agenttesla | 7c8aaa88dd30f1b0301e3aaf0da58cdea2dfa56c0eb3b35b68123ecdefdf59e9

Analysis

max time kernel
118s
max time network
125s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
01/11/2023, 15:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

47d09683fc102a85a7dea2516ca81fa3.exe
Size

760KB
MD5

47d09683fc102a85a7dea2516ca81fa3
SHA1

f64cc824abd8804458c3f31f06c16d0bec9338dd
SHA256

848ce511daf9046ab1ab3bed080d5c20bdeb3fd0bebc016fc3af70b892ebb5c9
SHA512

eccff33ade27412be147d7f792ec150f79f0fba322cbf4a2befb46f615a71c578bd15c324c579fdbb9c377f221679cf4a04575c9f8f4814841346a244e80a2a6
SSDEEP

12288:Ro7VntzJOQX040txZp8sNx2HExIWtWrnngnnnKnanxNY:u104SgWtWrnngnnnKnanxN

Score

10^/10

agenttesla purecrypter collection downloader keylogger loader persistence spyware stealer trojan

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
mail.metalindus.cl
Port:
587
Username:
[email protected]
Password:
metalindus_2019

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.metalindus.cl
Port:
587
Username:
[email protected]
Password:
metalindus_2019
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Detect PureCrypter injector 1 IoCs

loader

resource	yara_rule
behavioral23/memory/2428-3-0x0000000004DB0000-0x0000000004E1C000-memory.dmp	family_purecrypter

PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
loader downloader purecrypter

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key opened	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key opened	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Windows\CurrentVersion\Run\Tyovqojh = "\"C:\\Users\\Admin\\AppData\\Roaming\\Iqbhgo\\Tyovqojh.exe\""	47d09683fc102a85a7dea2516ca81fa3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Windows\CurrentVersion\Run\microsoft = "C:\\Users\\Admin\\AppData\\Roaming\\microsoft\\microsoft.exe"	MSBuild.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2428 set thread context of 1336	2428	47d09683fc102a85a7dea2516ca81fa3.exe	90

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 20 IoCs

evasion

pid	Process
2648	timeout.exe
2516	timeout.exe
2696	timeout.exe
2736	timeout.exe
2668	timeout.exe
2584	timeout.exe
1840	timeout.exe
1740	timeout.exe
2172	timeout.exe
2960	timeout.exe
2240	timeout.exe
1332	timeout.exe
644	timeout.exe
1984	timeout.exe
2912	timeout.exe
3056	timeout.exe
2608	timeout.exe
2632	timeout.exe
912	timeout.exe
1560	timeout.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2428	47d09683fc102a85a7dea2516ca81fa3.exe
2428	47d09683fc102a85a7dea2516ca81fa3.exe
1336	MSBuild.exe
1336	MSBuild.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2428	47d09683fc102a85a7dea2516ca81fa3.exe
Token: SeDebugPrivilege	1336	MSBuild.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1336	MSBuild.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2428 wrote to memory of 2256	2428	47d09683fc102a85a7dea2516ca81fa3.exe	28
PID 2428 wrote to memory of 2256	2428	47d09683fc102a85a7dea2516ca81fa3.exe	28
PID 2428 wrote to memory of 2256	2428	47d09683fc102a85a7dea2516ca81fa3.exe	28
PID 2428 wrote to memory of 2256	2428	47d09683fc102a85a7dea2516ca81fa3.exe	28
PID 2256 wrote to memory of 2172	2256	cmd.exe	30
PID 2256 wrote to memory of 2172	2256	cmd.exe	30
PID 2256 wrote to memory of 2172	2256	cmd.exe	30
PID 2256 wrote to memory of 2172	2256	cmd.exe	30
PID 2428 wrote to memory of 2212	2428	47d09683fc102a85a7dea2516ca81fa3.exe	31
PID 2428 wrote to memory of 2212	2428	47d09683fc102a85a7dea2516ca81fa3.exe	31
PID 2428 wrote to memory of 2212	2428	47d09683fc102a85a7dea2516ca81fa3.exe	31
PID 2428 wrote to memory of 2212	2428	47d09683fc102a85a7dea2516ca81fa3.exe	31
PID 2212 wrote to memory of 2960	2212	cmd.exe	33
PID 2212 wrote to memory of 2960	2212	cmd.exe	33
PID 2212 wrote to memory of 2960	2212	cmd.exe	33
PID 2212 wrote to memory of 2960	2212	cmd.exe	33
PID 2428 wrote to memory of 2228	2428	47d09683fc102a85a7dea2516ca81fa3.exe	34
PID 2428 wrote to memory of 2228	2428	47d09683fc102a85a7dea2516ca81fa3.exe	34
PID 2428 wrote to memory of 2228	2428	47d09683fc102a85a7dea2516ca81fa3.exe	34
PID 2428 wrote to memory of 2228	2428	47d09683fc102a85a7dea2516ca81fa3.exe	34
PID 2228 wrote to memory of 2240	2228	cmd.exe	36
PID 2228 wrote to memory of 2240	2228	cmd.exe	36
PID 2228 wrote to memory of 2240	2228	cmd.exe	36
PID 2228 wrote to memory of 2240	2228	cmd.exe	36
PID 2428 wrote to memory of 3036	2428	47d09683fc102a85a7dea2516ca81fa3.exe	37
PID 2428 wrote to memory of 3036	2428	47d09683fc102a85a7dea2516ca81fa3.exe	37
PID 2428 wrote to memory of 3036	2428	47d09683fc102a85a7dea2516ca81fa3.exe	37
PID 2428 wrote to memory of 3036	2428	47d09683fc102a85a7dea2516ca81fa3.exe	37
PID 3036 wrote to memory of 2912	3036	cmd.exe	39
PID 3036 wrote to memory of 2912	3036	cmd.exe	39
PID 3036 wrote to memory of 2912	3036	cmd.exe	39
PID 3036 wrote to memory of 2912	3036	cmd.exe	39
PID 2428 wrote to memory of 2840	2428	47d09683fc102a85a7dea2516ca81fa3.exe	40
PID 2428 wrote to memory of 2840	2428	47d09683fc102a85a7dea2516ca81fa3.exe	40
PID 2428 wrote to memory of 2840	2428	47d09683fc102a85a7dea2516ca81fa3.exe	40
PID 2428 wrote to memory of 2840	2428	47d09683fc102a85a7dea2516ca81fa3.exe	40
PID 2840 wrote to memory of 3056	2840	cmd.exe	42
PID 2840 wrote to memory of 3056	2840	cmd.exe	42
PID 2840 wrote to memory of 3056	2840	cmd.exe	42
PID 2840 wrote to memory of 3056	2840	cmd.exe	42
PID 2428 wrote to memory of 2600	2428	47d09683fc102a85a7dea2516ca81fa3.exe	43
PID 2428 wrote to memory of 2600	2428	47d09683fc102a85a7dea2516ca81fa3.exe	43
PID 2428 wrote to memory of 2600	2428	47d09683fc102a85a7dea2516ca81fa3.exe	43
PID 2428 wrote to memory of 2600	2428	47d09683fc102a85a7dea2516ca81fa3.exe	43
PID 2600 wrote to memory of 2648	2600	cmd.exe	45
PID 2600 wrote to memory of 2648	2600	cmd.exe	45
PID 2600 wrote to memory of 2648	2600	cmd.exe	45
PID 2600 wrote to memory of 2648	2600	cmd.exe	45
PID 2428 wrote to memory of 2712	2428	47d09683fc102a85a7dea2516ca81fa3.exe	46
PID 2428 wrote to memory of 2712	2428	47d09683fc102a85a7dea2516ca81fa3.exe	46
PID 2428 wrote to memory of 2712	2428	47d09683fc102a85a7dea2516ca81fa3.exe	46
PID 2428 wrote to memory of 2712	2428	47d09683fc102a85a7dea2516ca81fa3.exe	46
PID 2712 wrote to memory of 2736	2712	cmd.exe	48
PID 2712 wrote to memory of 2736	2712	cmd.exe	48
PID 2712 wrote to memory of 2736	2712	cmd.exe	48
PID 2712 wrote to memory of 2736	2712	cmd.exe	48
PID 2428 wrote to memory of 2716	2428	47d09683fc102a85a7dea2516ca81fa3.exe	49
PID 2428 wrote to memory of 2716	2428	47d09683fc102a85a7dea2516ca81fa3.exe	49
PID 2428 wrote to memory of 2716	2428	47d09683fc102a85a7dea2516ca81fa3.exe	49
PID 2428 wrote to memory of 2716	2428	47d09683fc102a85a7dea2516ca81fa3.exe	49
PID 2716 wrote to memory of 2632	2716	cmd.exe	51
PID 2716 wrote to memory of 2632	2716	cmd.exe	51
PID 2716 wrote to memory of 2632	2716	cmd.exe	51
PID 2716 wrote to memory of 2632	2716	cmd.exe	51

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe

C:\Users\Admin\AppData\Local\Temp\47d09683fc102a85a7dea2516ca81fa3.exe
"C:\Users\Admin\AppData\Local\Temp\47d09683fc102a85a7dea2516ca81fa3.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2428
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c timeout /t 1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2256
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:2172
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c timeout /t 1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2212
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:2960
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c timeout /t 1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2228
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:2240
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c timeout /t 1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3036
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:2912
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c timeout /t 1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2840
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:3056
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c timeout /t 1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2600
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:2648
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c timeout /t 1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2712
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:2736
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c timeout /t 1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2716
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:2632
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c timeout /t 1
  2⤵
  PID:2448
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:2516
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c timeout /t 1
  2⤵
  PID:832
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:2668
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c timeout /t 1
  2⤵
  PID:2676
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:2608
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c timeout /t 1
  2⤵
  PID:2644
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:2696
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c timeout /t 1
  2⤵
  PID:2504
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:2584
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c timeout /t 1
  2⤵
  PID:2488
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:1840
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c timeout /t 1
  2⤵
  PID:528
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:1740
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c timeout /t 1
  2⤵
  PID:2476
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:912
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c timeout /t 1
  2⤵
  PID:1704
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:1984
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c timeout /t 1
  2⤵
  PID:1172
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:1332
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c timeout /t 1
  2⤵
  PID:2204
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:644
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c timeout /t 1
  2⤵
  PID:2464
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:1560
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  2⤵
  - Accesses Microsoft Outlook profiles
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - outlook_office_path
  - outlook_win_path
  PID:1336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dbaa62192efadf8ed5213b4525462dd3

SHA1
732b14c1bb482f14105632ab0d7275e8c37e581a

SHA256
f627d397234573929e49003c270f983e1983e13b8da8f6e6017895fa778e9103

SHA512
089656199a5f836f0a76e564f34d56052b0a064eff28117ac26f6eacb0c2078a9d9895f9ae2f35d90e42233584dfcb65b9b014b63b3ac8cd97d625e5f7d633be

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1EC9.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1F39.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit
memory/1336-15-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1336-18-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1336-92-0x0000000005020000-0x0000000005060000-memory.dmp

Filesize
256KB

Download
memory/1336-91-0x0000000005020000-0x0000000005060000-memory.dmp

Filesize
256KB

Download
memory/1336-8-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1336-9-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1336-10-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1336-12-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1336-14-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/1336-90-0x0000000005020000-0x0000000005060000-memory.dmp

Filesize
256KB

Download
memory/1336-89-0x0000000073820000-0x0000000073F0E000-memory.dmp

Filesize
6.9MB

Download
memory/1336-22-0x0000000005020000-0x0000000005060000-memory.dmp

Filesize
256KB

Download
memory/1336-20-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1336-21-0x0000000073820000-0x0000000073F0E000-memory.dmp

Filesize
6.9MB

Download
memory/2428-4-0x0000000004AE0000-0x0000000004B20000-memory.dmp

Filesize
256KB

Download
memory/2428-3-0x0000000004DB0000-0x0000000004E1C000-memory.dmp

Filesize
432KB

Download
memory/2428-2-0x0000000073F10000-0x00000000745FE000-memory.dmp

Filesize
6.9MB

Download
memory/2428-1-0x0000000073F10000-0x00000000745FE000-memory.dmp

Filesize
6.9MB

Download
memory/2428-17-0x0000000073F10000-0x00000000745FE000-memory.dmp

Filesize
6.9MB

Download
memory/2428-0-0x0000000000C60000-0x0000000000D24000-memory.dmp

Filesize
784KB

Download
memory/2428-6-0x0000000000240000-0x000000000028C000-memory.dmp

Filesize
304KB

Download
memory/2428-5-0x0000000000200000-0x0000000000242000-memory.dmp

Filesize
264KB

Download