agenttesla | fc37e01bcc7919699ec81a825718d0639eaf85eef7e7b87111ff33b53fd09b0b

General

Target

04e761381caf955122a817f09ecb36b1_JaffaCakes118.exe
Size

442KB
MD5

04e761381caf955122a817f09ecb36b1
SHA1

37d443dd00b448a9661f7728a1c620729b10ddcf
SHA256

fc37e01bcc7919699ec81a825718d0639eaf85eef7e7b87111ff33b53fd09b0b
SHA512

ac48f9321604c38c52498be5c48ade24dadc0f1139fab5ca6b9c96b1aa326023eac09391b0189ae7b7ffb3bdd6eddc18ceb76dafcc9f7428a4fc8bf0d554111b
SSDEEP

6144:OQbGb6t7QSvKpgKQ9MJqgJOd9GLbqg50S2yURNF//E:9b46yur9MoUs9+q40bj/

Score

10^/10

agenttesla collection keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.fitchreatings.com
Port:
587
Username:
johnson.florenciani@fitchreatings.com
Password:
5{k0%{QmvnXe

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1736-113-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Loads dropped DLL 1 IoCs

Processes:

04e761381caf955122a817f09ecb36b1_JaffaCakes118.exe

pid process

1768 04e761381caf955122a817f09ecb36b1_JaffaCakes118.exe
Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

04e761381caf955122a817f09ecb36b1_JaffaCakes118.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	04e761381caf955122a817f09ecb36b1_JaffaCakes118.exe
Key opened	\REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	04e761381caf955122a817f09ecb36b1_JaffaCakes118.exe
Key opened	\REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	04e761381caf955122a817f09ecb36b1_JaffaCakes118.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

13 api.ipify.org

flow	ioc
13	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

Processes:

04e761381caf955122a817f09ecb36b1_JaffaCakes118.exe

description	pid	process	target process
PID 1768 set thread context of 1736	1768	04e761381caf955122a817f09ecb36b1_JaffaCakes118.exe	04e761381caf955122a817f09ecb36b1_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

04e761381caf955122a817f09ecb36b1_JaffaCakes118.exe04e761381caf955122a817f09ecb36b1_JaffaCakes118.exe

pid	process
1768	04e761381caf955122a817f09ecb36b1_JaffaCakes118.exe
1736	04e761381caf955122a817f09ecb36b1_JaffaCakes118.exe
1736	04e761381caf955122a817f09ecb36b1_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

04e761381caf955122a817f09ecb36b1_JaffaCakes118.exe04e761381caf955122a817f09ecb36b1_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	1768	04e761381caf955122a817f09ecb36b1_JaffaCakes118.exe
Token: SeDebugPrivilege	1736	04e761381caf955122a817f09ecb36b1_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

04e761381caf955122a817f09ecb36b1_JaffaCakes118.exe

description	pid	process	target process
PID 1768 wrote to memory of 1736	1768	04e761381caf955122a817f09ecb36b1_JaffaCakes118.exe	04e761381caf955122a817f09ecb36b1_JaffaCakes118.exe
PID 1768 wrote to memory of 1736	1768	04e761381caf955122a817f09ecb36b1_JaffaCakes118.exe	04e761381caf955122a817f09ecb36b1_JaffaCakes118.exe
PID 1768 wrote to memory of 1736	1768	04e761381caf955122a817f09ecb36b1_JaffaCakes118.exe	04e761381caf955122a817f09ecb36b1_JaffaCakes118.exe
PID 1768 wrote to memory of 1736	1768	04e761381caf955122a817f09ecb36b1_JaffaCakes118.exe	04e761381caf955122a817f09ecb36b1_JaffaCakes118.exe
PID 1768 wrote to memory of 1736	1768	04e761381caf955122a817f09ecb36b1_JaffaCakes118.exe	04e761381caf955122a817f09ecb36b1_JaffaCakes118.exe
PID 1768 wrote to memory of 1736	1768	04e761381caf955122a817f09ecb36b1_JaffaCakes118.exe	04e761381caf955122a817f09ecb36b1_JaffaCakes118.exe
PID 1768 wrote to memory of 1736	1768	04e761381caf955122a817f09ecb36b1_JaffaCakes118.exe	04e761381caf955122a817f09ecb36b1_JaffaCakes118.exe
PID 1768 wrote to memory of 1736	1768	04e761381caf955122a817f09ecb36b1_JaffaCakes118.exe	04e761381caf955122a817f09ecb36b1_JaffaCakes118.exe

outlook_office_path 1 IoCs

Processes:

04e761381caf955122a817f09ecb36b1_JaffaCakes118.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	04e761381caf955122a817f09ecb36b1_JaffaCakes118.exe

outlook_win_path 1 IoCs

Processes:

04e761381caf955122a817f09ecb36b1_JaffaCakes118.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	04e761381caf955122a817f09ecb36b1_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\04e761381caf955122a817f09ecb36b1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\04e761381caf955122a817f09ecb36b1_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1768

C:\Users\Admin\AppData\Local\Temp\04e761381caf955122a817f09ecb36b1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\04e761381caf955122a817f09ecb36b1_JaffaCakes118.exe"
2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:1736

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

4

T1552

Credentials In Files

3

T1552.001

Credentials in Registry

1

T1552.002

Discovery

Lateral Movement

Collection

Data from Local System

4

T1005

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\04e761381caf955122a817f09ecb36b1_JaffaCakes118.exe.log
Filesize
1KB

MD5
fc13935f3038bdde6cb484249fbff668

SHA1
a4c32013e6d59bf1eb1a5119456965de191e62b8

SHA256
de064c569a5f4edaf2da91d7bcb82bab06a35190b699cede1da0aa616a23d676

SHA512
5817275af0f8a48eb1e008d39f62fb3582db9a2d21a806e9f9ee36fbfd799fb17e91f0e3686f4b236724fe78f14ae7f40cd3755f0ec0fb6734ce42f996b798f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\b438b2b2-a27d-417f-8ec9-625540b311a1\g.dll
Filesize
94KB

MD5
14ff402962ad21b78ae0b4c43cd1f194

SHA1
f8a510eb26666e875a5bdd1cadad40602763ad72

SHA256
fb9646cb956945bdc503e69645f6b5316d3826b780d3c36738d6b944e884d15b

SHA512
daa7a08bf3709119a944bce28f6ebdd24e54a22b18cd9f86a87873e958df121a3881dcdd5e162f6b4e543238c7aef20f657c9830df01d4c79290f7c9a4fcc54b

Download Submit
memory/1736-112-0x0000000074890000-0x0000000075040000-memory.dmp

Filesize
7.7MB

Download
memory/1736-113-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1736-114-0x00000000055C0000-0x00000000055D0000-memory.dmp

Filesize
64KB

Download
memory/1736-122-0x00000000055C0000-0x00000000055D0000-memory.dmp

Filesize
64KB

Download
memory/1736-121-0x0000000007140000-0x000000000714A000-memory.dmp

Filesize
40KB

Download
memory/1736-120-0x00000000070C0000-0x0000000007110000-memory.dmp

Filesize
320KB

Download
memory/1736-119-0x00000000055C0000-0x00000000055D0000-memory.dmp

Filesize
64KB

Download
memory/1736-118-0x0000000074890000-0x0000000075040000-memory.dmp

Filesize
7.7MB

Download
memory/1736-117-0x0000000006480000-0x00000000064E6000-memory.dmp

Filesize
408KB

Download
memory/1736-116-0x0000000005800000-0x0000000005818000-memory.dmp

Filesize
96KB

Download
memory/1736-115-0x0000000005820000-0x00000000058BC000-memory.dmp

Filesize
624KB

Download
memory/1768-29-0x0000000003290000-0x00000000032AF000-memory.dmp

Filesize
124KB

Download
memory/1768-15-0x0000000003290000-0x00000000032AF000-memory.dmp

Filesize
124KB

Download
memory/1768-63-0x0000000003290000-0x00000000032AF000-memory.dmp

Filesize
124KB

Download
memory/1768-59-0x0000000003290000-0x00000000032AF000-memory.dmp

Filesize
124KB

Download
memory/1768-57-0x0000000003290000-0x00000000032AF000-memory.dmp

Filesize
124KB

Download
memory/1768-55-0x0000000003290000-0x00000000032AF000-memory.dmp

Filesize
124KB

Download
memory/1768-53-0x0000000003290000-0x00000000032AF000-memory.dmp

Filesize
124KB

Download
memory/1768-51-0x0000000003290000-0x00000000032AF000-memory.dmp

Filesize
124KB

Download
memory/1768-49-0x0000000003290000-0x00000000032AF000-memory.dmp

Filesize
124KB

Download
memory/1768-47-0x0000000003290000-0x00000000032AF000-memory.dmp

Filesize
124KB

Download
memory/1768-45-0x0000000003290000-0x00000000032AF000-memory.dmp

Filesize
124KB

Download
memory/1768-33-0x0000000003290000-0x00000000032AF000-memory.dmp

Filesize
124KB

Download
memory/1768-31-0x0000000003290000-0x00000000032AF000-memory.dmp

Filesize
124KB

Download
memory/1768-67-0x0000000003290000-0x00000000032AF000-memory.dmp

Filesize
124KB

Download
memory/1768-27-0x0000000003290000-0x00000000032AF000-memory.dmp

Filesize
124KB

Download
memory/1768-25-0x0000000003290000-0x00000000032AF000-memory.dmp

Filesize
124KB

Download
memory/1768-23-0x0000000003290000-0x00000000032AF000-memory.dmp

Filesize
124KB

Download
memory/1768-21-0x0000000003290000-0x00000000032AF000-memory.dmp

Filesize
124KB

Download
memory/1768-61-0x0000000003290000-0x00000000032AF000-memory.dmp

Filesize
124KB

Download
memory/1768-19-0x0000000003290000-0x00000000032AF000-memory.dmp

Filesize
124KB

Download
memory/1768-17-0x0000000003290000-0x00000000032AF000-memory.dmp

Filesize
124KB

Download
memory/1768-65-0x0000000003290000-0x00000000032AF000-memory.dmp

Filesize
124KB

Download
memory/1768-13-0x0000000003290000-0x00000000032AF000-memory.dmp

Filesize
124KB

Download
memory/1768-12-0x0000000003290000-0x00000000032AF000-memory.dmp

Filesize
124KB

Download
memory/1768-11-0x00000000732A0000-0x0000000073329000-memory.dmp

Filesize
548KB

Download
memory/1768-38-0x0000000003290000-0x00000000032AF000-memory.dmp

Filesize
124KB

Download
memory/1768-102-0x0000000074890000-0x0000000075040000-memory.dmp

Filesize
7.7MB

Download
memory/1768-103-0x00000000058E0000-0x00000000058F0000-memory.dmp

Filesize
64KB

Download
memory/1768-104-0x0000000006770000-0x0000000006D14000-memory.dmp

Filesize
5.6MB

Download
memory/1768-71-0x0000000003290000-0x00000000032AF000-memory.dmp

Filesize
124KB

Download
memory/1768-73-0x0000000003290000-0x00000000032AF000-memory.dmp

Filesize
124KB

Download
memory/1768-41-0x0000000003290000-0x00000000032AF000-memory.dmp

Filesize
124KB

Download
memory/1768-39-0x0000000003290000-0x00000000032AF000-memory.dmp

Filesize
124KB

Download
memory/1768-3-0x0000000003290000-0x00000000032B4000-memory.dmp

Filesize
144KB

Download
memory/1768-2-0x00000000058E0000-0x00000000058F0000-memory.dmp

Filesize
64KB

Download
memory/1768-1-0x0000000074890000-0x0000000075040000-memory.dmp

Filesize
7.7MB

Download
memory/1768-0-0x0000000000E40000-0x0000000000EB4000-memory.dmp

Filesize
464KB

Download
memory/1768-105-0x00000000062A0000-0x0000000006332000-memory.dmp

Filesize
584KB

Download
memory/1768-106-0x00000000058E0000-0x00000000058F0000-memory.dmp

Filesize
64KB

Download
memory/1768-107-0x0000000006350000-0x000000000635C000-memory.dmp

Filesize
48KB

Download
memory/1768-111-0x0000000074890000-0x0000000075040000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads