agenttesla | 0a840e0d003dbbe94510ba7ce6db2c41e5bcdbe4d8dfcb8f1a8b0f15d710419d

General

Target

rvjgwbak.exe
Size

209KB
MD5

dafb5f90a7e12d6c989b1b3be1ff45f4
SHA1

f52402ea9c8a6fefb872ce51a2fdfbbc212225b5
SHA256

0a840e0d003dbbe94510ba7ce6db2c41e5bcdbe4d8dfcb8f1a8b0f15d710419d
SHA512

137ed2f3c0786f83731069eef0cb38643d268040065d3a3b5d5a0ddf9da32ca9bc1d58916ee2b4f6179e9c328f7ecc810aa9a94523b2d8c63a15a39fe8203635

Score

10^/10

agenttesla purecrypter keylogger loader spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.mudanzasdistintas.com.ar
Port:
587
Username:
[email protected]
Password:
icui4cu2@@??
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Detect PureCrypter loader 1 IoCs

loader

resource	yara_rule
behavioral1/memory/632-56-0x0000000004F50000-0x0000000004FB0000-memory.dmp	family_purecrypter

PureCrypter
PureCrypter is a loader which is intended for downloading and executing additional payloads.
trojan loader purecrypter

AgentTesla Payload 6 IoCs

resource	yara_rule
behavioral1/memory/1700-64-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1700-63-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1700-65-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1700-66-0x0000000000436E0E-mapping.dmp	family_agenttesla
behavioral1/memory/1700-68-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1700-70-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 632 set thread context of 1700	632	rvjgwbak.exe	29

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
2044	timeout.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
632	rvjgwbak.exe
1700	MSBuild.exe
1700	MSBuild.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	632	rvjgwbak.exe
Token: SeDebugPrivilege	1700	MSBuild.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 632 wrote to memory of 1252	632	rvjgwbak.exe	26
PID 632 wrote to memory of 1252	632	rvjgwbak.exe	26
PID 632 wrote to memory of 1252	632	rvjgwbak.exe	26
PID 632 wrote to memory of 1252	632	rvjgwbak.exe	26
PID 1252 wrote to memory of 2044	1252	cmd.exe	28
PID 1252 wrote to memory of 2044	1252	cmd.exe	28
PID 1252 wrote to memory of 2044	1252	cmd.exe	28
PID 1252 wrote to memory of 2044	1252	cmd.exe	28
PID 632 wrote to memory of 1700	632	rvjgwbak.exe	29
PID 632 wrote to memory of 1700	632	rvjgwbak.exe	29
PID 632 wrote to memory of 1700	632	rvjgwbak.exe	29
PID 632 wrote to memory of 1700	632	rvjgwbak.exe	29
PID 632 wrote to memory of 1700	632	rvjgwbak.exe	29
PID 632 wrote to memory of 1700	632	rvjgwbak.exe	29
PID 632 wrote to memory of 1700	632	rvjgwbak.exe	29
PID 632 wrote to memory of 1700	632	rvjgwbak.exe	29
PID 632 wrote to memory of 1700	632	rvjgwbak.exe	29

C:\Users\Admin\AppData\Local\Temp\rvjgwbak.exe
"C:\Users\Admin\AppData\Local\Temp\rvjgwbak.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:632
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c timeout 20
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1252
- - C:\Windows\SysWOW64\timeout.exe
    timeout 20
    3⤵
    - Delays execution with timeout.exe
    PID:2044
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1700

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/632-54-0x0000000000A70000-0x0000000000AAA000-memory.dmp

Filesize
232KB

Download
memory/632-55-0x0000000075391000-0x0000000075393000-memory.dmp

Filesize
8KB

Download
memory/632-56-0x0000000004F50000-0x0000000004FB0000-memory.dmp

Filesize
384KB

Download
memory/632-57-0x0000000005380000-0x00000000053CC000-memory.dmp

Filesize
304KB

Download
memory/1700-60-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1700-61-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1700-64-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1700-63-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1700-65-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1700-68-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1700-70-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download

Analysis

Sharing