agenttesla | ec5d3735d3fbc85b1ba98cce0ecd8318c1dc0118d112b3c2e00cead058aa2db7

General

Target

Product list.scr
Size

261KB
MD5

740c71fa7480df0ca835b842c466d190
SHA1

a495afbf5175fb7c31d5bb79ab5bdefa5842ee40
SHA256

769e8c82f191a58829d7c5b460b80b6242a2f9b906c3a9b98e0b87fd83c88205
SHA512

28978c02bed5a684b724a0ec91f50d5e44f6baae7f860ad29d24f133a5b1693f7f4232bdfc1ef0babc79284d2ee8c4630b31370c5acee2243c49f7b33f3b23ea
SSDEEP

6144:iazT6ew3igBm7IGxRsS71IagwsUKl0zRcP8Ya:ian6emLBm7IGxRsSpsUKx8N

Score

10^/10

agenttesla purelogstealer zgrat keylogger rat spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.alualuminium.com.my
Port:
587
Username:
[email protected]
Password:
U8G4S13#8Zk$
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Detect ZGRat V1 34 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3344-4-0x0000000005970000-0x0000000005BA0000-memory.dmp	family_zgrat_v1
behavioral2/memory/3344-5-0x0000000005970000-0x0000000005B9B000-memory.dmp	family_zgrat_v1
behavioral2/memory/3344-8-0x0000000005970000-0x0000000005B9B000-memory.dmp	family_zgrat_v1
behavioral2/memory/3344-6-0x0000000005970000-0x0000000005B9B000-memory.dmp	family_zgrat_v1
behavioral2/memory/3344-10-0x0000000005970000-0x0000000005B9B000-memory.dmp	family_zgrat_v1
behavioral2/memory/3344-12-0x0000000005970000-0x0000000005B9B000-memory.dmp	family_zgrat_v1
behavioral2/memory/3344-14-0x0000000005970000-0x0000000005B9B000-memory.dmp	family_zgrat_v1
behavioral2/memory/3344-16-0x0000000005970000-0x0000000005B9B000-memory.dmp	family_zgrat_v1
behavioral2/memory/3344-18-0x0000000005970000-0x0000000005B9B000-memory.dmp	family_zgrat_v1
behavioral2/memory/3344-20-0x0000000005970000-0x0000000005B9B000-memory.dmp	family_zgrat_v1
behavioral2/memory/3344-22-0x0000000005970000-0x0000000005B9B000-memory.dmp	family_zgrat_v1
behavioral2/memory/3344-24-0x0000000005970000-0x0000000005B9B000-memory.dmp	family_zgrat_v1
behavioral2/memory/3344-26-0x0000000005970000-0x0000000005B9B000-memory.dmp	family_zgrat_v1
behavioral2/memory/3344-28-0x0000000005970000-0x0000000005B9B000-memory.dmp	family_zgrat_v1
behavioral2/memory/3344-30-0x0000000005970000-0x0000000005B9B000-memory.dmp	family_zgrat_v1
behavioral2/memory/3344-32-0x0000000005970000-0x0000000005B9B000-memory.dmp	family_zgrat_v1
behavioral2/memory/3344-34-0x0000000005970000-0x0000000005B9B000-memory.dmp	family_zgrat_v1
behavioral2/memory/3344-36-0x0000000005970000-0x0000000005B9B000-memory.dmp	family_zgrat_v1
behavioral2/memory/3344-38-0x0000000005970000-0x0000000005B9B000-memory.dmp	family_zgrat_v1
behavioral2/memory/3344-40-0x0000000005970000-0x0000000005B9B000-memory.dmp	family_zgrat_v1
behavioral2/memory/3344-42-0x0000000005970000-0x0000000005B9B000-memory.dmp	family_zgrat_v1
behavioral2/memory/3344-44-0x0000000005970000-0x0000000005B9B000-memory.dmp	family_zgrat_v1
behavioral2/memory/3344-46-0x0000000005970000-0x0000000005B9B000-memory.dmp	family_zgrat_v1
behavioral2/memory/3344-48-0x0000000005970000-0x0000000005B9B000-memory.dmp	family_zgrat_v1
behavioral2/memory/3344-50-0x0000000005970000-0x0000000005B9B000-memory.dmp	family_zgrat_v1
behavioral2/memory/3344-52-0x0000000005970000-0x0000000005B9B000-memory.dmp	family_zgrat_v1
behavioral2/memory/3344-54-0x0000000005970000-0x0000000005B9B000-memory.dmp	family_zgrat_v1
behavioral2/memory/3344-56-0x0000000005970000-0x0000000005B9B000-memory.dmp	family_zgrat_v1
behavioral2/memory/3344-58-0x0000000005970000-0x0000000005B9B000-memory.dmp	family_zgrat_v1
behavioral2/memory/3344-60-0x0000000005970000-0x0000000005B9B000-memory.dmp	family_zgrat_v1
behavioral2/memory/3344-62-0x0000000005970000-0x0000000005B9B000-memory.dmp	family_zgrat_v1
behavioral2/memory/3344-64-0x0000000005970000-0x0000000005B9B000-memory.dmp	family_zgrat_v1
behavioral2/memory/3344-66-0x0000000005970000-0x0000000005B9B000-memory.dmp	family_zgrat_v1
behavioral2/memory/3344-68-0x0000000005970000-0x0000000005B9B000-memory.dmp	family_zgrat_v1

PureLog Stealer
PureLog Stealer is an infostealer written in C#.
stealer purelogstealer

PureLog Stealer payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3344-0-0x00000000005F0000-0x0000000000636000-memory.dmp	family_purelog_stealer

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

36 api.ipify.org
37 api.ipify.org
38 ip-api.com
Suspicious use of SetThreadContext 1 IoCs

Processes:

Product list.scr

description pid process target process

PID 3344 set thread context of 4500 3344 Product list.scr MSBuild.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

MSBuild.exe

pid process

4500 MSBuild.exe
4500 MSBuild.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

Product list.scrMSBuild.exe

description pid process

Token: SeDebugPrivilege 3344 Product list.scr
Token: SeDebugPrivilege 3344 Product list.scr
Token: SeDebugPrivilege 4500 MSBuild.exe

flow	ioc
36	api.ipify.org
37	api.ipify.org
38	ip-api.com

description	pid	process	target process
PID 3344 set thread context of 4500	3344	Product list.scr	MSBuild.exe

pid	process
4500	MSBuild.exe
4500	MSBuild.exe

description	pid	process
Token: SeDebugPrivilege	3344	Product list.scr
Token: SeDebugPrivilege	3344	Product list.scr
Token: SeDebugPrivilege	4500	MSBuild.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

Product list.scr

description	pid	process	target process
PID 3344 wrote to memory of 4500	3344	Product list.scr	MSBuild.exe
PID 3344 wrote to memory of 4500	3344	Product list.scr	MSBuild.exe
PID 3344 wrote to memory of 4500	3344	Product list.scr	MSBuild.exe
PID 3344 wrote to memory of 4500	3344	Product list.scr	MSBuild.exe
PID 3344 wrote to memory of 4500	3344	Product list.scr	MSBuild.exe
PID 3344 wrote to memory of 4500	3344	Product list.scr	MSBuild.exe
PID 3344 wrote to memory of 4500	3344	Product list.scr	MSBuild.exe
PID 3344 wrote to memory of 4500	3344	Product list.scr	MSBuild.exe

C:\Users\Admin\AppData\Local\Temp\Product list.scr
"C:\Users\Admin\AppData\Local\Temp\Product list.scr" /S
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3344

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4500

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3344-0-0x00000000005F0000-0x0000000000636000-memory.dmp

Filesize
280KB

Download
memory/3344-1-0x0000000074960000-0x0000000075110000-memory.dmp

Filesize
7.7MB

Download
memory/3344-2-0x0000000005060000-0x0000000005070000-memory.dmp

Filesize
64KB

Download
memory/3344-3-0x0000000004F50000-0x0000000004F58000-memory.dmp

Filesize
32KB

Download
memory/3344-4-0x0000000005970000-0x0000000005BA0000-memory.dmp

Filesize
2.2MB

Download
memory/3344-5-0x0000000005970000-0x0000000005B9B000-memory.dmp

Filesize
2.2MB

Download
memory/3344-8-0x0000000005970000-0x0000000005B9B000-memory.dmp

Filesize
2.2MB

Download
memory/3344-6-0x0000000005970000-0x0000000005B9B000-memory.dmp

Filesize
2.2MB

Download
memory/3344-10-0x0000000005970000-0x0000000005B9B000-memory.dmp

Filesize
2.2MB

Download
memory/3344-12-0x0000000005970000-0x0000000005B9B000-memory.dmp

Filesize
2.2MB

Download
memory/3344-14-0x0000000005970000-0x0000000005B9B000-memory.dmp

Filesize
2.2MB

Download
memory/3344-16-0x0000000005970000-0x0000000005B9B000-memory.dmp

Filesize
2.2MB

Download
memory/3344-18-0x0000000005970000-0x0000000005B9B000-memory.dmp

Filesize
2.2MB

Download
memory/3344-20-0x0000000005970000-0x0000000005B9B000-memory.dmp

Filesize
2.2MB

Download
memory/3344-22-0x0000000005970000-0x0000000005B9B000-memory.dmp

Filesize
2.2MB

Download
memory/3344-24-0x0000000005970000-0x0000000005B9B000-memory.dmp

Filesize
2.2MB

Download
memory/3344-26-0x0000000005970000-0x0000000005B9B000-memory.dmp

Filesize
2.2MB

Download
memory/3344-28-0x0000000005970000-0x0000000005B9B000-memory.dmp

Filesize
2.2MB

Download
memory/3344-30-0x0000000005970000-0x0000000005B9B000-memory.dmp

Filesize
2.2MB

Download
memory/3344-32-0x0000000005970000-0x0000000005B9B000-memory.dmp

Filesize
2.2MB

Download
memory/3344-34-0x0000000005970000-0x0000000005B9B000-memory.dmp

Filesize
2.2MB

Download
memory/3344-36-0x0000000005970000-0x0000000005B9B000-memory.dmp

Filesize
2.2MB

Download
memory/3344-38-0x0000000005970000-0x0000000005B9B000-memory.dmp

Filesize
2.2MB

Download
memory/3344-40-0x0000000005970000-0x0000000005B9B000-memory.dmp

Filesize
2.2MB

Download
memory/3344-42-0x0000000005970000-0x0000000005B9B000-memory.dmp

Filesize
2.2MB

Download
memory/3344-44-0x0000000005970000-0x0000000005B9B000-memory.dmp

Filesize
2.2MB

Download
memory/3344-46-0x0000000005970000-0x0000000005B9B000-memory.dmp

Filesize
2.2MB

Download
memory/3344-48-0x0000000005970000-0x0000000005B9B000-memory.dmp

Filesize
2.2MB

Download
memory/3344-50-0x0000000005970000-0x0000000005B9B000-memory.dmp

Filesize
2.2MB

Download
memory/3344-52-0x0000000005970000-0x0000000005B9B000-memory.dmp

Filesize
2.2MB

Download
memory/3344-54-0x0000000005970000-0x0000000005B9B000-memory.dmp

Filesize
2.2MB

Download
memory/3344-56-0x0000000005970000-0x0000000005B9B000-memory.dmp

Filesize
2.2MB

Download
memory/3344-58-0x0000000005970000-0x0000000005B9B000-memory.dmp

Filesize
2.2MB

Download
memory/3344-60-0x0000000005970000-0x0000000005B9B000-memory.dmp

Filesize
2.2MB

Download
memory/3344-62-0x0000000005970000-0x0000000005B9B000-memory.dmp

Filesize
2.2MB

Download
memory/3344-64-0x0000000005970000-0x0000000005B9B000-memory.dmp

Filesize
2.2MB

Download
memory/3344-66-0x0000000005970000-0x0000000005B9B000-memory.dmp

Filesize
2.2MB

Download
memory/3344-68-0x0000000005970000-0x0000000005B9B000-memory.dmp

Filesize
2.2MB

Download
memory/3344-2941-0x0000000074960000-0x0000000075110000-memory.dmp

Filesize
7.7MB

Download
memory/3344-3314-0x0000000005060000-0x0000000005070000-memory.dmp

Filesize
64KB

Download
memory/3344-4887-0x0000000005C00000-0x0000000005C01000-memory.dmp

Filesize
4KB

Download
memory/3344-4888-0x0000000005E80000-0x0000000005EEC000-memory.dmp

Filesize
432KB

Download
memory/3344-4889-0x0000000005D70000-0x0000000005DBC000-memory.dmp

Filesize
304KB

Download
memory/3344-4890-0x0000000006690000-0x0000000006C34000-memory.dmp

Filesize
5.6MB

Download
memory/3344-4891-0x0000000005F60000-0x0000000005FB4000-memory.dmp

Filesize
336KB

Download
memory/3344-4894-0x0000000074960000-0x0000000075110000-memory.dmp

Filesize
7.7MB

Download
memory/4500-4896-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4500-4895-0x0000000074960000-0x0000000075110000-memory.dmp

Filesize
7.7MB

Download
memory/4500-4898-0x00000000053F0000-0x0000000005456000-memory.dmp

Filesize
408KB

Download
memory/4500-4897-0x0000000005210000-0x0000000005220000-memory.dmp

Filesize
64KB

Download
memory/4500-4899-0x00000000066E0000-0x0000000006730000-memory.dmp

Filesize
320KB

Download
memory/4500-4900-0x00000000067D0000-0x0000000006862000-memory.dmp

Filesize
584KB

Download
memory/4500-4901-0x0000000006760000-0x000000000676A000-memory.dmp

Filesize
40KB

Download
memory/4500-4902-0x0000000074960000-0x0000000075110000-memory.dmp

Filesize
7.7MB

Download
memory/4500-4903-0x0000000005210000-0x0000000005220000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads