agenttesla | 7fdcf8b6fa88225eb0938e3eb84ee20fbc757f24de8a62e75274ead764902351

General

Target

2b77d25e16d7b950e8a4b0d9c92e046e_JaffaCakes118.exe
Size

743KB
MD5

2b77d25e16d7b950e8a4b0d9c92e046e
SHA1

9c3bba964e5ec8cf1a8712f4d34937eb30f79e6b
SHA256

7fdcf8b6fa88225eb0938e3eb84ee20fbc757f24de8a62e75274ead764902351
SHA512

f71ee1a50586f808a1c768be2ade9e1806469dda2fc449b172e8f264bb438c41ca35930dd047af317b3458d3d924567272b0a4354aaaf776df444454c8b8482c
SSDEEP

12288:3gTEcqbVxLiVMyaEj9Swelx4P2P+qrGqjXVFZG2vV:wTErJxLiZCwelxe++

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.spinneker.co.uk
Port:
587
Username:
[email protected]
Password:
IPzvDNU7

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1356-6-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

Processes:

2b77d25e16d7b950e8a4b0d9c92e046e_JaffaCakes118.exe

description	pid	process	target process
PID 4776 set thread context of 1356	4776	2b77d25e16d7b950e8a4b0d9c92e046e_JaffaCakes118.exe	2b77d25e16d7b950e8a4b0d9c92e046e_JaffaCakes118.exe

Drops file in Windows directory 1 IoCs

Processes:

dw20.exe

description ioc process

File created C:\Windows\AppCompat\Programs\Amcache.hve.tmp dw20.exe

description	ioc	process
File created	C:\Windows\AppCompat\Programs\Amcache.hve.tmp	dw20.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

dw20.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dw20.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

dw20.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

2b77d25e16d7b950e8a4b0d9c92e046e_JaffaCakes118.exe

pid	process
4776	2b77d25e16d7b950e8a4b0d9c92e046e_JaffaCakes118.exe
4776	2b77d25e16d7b950e8a4b0d9c92e046e_JaffaCakes118.exe
4776	2b77d25e16d7b950e8a4b0d9c92e046e_JaffaCakes118.exe
4776	2b77d25e16d7b950e8a4b0d9c92e046e_JaffaCakes118.exe
4776	2b77d25e16d7b950e8a4b0d9c92e046e_JaffaCakes118.exe
4776	2b77d25e16d7b950e8a4b0d9c92e046e_JaffaCakes118.exe
4776	2b77d25e16d7b950e8a4b0d9c92e046e_JaffaCakes118.exe
4776	2b77d25e16d7b950e8a4b0d9c92e046e_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

2b77d25e16d7b950e8a4b0d9c92e046e_JaffaCakes118.exedw20.exe

description	pid	process
Token: SeDebugPrivilege	4776	2b77d25e16d7b950e8a4b0d9c92e046e_JaffaCakes118.exe
Token: SeRestorePrivilege	508	dw20.exe
Token: SeBackupPrivilege	508	dw20.exe
Token: SeBackupPrivilege	508	dw20.exe
Token: SeBackupPrivilege	508	dw20.exe
Token: SeBackupPrivilege	508	dw20.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

2b77d25e16d7b950e8a4b0d9c92e046e_JaffaCakes118.exe2b77d25e16d7b950e8a4b0d9c92e046e_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\2b77d25e16d7b950e8a4b0d9c92e046e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2b77d25e16d7b950e8a4b0d9c92e046e_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4776

C:\Users\Admin\AppData\Local\Temp\2b77d25e16d7b950e8a4b0d9c92e046e_JaffaCakes118.exe
"{path}"
2⤵
PID:3472

C:\Users\Admin\AppData\Local\Temp\2b77d25e16d7b950e8a4b0d9c92e046e_JaffaCakes118.exe
"{path}"
2⤵
PID:3292

C:\Users\Admin\AppData\Local\Temp\2b77d25e16d7b950e8a4b0d9c92e046e_JaffaCakes118.exe
"{path}"
2⤵
PID:3772

C:\Users\Admin\AppData\Local\Temp\2b77d25e16d7b950e8a4b0d9c92e046e_JaffaCakes118.exe
"{path}"
2⤵
PID:2460

C:\Users\Admin\AppData\Local\Temp\2b77d25e16d7b950e8a4b0d9c92e046e_JaffaCakes118.exe
"{path}"
2⤵
- Suspicious use of WriteProcessMemory
PID:1356

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 788
3⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:508

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\2b77d25e16d7b950e8a4b0d9c92e046e_JaffaCakes118.exe.log
Filesize
594B

MD5
fdb26b3b547022b45cfaeee57eafd566

SHA1
11c6798b8a59233f404014c5e79b3363cd564b37

SHA256
2707fc7f074413881b7bafca05079327b188db6005709951e7f69d39a2af97c0

SHA512
44d9bb8c0f0b341690d00eda86e15a50f7f29ce9595925c1a2a7e19ad26202d10049a7a97bea278ecb7d429ad555de8edceeffff664d4b06309a9410a09bb700

Download Submit
memory/1356-10-0x00000000010D0000-0x00000000010E0000-memory.dmp

Filesize
64KB

Download
memory/1356-6-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1356-9-0x0000000074620000-0x0000000074BD1000-memory.dmp

Filesize
5.7MB

Download
memory/1356-12-0x0000000074620000-0x0000000074BD1000-memory.dmp

Filesize
5.7MB

Download
memory/1356-19-0x0000000074620000-0x0000000074BD1000-memory.dmp

Filesize
5.7MB

Download
memory/4776-2-0x00000000011F0000-0x0000000001200000-memory.dmp

Filesize
64KB

Download
memory/4776-3-0x0000000074620000-0x0000000074BD1000-memory.dmp

Filesize
5.7MB

Download
memory/4776-4-0x00000000011F0000-0x0000000001200000-memory.dmp

Filesize
64KB

Download
memory/4776-5-0x00000000011F0000-0x0000000001200000-memory.dmp

Filesize
64KB

Download
memory/4776-1-0x0000000074620000-0x0000000074BD1000-memory.dmp

Filesize
5.7MB

Download
memory/4776-0-0x0000000074620000-0x0000000074BD1000-memory.dmp

Filesize
5.7MB

Download
memory/4776-11-0x0000000074620000-0x0000000074BD1000-memory.dmp

Filesize
5.7MB

Download

description	pid	process	target process
PID 4776 wrote to memory of 3472	4776	2b77d25e16d7b950e8a4b0d9c92e046e_JaffaCakes118.exe	2b77d25e16d7b950e8a4b0d9c92e046e_JaffaCakes118.exe
PID 4776 wrote to memory of 3472	4776	2b77d25e16d7b950e8a4b0d9c92e046e_JaffaCakes118.exe	2b77d25e16d7b950e8a4b0d9c92e046e_JaffaCakes118.exe
PID 4776 wrote to memory of 3472	4776	2b77d25e16d7b950e8a4b0d9c92e046e_JaffaCakes118.exe	2b77d25e16d7b950e8a4b0d9c92e046e_JaffaCakes118.exe
PID 4776 wrote to memory of 3292	4776	2b77d25e16d7b950e8a4b0d9c92e046e_JaffaCakes118.exe	2b77d25e16d7b950e8a4b0d9c92e046e_JaffaCakes118.exe
PID 4776 wrote to memory of 3292	4776	2b77d25e16d7b950e8a4b0d9c92e046e_JaffaCakes118.exe	2b77d25e16d7b950e8a4b0d9c92e046e_JaffaCakes118.exe
PID 4776 wrote to memory of 3292	4776	2b77d25e16d7b950e8a4b0d9c92e046e_JaffaCakes118.exe	2b77d25e16d7b950e8a4b0d9c92e046e_JaffaCakes118.exe
PID 4776 wrote to memory of 3772	4776	2b77d25e16d7b950e8a4b0d9c92e046e_JaffaCakes118.exe	2b77d25e16d7b950e8a4b0d9c92e046e_JaffaCakes118.exe
PID 4776 wrote to memory of 3772	4776	2b77d25e16d7b950e8a4b0d9c92e046e_JaffaCakes118.exe	2b77d25e16d7b950e8a4b0d9c92e046e_JaffaCakes118.exe
PID 4776 wrote to memory of 3772	4776	2b77d25e16d7b950e8a4b0d9c92e046e_JaffaCakes118.exe	2b77d25e16d7b950e8a4b0d9c92e046e_JaffaCakes118.exe
PID 4776 wrote to memory of 2460	4776	2b77d25e16d7b950e8a4b0d9c92e046e_JaffaCakes118.exe	2b77d25e16d7b950e8a4b0d9c92e046e_JaffaCakes118.exe
PID 4776 wrote to memory of 2460	4776	2b77d25e16d7b950e8a4b0d9c92e046e_JaffaCakes118.exe	2b77d25e16d7b950e8a4b0d9c92e046e_JaffaCakes118.exe
PID 4776 wrote to memory of 2460	4776	2b77d25e16d7b950e8a4b0d9c92e046e_JaffaCakes118.exe	2b77d25e16d7b950e8a4b0d9c92e046e_JaffaCakes118.exe
PID 4776 wrote to memory of 1356	4776	2b77d25e16d7b950e8a4b0d9c92e046e_JaffaCakes118.exe	2b77d25e16d7b950e8a4b0d9c92e046e_JaffaCakes118.exe
PID 4776 wrote to memory of 1356	4776	2b77d25e16d7b950e8a4b0d9c92e046e_JaffaCakes118.exe	2b77d25e16d7b950e8a4b0d9c92e046e_JaffaCakes118.exe
PID 4776 wrote to memory of 1356	4776	2b77d25e16d7b950e8a4b0d9c92e046e_JaffaCakes118.exe	2b77d25e16d7b950e8a4b0d9c92e046e_JaffaCakes118.exe
PID 4776 wrote to memory of 1356	4776	2b77d25e16d7b950e8a4b0d9c92e046e_JaffaCakes118.exe	2b77d25e16d7b950e8a4b0d9c92e046e_JaffaCakes118.exe
PID 4776 wrote to memory of 1356	4776	2b77d25e16d7b950e8a4b0d9c92e046e_JaffaCakes118.exe	2b77d25e16d7b950e8a4b0d9c92e046e_JaffaCakes118.exe
PID 4776 wrote to memory of 1356	4776	2b77d25e16d7b950e8a4b0d9c92e046e_JaffaCakes118.exe	2b77d25e16d7b950e8a4b0d9c92e046e_JaffaCakes118.exe
PID 4776 wrote to memory of 1356	4776	2b77d25e16d7b950e8a4b0d9c92e046e_JaffaCakes118.exe	2b77d25e16d7b950e8a4b0d9c92e046e_JaffaCakes118.exe
PID 4776 wrote to memory of 1356	4776	2b77d25e16d7b950e8a4b0d9c92e046e_JaffaCakes118.exe	2b77d25e16d7b950e8a4b0d9c92e046e_JaffaCakes118.exe
PID 1356 wrote to memory of 508	1356	2b77d25e16d7b950e8a4b0d9c92e046e_JaffaCakes118.exe	dw20.exe
PID 1356 wrote to memory of 508	1356	2b77d25e16d7b950e8a4b0d9c92e046e_JaffaCakes118.exe	dw20.exe
PID 1356 wrote to memory of 508	1356	2b77d25e16d7b950e8a4b0d9c92e046e_JaffaCakes118.exe	dw20.exe

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads