agenttesla | 28fc24022fa2071443e9dd16f85261f76cf27d6a7ac89fd8e93a2f349ccd250c

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11-07-2024 01:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

28fc24022fa2071443e9dd16f85261f76cf27d6a7ac89fd8e93a2f349ccd250c.exe
Size

67KB
MD5

1b1e897906433a078f95d52051443c15
SHA1

305ee07245f1de1525f9379374250d695e487a4e
SHA256

28fc24022fa2071443e9dd16f85261f76cf27d6a7ac89fd8e93a2f349ccd250c
SHA512

9a33d9300479c7a631ea84e16814091de3257f6495a8f0a4713119de3b4c2b70a02ddff4e2d6e4aa09665828aa019ab0e91d1d450f066d3ab735751ab795e34b
SSDEEP

1536:FWffnB8k6Z7f4wpKPKoM220M64IBJKwXg32CZikQ3mVKJchjDK4bpr:FWXEZ1pmzPMrIBDg62VKJc5W4bd

Score

10^/10

agenttesla purelogstealer keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
investms.vadavo.cloud
Port:
587
Username:
[email protected]
Password:
emp@GnVg+%sS},OW
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
PureLog Stealer
PureLog Stealer is an infostealer written in C#.
stealer purelogstealer

PureLog Stealer payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4408-1-0x0000000000780000-0x0000000000798000-memory.dmp	family_purelog_stealer

Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

40 api.ipify.org
41 api.ipify.org
42 ip-api.com

flow	ioc
40	api.ipify.org
41	api.ipify.org
42	ip-api.com

Suspicious use of SetThreadContext 1 IoCs

Processes:

28fc24022fa2071443e9dd16f85261f76cf27d6a7ac89fd8e93a2f349ccd250c.exe

description	pid	process	target process
PID 4408 set thread context of 4896	4408	28fc24022fa2071443e9dd16f85261f76cf27d6a7ac89fd8e93a2f349ccd250c.exe	aspnet_compiler.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

aspnet_compiler.exe

pid process

4896 aspnet_compiler.exe
4896 aspnet_compiler.exe

pid	process
4896	aspnet_compiler.exe
4896	aspnet_compiler.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

28fc24022fa2071443e9dd16f85261f76cf27d6a7ac89fd8e93a2f349ccd250c.exeaspnet_compiler.exe

description	pid	process
Token: SeDebugPrivilege	4408	28fc24022fa2071443e9dd16f85261f76cf27d6a7ac89fd8e93a2f349ccd250c.exe
Token: SeDebugPrivilege	4408	28fc24022fa2071443e9dd16f85261f76cf27d6a7ac89fd8e93a2f349ccd250c.exe
Token: SeDebugPrivilege	4896	aspnet_compiler.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

aspnet_compiler.exe

pid process

4896 aspnet_compiler.exe

pid	process
4896	aspnet_compiler.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

28fc24022fa2071443e9dd16f85261f76cf27d6a7ac89fd8e93a2f349ccd250c.exe

description	pid	process	target process
PID 4408 wrote to memory of 4896	4408	28fc24022fa2071443e9dd16f85261f76cf27d6a7ac89fd8e93a2f349ccd250c.exe	aspnet_compiler.exe
PID 4408 wrote to memory of 4896	4408	28fc24022fa2071443e9dd16f85261f76cf27d6a7ac89fd8e93a2f349ccd250c.exe	aspnet_compiler.exe
PID 4408 wrote to memory of 4896	4408	28fc24022fa2071443e9dd16f85261f76cf27d6a7ac89fd8e93a2f349ccd250c.exe	aspnet_compiler.exe
PID 4408 wrote to memory of 4896	4408	28fc24022fa2071443e9dd16f85261f76cf27d6a7ac89fd8e93a2f349ccd250c.exe	aspnet_compiler.exe
PID 4408 wrote to memory of 4896	4408	28fc24022fa2071443e9dd16f85261f76cf27d6a7ac89fd8e93a2f349ccd250c.exe	aspnet_compiler.exe
PID 4408 wrote to memory of 4896	4408	28fc24022fa2071443e9dd16f85261f76cf27d6a7ac89fd8e93a2f349ccd250c.exe	aspnet_compiler.exe
PID 4408 wrote to memory of 4896	4408	28fc24022fa2071443e9dd16f85261f76cf27d6a7ac89fd8e93a2f349ccd250c.exe	aspnet_compiler.exe
PID 4408 wrote to memory of 4896	4408	28fc24022fa2071443e9dd16f85261f76cf27d6a7ac89fd8e93a2f349ccd250c.exe	aspnet_compiler.exe

C:\Users\Admin\AppData\Local\Temp\28fc24022fa2071443e9dd16f85261f76cf27d6a7ac89fd8e93a2f349ccd250c.exe
"C:\Users\Admin\AppData\Local\Temp\28fc24022fa2071443e9dd16f85261f76cf27d6a7ac89fd8e93a2f349ccd250c.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4408
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:4896

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4408-0-0x000000007503E000-0x000000007503F000-memory.dmp

Filesize
4KB

Download
memory/4408-1-0x0000000000780000-0x0000000000798000-memory.dmp

Filesize
96KB

Download
memory/4408-2-0x0000000005320000-0x0000000005328000-memory.dmp

Filesize
32KB

Download
memory/4408-3-0x0000000075030000-0x00000000757E0000-memory.dmp

Filesize
7.7MB

Download
memory/4408-4-0x0000000006430000-0x0000000006660000-memory.dmp

Filesize
2.2MB

Download
memory/4408-8-0x0000000006430000-0x000000000665A000-memory.dmp

Filesize
2.2MB

Download
memory/4408-12-0x0000000006430000-0x000000000665A000-memory.dmp

Filesize
2.2MB

Download
memory/4408-36-0x0000000006430000-0x000000000665A000-memory.dmp

Filesize
2.2MB

Download
memory/4408-22-0x0000000006430000-0x000000000665A000-memory.dmp

Filesize
2.2MB

Download
memory/4408-34-0x0000000006430000-0x000000000665A000-memory.dmp

Filesize
2.2MB

Download
memory/4408-38-0x0000000006430000-0x000000000665A000-memory.dmp

Filesize
2.2MB

Download
memory/4408-32-0x0000000006430000-0x000000000665A000-memory.dmp

Filesize
2.2MB

Download
memory/4408-30-0x0000000006430000-0x000000000665A000-memory.dmp

Filesize
2.2MB

Download
memory/4408-28-0x0000000006430000-0x000000000665A000-memory.dmp

Filesize
2.2MB

Download
memory/4408-26-0x0000000006430000-0x000000000665A000-memory.dmp

Filesize
2.2MB

Download
memory/4408-25-0x0000000006430000-0x000000000665A000-memory.dmp

Filesize
2.2MB

Download
memory/4408-20-0x0000000006430000-0x000000000665A000-memory.dmp

Filesize
2.2MB

Download
memory/4408-16-0x0000000006430000-0x000000000665A000-memory.dmp

Filesize
2.2MB

Download
memory/4408-14-0x0000000006430000-0x000000000665A000-memory.dmp

Filesize
2.2MB

Download
memory/4408-10-0x0000000006430000-0x000000000665A000-memory.dmp

Filesize
2.2MB

Download
memory/4408-18-0x0000000006430000-0x000000000665A000-memory.dmp

Filesize
2.2MB

Download
memory/4408-6-0x0000000006430000-0x000000000665A000-memory.dmp

Filesize
2.2MB

Download
memory/4408-5-0x0000000006430000-0x000000000665A000-memory.dmp

Filesize
2.2MB

Download
memory/4408-40-0x0000000006430000-0x000000000665A000-memory.dmp

Filesize
2.2MB

Download
memory/4408-62-0x0000000006430000-0x000000000665A000-memory.dmp

Filesize
2.2MB

Download
memory/4408-68-0x0000000006430000-0x000000000665A000-memory.dmp

Filesize
2.2MB

Download
memory/4408-67-0x0000000006430000-0x000000000665A000-memory.dmp

Filesize
2.2MB

Download
memory/4408-60-0x0000000006430000-0x000000000665A000-memory.dmp

Filesize
2.2MB

Download
memory/4408-59-0x0000000006430000-0x000000000665A000-memory.dmp

Filesize
2.2MB

Download
memory/4408-56-0x0000000006430000-0x000000000665A000-memory.dmp

Filesize
2.2MB

Download
memory/4408-54-0x0000000006430000-0x000000000665A000-memory.dmp

Filesize
2.2MB

Download
memory/4408-51-0x0000000006430000-0x000000000665A000-memory.dmp

Filesize
2.2MB

Download
memory/4408-48-0x0000000006430000-0x000000000665A000-memory.dmp

Filesize
2.2MB

Download
memory/4408-44-0x0000000006430000-0x000000000665A000-memory.dmp

Filesize
2.2MB

Download
memory/4408-42-0x0000000006430000-0x000000000665A000-memory.dmp

Filesize
2.2MB

Download
memory/4408-64-0x0000000006430000-0x000000000665A000-memory.dmp

Filesize
2.2MB

Download
memory/4408-52-0x0000000006430000-0x000000000665A000-memory.dmp

Filesize
2.2MB

Download
memory/4408-46-0x0000000006430000-0x000000000665A000-memory.dmp

Filesize
2.2MB

Download
memory/4408-4867-0x0000000075030000-0x00000000757E0000-memory.dmp

Filesize
7.7MB

Download
memory/4408-4868-0x0000000005B80000-0x0000000005BEC000-memory.dmp

Filesize
432KB

Download
memory/4408-4869-0x0000000005BF0000-0x0000000005C3C000-memory.dmp

Filesize
304KB

Download
memory/4408-4870-0x000000007503E000-0x000000007503F000-memory.dmp

Filesize
4KB

Download
memory/4408-4871-0x0000000075030000-0x00000000757E0000-memory.dmp

Filesize
7.7MB

Download
memory/4408-4872-0x0000000006E70000-0x0000000007414000-memory.dmp

Filesize
5.6MB

Download
memory/4408-4873-0x0000000000EE0000-0x0000000000F34000-memory.dmp

Filesize
336KB

Download
memory/4408-4877-0x0000000075030000-0x00000000757E0000-memory.dmp

Filesize
7.7MB

Download
memory/4896-4876-0x0000000075030000-0x00000000757E0000-memory.dmp

Filesize
7.7MB

Download
memory/4896-4878-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4896-4880-0x0000000005350000-0x00000000053B6000-memory.dmp

Filesize
408KB

Download
memory/4896-4879-0x0000000075030000-0x00000000757E0000-memory.dmp

Filesize
7.7MB

Download
memory/4896-4881-0x00000000067F0000-0x0000000006840000-memory.dmp

Filesize
320KB

Download
memory/4896-4882-0x00000000068E0000-0x0000000006972000-memory.dmp

Filesize
584KB

Download
memory/4896-4883-0x00000000068A0000-0x00000000068AA000-memory.dmp

Filesize
40KB

Download
memory/4896-4884-0x0000000075030000-0x00000000757E0000-memory.dmp

Filesize
7.7MB

Download