Analysis
- max time kernel
139s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20231127-en - resource tags
- submitted
02/12/2023, 09:37
General
- Target b63c7c8967a492c0c2a30d0b0d4694cfa693b1a1b6db3d7498d4d526889ecc44.exe
- Size 416KB
- Sample231202-llx19sbe59
- SHA256 b63c7c8967a492c0c2a30d0b0d4694cfa693b1a1b6db3d7498d4d526889ecc44
Malware Config
Extracted
-
agenttesla
-
Protocol
smtp
-
Host
smtp.rapltorsupplies.com
-
Port
587
-
Username
-
Password
JG%xlMm6
-
Email to
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Detect PureLogs payload 1 IoCs
- PureLogs
PureLogs is an infostealer written in C#.
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b63c7c8967a492c0c2a30d0b0d4694cfa693b1a1b6db3d7498d4d526889ecc44.exe"C:\Users\Admin\AppData\Local\Temp\b63c7c8967a492c0c2a30d0b0d4694cfa693b1a1b6db3d7498d4d526889ecc44.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe2⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4348-16-0x00000000064C0000-0x0000000006552000-memory.dmp
memory/4348-17-0x0000000006650000-0x000000000665A000-memory.dmp
memory/4348-21-0x00000000053A0000-0x00000000053B0000-memory.dmp
memory/4348-20-0x0000000075180000-0x0000000075930000-memory.dmp
memory/4348-19-0x0000000006930000-0x0000000006AF2000-memory.dmp
memory/4348-18-0x0000000006670000-0x00000000066C0000-memory.dmp
memory/4348-15-0x0000000005220000-0x0000000005286000-memory.dmp
memory/4348-14-0x00000000053A0000-0x00000000053B0000-memory.dmp
memory/4348-10-0x0000000000400000-0x0000000000430000-memory.dmp
memory/4348-12-0x0000000075180000-0x0000000075930000-memory.dmp
memory/4448-1-0x0000000000FE0000-0x000000000104E000-memory.dmp
memory/4448-9-0x0000000006BD0000-0x0000000007174000-memory.dmp
memory/4448-8-0x0000000005980000-0x0000000005990000-memory.dmp
memory/4448-7-0x0000000075180000-0x0000000075930000-memory.dmp
memory/4448-6-0x0000000006590000-0x00000000065DC000-memory.dmp
memory/4448-0-0x0000000075180000-0x0000000075930000-memory.dmp
memory/4448-13-0x0000000075180000-0x0000000075930000-memory.dmp
memory/4448-5-0x0000000006550000-0x0000000006590000-memory.dmp
memory/4448-4-0x00000000064F0000-0x0000000006530000-memory.dmp
memory/4448-3-0x0000000006410000-0x0000000006468000-memory.dmp
memory/4448-2-0x0000000005980000-0x0000000005990000-memory.dmp