agenttesla | c5cb02082fc5df46b664578c2e049882a10fbd6be805ed345f8699e109fa8d1d

General

Target

ZAMÓWIENIE_DR-5-33499_pdf.exe
Size

16KB
MD5

de19e80d4eb300de7498fd561a9b7e02
SHA1

d8abc5d5e011a5e27462d26e1a04e824a2c6c6ef
SHA256

c5cb02082fc5df46b664578c2e049882a10fbd6be805ed345f8699e109fa8d1d
SHA512

90b7da873e409602321bac44627db55cd3e35dce6374de5514697127734060527776153d59b28abffd2852545ce829dc2b4deff92508c1456016106d3973ed9b
SSDEEP

96:kyH1vt86ZcAP9G/15ugGkXRVsAmdEL0dkLUdEL0d6Ddhk8v1/zNt:k8/5Pw/15LrX0Ami4CYi4Mn

Score

10^/10

agenttesla purecrypter collection downloader keylogger loader spyware stealer trojan

Malware Config

Extracted

Family

purecrypter

C2

http://45.84.1.117/3477/Ptstngx.bmp

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot5846767138:AAHbrIUF1epdWlFQ2_64LCd8vdF121y1XGE/

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
loader downloader purecrypter
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	ZAMÓWIENIE_DR-5-33499_pdf.exe
Key opened	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	ZAMÓWIENIE_DR-5-33499_pdf.exe
Key opened	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	ZAMÓWIENIE_DR-5-33499_pdf.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	api.ipify.org
5	api.ipify.org

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1136	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1652	ZAMÓWIENIE_DR-5-33499_pdf.exe
Token: SeDebugPrivilege	1136	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1652 wrote to memory of 1136	1652	ZAMÓWIENIE_DR-5-33499_pdf.exe	27
PID 1652 wrote to memory of 1136	1652	ZAMÓWIENIE_DR-5-33499_pdf.exe	27
PID 1652 wrote to memory of 1136	1652	ZAMÓWIENIE_DR-5-33499_pdf.exe	27
PID 1652 wrote to memory of 1136	1652	ZAMÓWIENIE_DR-5-33499_pdf.exe	27

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	ZAMÓWIENIE_DR-5-33499_pdf.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	ZAMÓWIENIE_DR-5-33499_pdf.exe

C:\Users\Admin\AppData\Local\Temp\ZAMÓWIENIE_DR-5-33499_pdf.exe
"C:\Users\Admin\AppData\Local\Temp\ZAMÓWIENIE_DR-5-33499_pdf.exe"
1⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:1652
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA==
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1136

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1136-60-0x000000006E350000-0x000000006E8FB000-memory.dmp

Filesize
5.7MB

Download
memory/1136-61-0x000000006E350000-0x000000006E8FB000-memory.dmp

Filesize
5.7MB

Download
memory/1136-62-0x000000006E350000-0x000000006E8FB000-memory.dmp

Filesize
5.7MB

Download
memory/1652-54-0x0000000000920000-0x000000000092A000-memory.dmp

Filesize
40KB

Download
memory/1652-55-0x00000000757A1000-0x00000000757A3000-memory.dmp

Filesize
8KB

Download
memory/1652-56-0x0000000005F30000-0x0000000005FE4000-memory.dmp

Filesize
720KB

Download
memory/1652-57-0x00000000004D0000-0x00000000004EA000-memory.dmp

Filesize
104KB

Download
memory/1652-63-0x00000000046C0000-0x00000000046F0000-memory.dmp

Filesize
192KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads