agenttesla | 0ee017703bd2fd8b81b7b71182ac937f143989731e6adf44dc305dd4fd6150c1

General

Target

0905ba6c00ce17c79cc4afea05464889_JaffaCakes118.exe
Size

735KB
MD5

0905ba6c00ce17c79cc4afea05464889
SHA1

13f66a4d33a16bb8a24d3339f12aeba38aa819e6
SHA256

0ee017703bd2fd8b81b7b71182ac937f143989731e6adf44dc305dd4fd6150c1
SHA512

b3e940d55016b778683bcb7c5327b6f4e69360cfe29c15a4e80b0ac663e01c69e84bc83ab67dcb212bdbb995bbf112c020085ade54ae8ba7a1d732e10d2f69a0
SSDEEP

12288:rY1TUyutgWBYqwXMeEOWCfBIn23vYezhmjWoXDB6hmtMYrf8G/VJM:yTUykZBYppEY5setmio

Score

10^/10

agenttesla evasion keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.westviewcargos.com
Port:
587
Username:
fb@westviewcargos.com
Password:
Choice@@@12345

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1948-12-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1948-14-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1948-18-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1948-20-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1948-22-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

0905ba6c00ce17c79cc4afea05464889_JaffaCakes118.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Oracle\VirtualBox Guest Additions	0905ba6c00ce17c79cc4afea05464889_JaffaCakes118.exe

Looks for VMWare Tools registry key 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

0905ba6c00ce17c79cc4afea05464889_JaffaCakes118.exe

description ioc process

Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools 0905ba6c00ce17c79cc4afea05464889_JaffaCakes118.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools	0905ba6c00ce17c79cc4afea05464889_JaffaCakes118.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

0905ba6c00ce17c79cc4afea05464889_JaffaCakes118.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	0905ba6c00ce17c79cc4afea05464889_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	0905ba6c00ce17c79cc4afea05464889_JaffaCakes118.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

0905ba6c00ce17c79cc4afea05464889_JaffaCakes118.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	0905ba6c00ce17c79cc4afea05464889_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	0905ba6c00ce17c79cc4afea05464889_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

0905ba6c00ce17c79cc4afea05464889_JaffaCakes118.exe

description	pid	process	target process
PID 2004 set thread context of 1948	2004	0905ba6c00ce17c79cc4afea05464889_JaffaCakes118.exe	0905ba6c00ce17c79cc4afea05464889_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

2584 schtasks.exe

pid	process
2584	schtasks.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

0905ba6c00ce17c79cc4afea05464889_JaffaCakes118.exe0905ba6c00ce17c79cc4afea05464889_JaffaCakes118.exe

description	pid	process	target process
PID 2004 wrote to memory of 2584	2004	0905ba6c00ce17c79cc4afea05464889_JaffaCakes118.exe	schtasks.exe
PID 2004 wrote to memory of 2584	2004	0905ba6c00ce17c79cc4afea05464889_JaffaCakes118.exe	schtasks.exe
PID 2004 wrote to memory of 2584	2004	0905ba6c00ce17c79cc4afea05464889_JaffaCakes118.exe	schtasks.exe
PID 2004 wrote to memory of 2584	2004	0905ba6c00ce17c79cc4afea05464889_JaffaCakes118.exe	schtasks.exe
PID 2004 wrote to memory of 1948	2004	0905ba6c00ce17c79cc4afea05464889_JaffaCakes118.exe	0905ba6c00ce17c79cc4afea05464889_JaffaCakes118.exe
PID 2004 wrote to memory of 1948	2004	0905ba6c00ce17c79cc4afea05464889_JaffaCakes118.exe	0905ba6c00ce17c79cc4afea05464889_JaffaCakes118.exe
PID 2004 wrote to memory of 1948	2004	0905ba6c00ce17c79cc4afea05464889_JaffaCakes118.exe	0905ba6c00ce17c79cc4afea05464889_JaffaCakes118.exe
PID 2004 wrote to memory of 1948	2004	0905ba6c00ce17c79cc4afea05464889_JaffaCakes118.exe	0905ba6c00ce17c79cc4afea05464889_JaffaCakes118.exe
PID 2004 wrote to memory of 1948	2004	0905ba6c00ce17c79cc4afea05464889_JaffaCakes118.exe	0905ba6c00ce17c79cc4afea05464889_JaffaCakes118.exe
PID 2004 wrote to memory of 1948	2004	0905ba6c00ce17c79cc4afea05464889_JaffaCakes118.exe	0905ba6c00ce17c79cc4afea05464889_JaffaCakes118.exe
PID 2004 wrote to memory of 1948	2004	0905ba6c00ce17c79cc4afea05464889_JaffaCakes118.exe	0905ba6c00ce17c79cc4afea05464889_JaffaCakes118.exe
PID 2004 wrote to memory of 1948	2004	0905ba6c00ce17c79cc4afea05464889_JaffaCakes118.exe	0905ba6c00ce17c79cc4afea05464889_JaffaCakes118.exe
PID 2004 wrote to memory of 1948	2004	0905ba6c00ce17c79cc4afea05464889_JaffaCakes118.exe	0905ba6c00ce17c79cc4afea05464889_JaffaCakes118.exe
PID 1948 wrote to memory of 2436	1948	0905ba6c00ce17c79cc4afea05464889_JaffaCakes118.exe	dw20.exe
PID 1948 wrote to memory of 2436	1948	0905ba6c00ce17c79cc4afea05464889_JaffaCakes118.exe	dw20.exe
PID 1948 wrote to memory of 2436	1948	0905ba6c00ce17c79cc4afea05464889_JaffaCakes118.exe	dw20.exe
PID 1948 wrote to memory of 2436	1948	0905ba6c00ce17c79cc4afea05464889_JaffaCakes118.exe	dw20.exe

C:\Users\Admin\AppData\Local\Temp\0905ba6c00ce17c79cc4afea05464889_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0905ba6c00ce17c79cc4afea05464889_JaffaCakes118.exe"
1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2004

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\cfBVyFdDFVQUZn" /XML "C:\Users\Admin\AppData\Local\Temp\tmpBEAD.tmp"
2⤵
- Creates scheduled task(s)
PID:2584

C:\Users\Admin\AppData\Local\Temp\0905ba6c00ce17c79cc4afea05464889_JaffaCakes118.exe
"{path}"
2⤵
- Suspicious use of WriteProcessMemory
PID:1948

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 384
3⤵
PID:2436

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Virtualization/Sandbox Evasion

2

T1497

Credential Access

Discovery

Query Registry

4

T1012

Virtualization/Sandbox Evasion

2

T1497

System Information Discovery

3

T1082

Peripheral Device Discovery

1

T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpBEAD.tmp
Filesize
1KB

MD5
112c4bc7baa2ed30539366f2744b5df7

SHA1
0cca6b2d80d2c1f35f483009a4bd8b4218f63965

SHA256
02538f59f7ae2b9bc19df67b8b8a076aa3b5bf17bccfe91ac614b57639e4bd21

SHA512
31df7c49a3e7e45541eeb88d07201a9f53d36a49a48ec197461273dd4078e218d22e619ba6d92fba77e7f56714438eda0c50b1951335d68172635375901ce92d

Download Submit
memory/1948-16-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1948-26-0x00000000746E0000-0x0000000074C8B000-memory.dmp

Filesize
5.7MB

Download
memory/1948-18-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1948-22-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1948-20-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1948-8-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1948-10-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1948-12-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1948-14-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1948-29-0x0000000000CA0000-0x0000000000CE0000-memory.dmp

Filesize
256KB

Download
memory/1948-28-0x00000000746E0000-0x0000000074C8B000-memory.dmp

Filesize
5.7MB

Download
memory/1948-25-0x0000000000CA0000-0x0000000000CE0000-memory.dmp

Filesize
256KB

Download
memory/1948-24-0x00000000746E0000-0x0000000074C8B000-memory.dmp

Filesize
5.7MB

Download
memory/2004-4-0x00000000004E0000-0x0000000000520000-memory.dmp

Filesize
256KB

Download
memory/2004-1-0x00000000746E0000-0x0000000074C8B000-memory.dmp

Filesize
5.7MB

Download
memory/2004-23-0x00000000746E0000-0x0000000074C8B000-memory.dmp

Filesize
5.7MB

Download
memory/2004-2-0x00000000004E0000-0x0000000000520000-memory.dmp

Filesize
256KB

Download
memory/2004-3-0x00000000746E0000-0x0000000074C8B000-memory.dmp

Filesize
5.7MB

Download
memory/2004-0-0x00000000746E0000-0x0000000074C8B000-memory.dmp

Filesize
5.7MB

Download
memory/2436-27-0x00000000029B0000-0x00000000029B1000-memory.dmp

Filesize
4KB

Download
memory/2436-30-0x00000000029B0000-0x00000000029B1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads