3028-5-0x0000000000400000-0x0000000000476000-memory.dmp

Filesize
472KB

Download
memory/3028-6-0x0000000000400000-0x0000000000476000-memory.dmp

Filesize
472KB

Download
memory/3028-8-0x0000000000400000-0x0000000000476000-memory.dmp

Filesize
472KB

Download