agenttesla | 28fc24022fa2071443e9dd16f85261f76cf27d6a7ac89fd8e93a2f349ccd250c

Analysis

max time kernel
61s
max time network
149s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
11-07-2024 01:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

28fc24022fa2071443e9dd16f85261f76cf27d6a7ac89fd8e93a2f349ccd250c.exe
Size

67KB
MD5

1b1e897906433a078f95d52051443c15
SHA1

305ee07245f1de1525f9379374250d695e487a4e
SHA256

28fc24022fa2071443e9dd16f85261f76cf27d6a7ac89fd8e93a2f349ccd250c
SHA512

9a33d9300479c7a631ea84e16814091de3257f6495a8f0a4713119de3b4c2b70a02ddff4e2d6e4aa09665828aa019ab0e91d1d450f066d3ab735751ab795e34b
SSDEEP

1536:FWffnB8k6Z7f4wpKPKoM220M64IBJKwXg32CZikQ3mVKJchjDK4bpr:FWXEZ1pmzPMrIBDg62VKJc5W4bd

Score

10^/10

agenttesla purelogstealer keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
investms.vadavo.cloud
Port:
587
Username:
[email protected]
Password:
emp@GnVg+%sS},OW
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
PureLog Stealer
PureLog Stealer is an infostealer written in C#.
stealer purelogstealer

PureLog Stealer payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1612-1-0x0000000001040000-0x0000000001058000-memory.dmp	family_purelog_stealer

Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

9 ip-api.com
7 api.ipify.org
8 api.ipify.org

flow	ioc
9	ip-api.com
7	api.ipify.org
8	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

Processes:

28fc24022fa2071443e9dd16f85261f76cf27d6a7ac89fd8e93a2f349ccd250c.exe

description	pid	process	target process
PID 1612 set thread context of 3356	1612	28fc24022fa2071443e9dd16f85261f76cf27d6a7ac89fd8e93a2f349ccd250c.exe	aspnet_compiler.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

aspnet_compiler.exe

pid process

3356 aspnet_compiler.exe
3356 aspnet_compiler.exe

pid	process
3356	aspnet_compiler.exe
3356	aspnet_compiler.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

28fc24022fa2071443e9dd16f85261f76cf27d6a7ac89fd8e93a2f349ccd250c.exeaspnet_compiler.exe

description	pid	process
Token: SeDebugPrivilege	1612	28fc24022fa2071443e9dd16f85261f76cf27d6a7ac89fd8e93a2f349ccd250c.exe
Token: SeDebugPrivilege	1612	28fc24022fa2071443e9dd16f85261f76cf27d6a7ac89fd8e93a2f349ccd250c.exe
Token: SeDebugPrivilege	3356	aspnet_compiler.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

aspnet_compiler.exe

pid process

3356 aspnet_compiler.exe

pid	process
3356	aspnet_compiler.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

28fc24022fa2071443e9dd16f85261f76cf27d6a7ac89fd8e93a2f349ccd250c.exe

description	pid	process	target process
PID 1612 wrote to memory of 3356	1612	28fc24022fa2071443e9dd16f85261f76cf27d6a7ac89fd8e93a2f349ccd250c.exe	aspnet_compiler.exe
PID 1612 wrote to memory of 3356	1612	28fc24022fa2071443e9dd16f85261f76cf27d6a7ac89fd8e93a2f349ccd250c.exe	aspnet_compiler.exe
PID 1612 wrote to memory of 3356	1612	28fc24022fa2071443e9dd16f85261f76cf27d6a7ac89fd8e93a2f349ccd250c.exe	aspnet_compiler.exe
PID 1612 wrote to memory of 3356	1612	28fc24022fa2071443e9dd16f85261f76cf27d6a7ac89fd8e93a2f349ccd250c.exe	aspnet_compiler.exe
PID 1612 wrote to memory of 3356	1612	28fc24022fa2071443e9dd16f85261f76cf27d6a7ac89fd8e93a2f349ccd250c.exe	aspnet_compiler.exe
PID 1612 wrote to memory of 3356	1612	28fc24022fa2071443e9dd16f85261f76cf27d6a7ac89fd8e93a2f349ccd250c.exe	aspnet_compiler.exe
PID 1612 wrote to memory of 3356	1612	28fc24022fa2071443e9dd16f85261f76cf27d6a7ac89fd8e93a2f349ccd250c.exe	aspnet_compiler.exe
PID 1612 wrote to memory of 3356	1612	28fc24022fa2071443e9dd16f85261f76cf27d6a7ac89fd8e93a2f349ccd250c.exe	aspnet_compiler.exe
PID 1612 wrote to memory of 3356	1612	28fc24022fa2071443e9dd16f85261f76cf27d6a7ac89fd8e93a2f349ccd250c.exe	aspnet_compiler.exe

C:\Users\Admin\AppData\Local\Temp\28fc24022fa2071443e9dd16f85261f76cf27d6a7ac89fd8e93a2f349ccd250c.exe
"C:\Users\Admin\AppData\Local\Temp\28fc24022fa2071443e9dd16f85261f76cf27d6a7ac89fd8e93a2f349ccd250c.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:3356

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1612-46-0x0000000006280000-0x00000000064AA000-memory.dmp

Filesize
2.2MB

Download
memory/1612-10-0x0000000006280000-0x00000000064AA000-memory.dmp

Filesize
2.2MB

Download
memory/1612-2-0x0000000000350000-0x0000000000358000-memory.dmp

Filesize
32KB

Download
memory/1612-3-0x0000000074250000-0x000000007493E000-memory.dmp

Filesize
6.9MB

Download
memory/1612-4-0x0000000006280000-0x00000000064B0000-memory.dmp

Filesize
2.2MB

Download
memory/1612-5-0x0000000006280000-0x00000000064AA000-memory.dmp

Filesize
2.2MB

Download
memory/1612-20-0x0000000006280000-0x00000000064AA000-memory.dmp

Filesize
2.2MB

Download
memory/1612-12-0x0000000006280000-0x00000000064AA000-memory.dmp

Filesize
2.2MB

Download
memory/1612-6-0x0000000006280000-0x00000000064AA000-memory.dmp

Filesize
2.2MB

Download
memory/1612-16-0x0000000006280000-0x00000000064AA000-memory.dmp

Filesize
2.2MB

Download
memory/1612-14-0x0000000006280000-0x00000000064AA000-memory.dmp

Filesize
2.2MB

Download
memory/1612-18-0x0000000006280000-0x00000000064AA000-memory.dmp

Filesize
2.2MB

Download
memory/1612-26-0x0000000006280000-0x00000000064AA000-memory.dmp

Filesize
2.2MB

Download
memory/1612-36-0x0000000006280000-0x00000000064AA000-memory.dmp

Filesize
2.2MB

Download
memory/1612-44-0x0000000006280000-0x00000000064AA000-memory.dmp

Filesize
2.2MB

Download
memory/1612-42-0x0000000006280000-0x00000000064AA000-memory.dmp

Filesize
2.2MB

Download
memory/1612-40-0x0000000006280000-0x00000000064AA000-memory.dmp

Filesize
2.2MB

Download
memory/1612-38-0x0000000006280000-0x00000000064AA000-memory.dmp

Filesize
2.2MB

Download
memory/1612-34-0x0000000006280000-0x00000000064AA000-memory.dmp

Filesize
2.2MB

Download
memory/1612-32-0x0000000006280000-0x00000000064AA000-memory.dmp

Filesize
2.2MB

Download
memory/1612-0-0x000000007425E000-0x000000007425F000-memory.dmp

Filesize
4KB

Download
memory/1612-28-0x0000000006280000-0x00000000064AA000-memory.dmp

Filesize
2.2MB

Download
memory/1612-24-0x0000000006280000-0x00000000064AA000-memory.dmp

Filesize
2.2MB

Download
memory/1612-22-0x0000000006280000-0x00000000064AA000-memory.dmp

Filesize
2.2MB

Download
memory/1612-30-0x0000000006280000-0x00000000064AA000-memory.dmp

Filesize
2.2MB

Download
memory/1612-1-0x0000000001040000-0x0000000001058000-memory.dmp

Filesize
96KB

Download
memory/1612-8-0x0000000006280000-0x00000000064AA000-memory.dmp

Filesize
2.2MB

Download
memory/1612-48-0x0000000006280000-0x00000000064AA000-memory.dmp

Filesize
2.2MB

Download
memory/1612-50-0x0000000006280000-0x00000000064AA000-memory.dmp

Filesize
2.2MB

Download
memory/1612-52-0x0000000006280000-0x00000000064AA000-memory.dmp

Filesize
2.2MB

Download
memory/1612-54-0x0000000006280000-0x00000000064AA000-memory.dmp

Filesize
2.2MB

Download
memory/1612-56-0x0000000006280000-0x00000000064AA000-memory.dmp

Filesize
2.2MB

Download
memory/1612-58-0x0000000006280000-0x00000000064AA000-memory.dmp

Filesize
2.2MB

Download
memory/1612-60-0x0000000006280000-0x00000000064AA000-memory.dmp

Filesize
2.2MB

Download
memory/1612-62-0x0000000006280000-0x00000000064AA000-memory.dmp

Filesize
2.2MB

Download
memory/1612-64-0x0000000006280000-0x00000000064AA000-memory.dmp

Filesize
2.2MB

Download
memory/1612-66-0x0000000006280000-0x00000000064AA000-memory.dmp

Filesize
2.2MB

Download
memory/1612-68-0x0000000006280000-0x00000000064AA000-memory.dmp

Filesize
2.2MB

Download
memory/1612-4868-0x00000000055D0000-0x000000000561C000-memory.dmp

Filesize
304KB

Download
memory/1612-4867-0x0000000004E10000-0x0000000004E7C000-memory.dmp

Filesize
432KB

Download
memory/1612-4869-0x0000000074250000-0x000000007493E000-memory.dmp

Filesize
6.9MB

Download
memory/1612-4870-0x000000007425E000-0x000000007425F000-memory.dmp

Filesize
4KB

Download
memory/1612-4871-0x0000000074250000-0x000000007493E000-memory.dmp

Filesize
6.9MB

Download
memory/1612-4872-0x0000000004E80000-0x0000000004ED4000-memory.dmp

Filesize
336KB

Download
memory/1612-4884-0x0000000074250000-0x000000007493E000-memory.dmp

Filesize
6.9MB

Download
memory/3356-4885-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3356-4886-0x0000000074250000-0x000000007493E000-memory.dmp

Filesize
6.9MB

Download
memory/3356-4887-0x0000000074250000-0x000000007493E000-memory.dmp

Filesize
6.9MB

Download
memory/3356-4888-0x0000000074250000-0x000000007493E000-memory.dmp

Filesize
6.9MB

Download