agenttesla | f4008d16e598db2a35512ca619aa47a5434e177e5be16323378fd86715002808

General

Target

170b650b89eb3f88732366ca582cb976_JaffaCakes118.exe
Size

341KB
MD5

170b650b89eb3f88732366ca582cb976
SHA1

b76899209d61e00e567d6bfa1140b6455f28b9c6
SHA256

f4008d16e598db2a35512ca619aa47a5434e177e5be16323378fd86715002808
SHA512

562b57205bee65a96ff1e8eabbe64e0f0bb5e1390ba8b6354691a7875ef819b87742a18dfc482e62930cf2f6f5f0d3d517a3da4d67d8e5a55bebc609c10ccf18
SSDEEP

6144:GBlL/LNEppNBYRU1P/PMSnxT0SBCGbyVpEhcHEytf7anFF:EBm77RnxT0SBCGQon7

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla payload 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3020-8-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla
behavioral1/memory/3020-10-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla
behavioral1/memory/3020-11-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla
behavioral1/memory/3020-16-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla

Loads dropped DLL 1 IoCs

Processes:

170b650b89eb3f88732366ca582cb976_JaffaCakes118.exe

pid process

3048 170b650b89eb3f88732366ca582cb976_JaffaCakes118.exe

pid	process
3048	170b650b89eb3f88732366ca582cb976_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

170b650b89eb3f88732366ca582cb976_JaffaCakes118.exe

description	pid	process	target process
PID 3048 set thread context of 3020	3048	170b650b89eb3f88732366ca582cb976_JaffaCakes118.exe	170b650b89eb3f88732366ca582cb976_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

170b650b89eb3f88732366ca582cb976_JaffaCakes118.exe

pid process

3020 170b650b89eb3f88732366ca582cb976_JaffaCakes118.exe
3020 170b650b89eb3f88732366ca582cb976_JaffaCakes118.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

170b650b89eb3f88732366ca582cb976_JaffaCakes118.exe

description pid process

Token: SeDebugPrivilege 3020 170b650b89eb3f88732366ca582cb976_JaffaCakes118.exe

pid	process
3020	170b650b89eb3f88732366ca582cb976_JaffaCakes118.exe
3020	170b650b89eb3f88732366ca582cb976_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	3020	170b650b89eb3f88732366ca582cb976_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

170b650b89eb3f88732366ca582cb976_JaffaCakes118.exe170b650b89eb3f88732366ca582cb976_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\170b650b89eb3f88732366ca582cb976_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\170b650b89eb3f88732366ca582cb976_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3048

C:\Users\Admin\AppData\Local\Temp\170b650b89eb3f88732366ca582cb976_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\170b650b89eb3f88732366ca582cb976_JaffaCakes118.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3020

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 508
3⤵
PID:2640

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nst45C8.tmp\misckvq.dll
Filesize
32KB

MD5
71455ae5bee5d2dc77c1c86f0ff4a9aa

SHA1
30aba60427c693656d8d76cbdf257c033284f1c2

SHA256
10d7db2ec1fa897b98373589c629e14b938d81a952bc33c32d60aea1522f86d6

SHA512
a4e0a98ef162bf28059af238b25f696d1dd0e07cc30337968f15ebb802ecd487c9f4ada2ee441052a24e66ba4f9dbf6beb307e9a7f65495156270468fb2c699a

Download Submit
memory/2640-15-0x0000000001E10000-0x0000000001E11000-memory.dmp

Filesize
4KB

Download
memory/2640-20-0x0000000001E10000-0x0000000001E11000-memory.dmp

Filesize
4KB

Download
memory/3020-8-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/3020-10-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/3020-11-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/3020-12-0x0000000074810000-0x0000000074DBB000-memory.dmp

Filesize
5.7MB

Download
memory/3020-13-0x0000000074810000-0x0000000074DBB000-memory.dmp

Filesize
5.7MB

Download
memory/3020-14-0x0000000001EE0000-0x0000000001F20000-memory.dmp

Filesize
256KB

Download
memory/3020-16-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/3020-17-0x0000000074810000-0x0000000074DBB000-memory.dmp

Filesize
5.7MB

Download

description	pid	process	target process
PID 3048 wrote to memory of 3020	3048	170b650b89eb3f88732366ca582cb976_JaffaCakes118.exe	170b650b89eb3f88732366ca582cb976_JaffaCakes118.exe
PID 3048 wrote to memory of 3020	3048	170b650b89eb3f88732366ca582cb976_JaffaCakes118.exe	170b650b89eb3f88732366ca582cb976_JaffaCakes118.exe
PID 3048 wrote to memory of 3020	3048	170b650b89eb3f88732366ca582cb976_JaffaCakes118.exe	170b650b89eb3f88732366ca582cb976_JaffaCakes118.exe
PID 3048 wrote to memory of 3020	3048	170b650b89eb3f88732366ca582cb976_JaffaCakes118.exe	170b650b89eb3f88732366ca582cb976_JaffaCakes118.exe
PID 3048 wrote to memory of 3020	3048	170b650b89eb3f88732366ca582cb976_JaffaCakes118.exe	170b650b89eb3f88732366ca582cb976_JaffaCakes118.exe
PID 3048 wrote to memory of 3020	3048	170b650b89eb3f88732366ca582cb976_JaffaCakes118.exe	170b650b89eb3f88732366ca582cb976_JaffaCakes118.exe
PID 3048 wrote to memory of 3020	3048	170b650b89eb3f88732366ca582cb976_JaffaCakes118.exe	170b650b89eb3f88732366ca582cb976_JaffaCakes118.exe
PID 3048 wrote to memory of 3020	3048	170b650b89eb3f88732366ca582cb976_JaffaCakes118.exe	170b650b89eb3f88732366ca582cb976_JaffaCakes118.exe
PID 3048 wrote to memory of 3020	3048	170b650b89eb3f88732366ca582cb976_JaffaCakes118.exe	170b650b89eb3f88732366ca582cb976_JaffaCakes118.exe
PID 3048 wrote to memory of 3020	3048	170b650b89eb3f88732366ca582cb976_JaffaCakes118.exe	170b650b89eb3f88732366ca582cb976_JaffaCakes118.exe
PID 3048 wrote to memory of 3020	3048	170b650b89eb3f88732366ca582cb976_JaffaCakes118.exe	170b650b89eb3f88732366ca582cb976_JaffaCakes118.exe
PID 3020 wrote to memory of 2640	3020	170b650b89eb3f88732366ca582cb976_JaffaCakes118.exe	dw20.exe
PID 3020 wrote to memory of 2640	3020	170b650b89eb3f88732366ca582cb976_JaffaCakes118.exe	dw20.exe
PID 3020 wrote to memory of 2640	3020	170b650b89eb3f88732366ca582cb976_JaffaCakes118.exe	dw20.exe
PID 3020 wrote to memory of 2640	3020	170b650b89eb3f88732366ca582cb976_JaffaCakes118.exe	dw20.exe

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads