agenttesla | 0743b68b011b64921ce7d5f306410a104d2b856d538188be26f1fca7926a8e7a

General

Target

02a34bf8a236b27d487f211a729d1624_JaffaCakes118.exe
Size

811KB
MD5

02a34bf8a236b27d487f211a729d1624
SHA1

33da43d0e93c495d7de316268f2a437204dc34e1
SHA256

0743b68b011b64921ce7d5f306410a104d2b856d538188be26f1fca7926a8e7a
SHA512

28474ed5f4db80f0789206cd60e952e1a12e9bb21290fee99dc1b6d8b69f3b3b4e41c1f257e4a44901bce2c39b0eaf9dea094305d7ce953b38c2123b09e3fd27
SSDEEP

12288:Cy8TC5hFG5yzMxR/QPNtcEyM3MgghFeGb98O4Y3WsY4mAz6v3SSQ/+WRX:/8TqfG0Qx4tOAMgAbP4nsv

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.cabletraychina.com
Port:
587
Username:
sales@cabletraychina.com
Password:
Jhdq2017#

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla payload 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1720-9-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1720-10-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1720-13-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1720-15-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1720-17-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1720-19-0x00000000000E0000-0x0000000000120000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

Processes:

02a34bf8a236b27d487f211a729d1624_JaffaCakes118.exe

description	pid	process	target process
PID 1808 set thread context of 1720	1808	02a34bf8a236b27d487f211a729d1624_JaffaCakes118.exe	02a34bf8a236b27d487f211a729d1624_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

02a34bf8a236b27d487f211a729d1624_JaffaCakes118.exe02a34bf8a236b27d487f211a729d1624_JaffaCakes118.exe

description	pid	process	target process
PID 1808 wrote to memory of 1720	1808	02a34bf8a236b27d487f211a729d1624_JaffaCakes118.exe	02a34bf8a236b27d487f211a729d1624_JaffaCakes118.exe
PID 1808 wrote to memory of 1720	1808	02a34bf8a236b27d487f211a729d1624_JaffaCakes118.exe	02a34bf8a236b27d487f211a729d1624_JaffaCakes118.exe
PID 1808 wrote to memory of 1720	1808	02a34bf8a236b27d487f211a729d1624_JaffaCakes118.exe	02a34bf8a236b27d487f211a729d1624_JaffaCakes118.exe
PID 1808 wrote to memory of 1720	1808	02a34bf8a236b27d487f211a729d1624_JaffaCakes118.exe	02a34bf8a236b27d487f211a729d1624_JaffaCakes118.exe
PID 1808 wrote to memory of 1720	1808	02a34bf8a236b27d487f211a729d1624_JaffaCakes118.exe	02a34bf8a236b27d487f211a729d1624_JaffaCakes118.exe
PID 1808 wrote to memory of 1720	1808	02a34bf8a236b27d487f211a729d1624_JaffaCakes118.exe	02a34bf8a236b27d487f211a729d1624_JaffaCakes118.exe
PID 1808 wrote to memory of 1720	1808	02a34bf8a236b27d487f211a729d1624_JaffaCakes118.exe	02a34bf8a236b27d487f211a729d1624_JaffaCakes118.exe
PID 1808 wrote to memory of 1720	1808	02a34bf8a236b27d487f211a729d1624_JaffaCakes118.exe	02a34bf8a236b27d487f211a729d1624_JaffaCakes118.exe
PID 1808 wrote to memory of 1720	1808	02a34bf8a236b27d487f211a729d1624_JaffaCakes118.exe	02a34bf8a236b27d487f211a729d1624_JaffaCakes118.exe
PID 1720 wrote to memory of 2988	1720	02a34bf8a236b27d487f211a729d1624_JaffaCakes118.exe	dw20.exe
PID 1720 wrote to memory of 2988	1720	02a34bf8a236b27d487f211a729d1624_JaffaCakes118.exe	dw20.exe
PID 1720 wrote to memory of 2988	1720	02a34bf8a236b27d487f211a729d1624_JaffaCakes118.exe	dw20.exe
PID 1720 wrote to memory of 2988	1720	02a34bf8a236b27d487f211a729d1624_JaffaCakes118.exe	dw20.exe

C:\Users\Admin\AppData\Local\Temp\02a34bf8a236b27d487f211a729d1624_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\02a34bf8a236b27d487f211a729d1624_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1808

C:\Users\Admin\AppData\Local\Temp\02a34bf8a236b27d487f211a729d1624_JaffaCakes118.exe
"{path}"
2⤵
- Suspicious use of WriteProcessMemory
PID:1720

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 388
3⤵
PID:2988

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1720-13-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1720-18-0x0000000073D10000-0x00000000742BB000-memory.dmp

Filesize
5.7MB

Download
memory/1720-24-0x00000000000E0000-0x0000000000120000-memory.dmp

Filesize
256KB

Download
memory/1720-17-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1720-15-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1720-5-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1720-7-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1720-9-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1720-10-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1720-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1720-23-0x0000000073D10000-0x00000000742BB000-memory.dmp

Filesize
5.7MB

Download
memory/1720-20-0x0000000073D10000-0x00000000742BB000-memory.dmp

Filesize
5.7MB

Download
memory/1720-19-0x00000000000E0000-0x0000000000120000-memory.dmp

Filesize
256KB

Download
memory/1808-4-0x0000000000160000-0x00000000001A0000-memory.dmp

Filesize
256KB

Download
memory/1808-3-0x0000000073D10000-0x00000000742BB000-memory.dmp

Filesize
5.7MB

Download
memory/1808-2-0x0000000000160000-0x00000000001A0000-memory.dmp

Filesize
256KB

Download
memory/1808-21-0x0000000073D10000-0x00000000742BB000-memory.dmp

Filesize
5.7MB

Download
memory/1808-1-0x0000000073D10000-0x00000000742BB000-memory.dmp

Filesize
5.7MB

Download
memory/1808-0-0x0000000073D10000-0x00000000742BB000-memory.dmp

Filesize
5.7MB

Download
memory/2988-22-0x00000000025C0000-0x00000000025C1000-memory.dmp

Filesize
4KB

Download
memory/2988-25-0x00000000025C0000-0x00000000025C1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads