agenttesla | b67c98d61821c20cee68007e1c4dedcc40faae142361866e2340bba3c55f7b96

General

Target

f808d1fe0406d1f118f1d5bfc312b0a7_JaffaCakes118.exe
Size

844KB
MD5

f808d1fe0406d1f118f1d5bfc312b0a7
SHA1

1004d0ec9e9224216073c2a1ab254ad4bcaea2e9
SHA256

b67c98d61821c20cee68007e1c4dedcc40faae142361866e2340bba3c55f7b96
SHA512

dc298b0564134cc2c5743b43b2ae494bdb90686ac23e2ae8a0bda197f8bdb22178f548d6b3efd02e6ecabca5c4e712c4a9ae49847bfb62de324971ad20774b1d
SSDEEP

24576:nGPdnVamxuT7V11u14tlz3Vby3FtfnVN:nMdnVaQp14tlz3Vby3FtfnVN

Score

10^/10

agenttesla collection keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.unalanguvenlik.com
Port:
587
Username:
david.b@unalanguvenlik.com
Password:
selection2018

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla payload 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1832-26-0x0000000000400000-0x0000000000450000-memory.dmp	family_agenttesla
behavioral1/memory/1832-27-0x0000000000400000-0x0000000000450000-memory.dmp	family_agenttesla
behavioral1/memory/1832-29-0x0000000000400000-0x0000000000450000-memory.dmp	family_agenttesla
behavioral1/memory/1832-31-0x0000000000400000-0x0000000000450000-memory.dmp	family_agenttesla
behavioral1/memory/1832-33-0x0000000000400000-0x0000000000450000-memory.dmp	family_agenttesla
behavioral1/memory/1832-37-0x00000000003C0000-0x0000000000400000-memory.dmp	family_agenttesla

Executes dropped EXE 1 IoCs

Processes:

winint.exe

pid process

308 winint.exe
Loads dropped DLL 1 IoCs

Processes:

powershell.exe

pid process

2468 powershell.exe

pid	process
308	winint.exe

pid	process
2468	powershell.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

AppLaunch.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AppLaunch.exe
Key opened	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AppLaunch.exe
Key opened	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AppLaunch.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

winint.exe

description pid process target process

PID 308 set thread context of 1832 308 winint.exe AppLaunch.exe

description	pid	process	target process
PID 308 set thread context of 1832	308	winint.exe	AppLaunch.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

f808d1fe0406d1f118f1d5bfc312b0a7_JaffaCakes118.exepowershell.exewinint.exeAppLaunch.exe

pid	process
1676	f808d1fe0406d1f118f1d5bfc312b0a7_JaffaCakes118.exe
1676	f808d1fe0406d1f118f1d5bfc312b0a7_JaffaCakes118.exe
1676	f808d1fe0406d1f118f1d5bfc312b0a7_JaffaCakes118.exe
1676	f808d1fe0406d1f118f1d5bfc312b0a7_JaffaCakes118.exe
2468	powershell.exe
2468	powershell.exe
2468	powershell.exe
308	winint.exe
308	winint.exe
308	winint.exe
1832	AppLaunch.exe
1832	AppLaunch.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

f808d1fe0406d1f118f1d5bfc312b0a7_JaffaCakes118.exepowershell.exewinint.exeAppLaunch.exe

description	pid	process
Token: SeDebugPrivilege	1676	f808d1fe0406d1f118f1d5bfc312b0a7_JaffaCakes118.exe
Token: SeDebugPrivilege	2468	powershell.exe
Token: SeDebugPrivilege	308	winint.exe
Token: SeDebugPrivilege	1832	AppLaunch.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

f808d1fe0406d1f118f1d5bfc312b0a7_JaffaCakes118.execmd.exepowershell.exewinint.execmd.exeAppLaunch.exe

description	pid	process	target process
PID 1676 wrote to memory of 3068	1676	f808d1fe0406d1f118f1d5bfc312b0a7_JaffaCakes118.exe	cmd.exe
PID 1676 wrote to memory of 3068	1676	f808d1fe0406d1f118f1d5bfc312b0a7_JaffaCakes118.exe	cmd.exe
PID 1676 wrote to memory of 3068	1676	f808d1fe0406d1f118f1d5bfc312b0a7_JaffaCakes118.exe	cmd.exe
PID 1676 wrote to memory of 3068	1676	f808d1fe0406d1f118f1d5bfc312b0a7_JaffaCakes118.exe	cmd.exe
PID 3068 wrote to memory of 2572	3068	cmd.exe	reg.exe
PID 3068 wrote to memory of 2572	3068	cmd.exe	reg.exe
PID 3068 wrote to memory of 2572	3068	cmd.exe	reg.exe
PID 3068 wrote to memory of 2572	3068	cmd.exe	reg.exe
PID 1676 wrote to memory of 2468	1676	f808d1fe0406d1f118f1d5bfc312b0a7_JaffaCakes118.exe	powershell.exe
PID 1676 wrote to memory of 2468	1676	f808d1fe0406d1f118f1d5bfc312b0a7_JaffaCakes118.exe	powershell.exe
PID 1676 wrote to memory of 2468	1676	f808d1fe0406d1f118f1d5bfc312b0a7_JaffaCakes118.exe	powershell.exe
PID 1676 wrote to memory of 2468	1676	f808d1fe0406d1f118f1d5bfc312b0a7_JaffaCakes118.exe	powershell.exe
PID 2468 wrote to memory of 308	2468	powershell.exe	winint.exe
PID 2468 wrote to memory of 308	2468	powershell.exe	winint.exe
PID 2468 wrote to memory of 308	2468	powershell.exe	winint.exe
PID 2468 wrote to memory of 308	2468	powershell.exe	winint.exe
PID 308 wrote to memory of 1456	308	winint.exe	cmd.exe
PID 308 wrote to memory of 1456	308	winint.exe	cmd.exe
PID 308 wrote to memory of 1456	308	winint.exe	cmd.exe
PID 308 wrote to memory of 1456	308	winint.exe	cmd.exe
PID 1456 wrote to memory of 1768	1456	cmd.exe	reg.exe
PID 1456 wrote to memory of 1768	1456	cmd.exe	reg.exe
PID 1456 wrote to memory of 1768	1456	cmd.exe	reg.exe
PID 1456 wrote to memory of 1768	1456	cmd.exe	reg.exe
PID 308 wrote to memory of 1832	308	winint.exe	AppLaunch.exe
PID 308 wrote to memory of 1832	308	winint.exe	AppLaunch.exe
PID 308 wrote to memory of 1832	308	winint.exe	AppLaunch.exe
PID 308 wrote to memory of 1832	308	winint.exe	AppLaunch.exe
PID 308 wrote to memory of 1832	308	winint.exe	AppLaunch.exe
PID 308 wrote to memory of 1832	308	winint.exe	AppLaunch.exe
PID 308 wrote to memory of 1832	308	winint.exe	AppLaunch.exe
PID 308 wrote to memory of 1832	308	winint.exe	AppLaunch.exe
PID 308 wrote to memory of 1832	308	winint.exe	AppLaunch.exe
PID 308 wrote to memory of 1832	308	winint.exe	AppLaunch.exe
PID 308 wrote to memory of 1832	308	winint.exe	AppLaunch.exe
PID 308 wrote to memory of 1832	308	winint.exe	AppLaunch.exe
PID 1832 wrote to memory of 1944	1832	AppLaunch.exe	netsh.exe
PID 1832 wrote to memory of 1944	1832	AppLaunch.exe	netsh.exe
PID 1832 wrote to memory of 1944	1832	AppLaunch.exe	netsh.exe
PID 1832 wrote to memory of 1944	1832	AppLaunch.exe	netsh.exe
PID 1832 wrote to memory of 1944	1832	AppLaunch.exe	netsh.exe
PID 1832 wrote to memory of 1944	1832	AppLaunch.exe	netsh.exe
PID 1832 wrote to memory of 1944	1832	AppLaunch.exe	netsh.exe

outlook_office_path 1 IoCs

Processes:

AppLaunch.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AppLaunch.exe

outlook_win_path 1 IoCs

Processes:

AppLaunch.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AppLaunch.exe

C:\Users\Admin\AppData\Local\Temp\f808d1fe0406d1f118f1d5bfc312b0a7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f808d1fe0406d1f118f1d5bfc312b0a7_JaffaCakes118.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1676

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /c REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v windows display manager /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Roaming\winint.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:3068

C:\Windows\SysWOW64\reg.exe
REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v windows display manager /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Roaming\winint.exe"
3⤵
PID:2572

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Process C:\Users\Admin\AppData\Roaming\winint.exe
2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2468

C:\Users\Admin\AppData\Roaming\winint.exe
"C:\Users\Admin\AppData\Roaming\winint.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:308

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /c REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v windows display manager /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Roaming\winint.exe"
4⤵
- Suspicious use of WriteProcessMemory
PID:1456

C:\Windows\SysWOW64\reg.exe
REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v windows display manager /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Roaming\winint.exe"
5⤵
PID:1768

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
4⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:1832

C:\Windows\SysWOW64\netsh.exe
"netsh" wlan show profile
5⤵
PID:1944

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\winint.exe
Filesize
844KB

MD5
f808d1fe0406d1f118f1d5bfc312b0a7

SHA1
1004d0ec9e9224216073c2a1ab254ad4bcaea2e9

SHA256
b67c98d61821c20cee68007e1c4dedcc40faae142361866e2340bba3c55f7b96

SHA512
dc298b0564134cc2c5743b43b2ae494bdb90686ac23e2ae8a0bda197f8bdb22178f548d6b3efd02e6ecabca5c4e712c4a9ae49847bfb62de324971ad20774b1d

Download Submit
memory/308-35-0x0000000070B80000-0x000000007126E000-memory.dmp

Filesize
6.9MB

Download
memory/308-19-0x0000000070B80000-0x000000007126E000-memory.dmp

Filesize
6.9MB

Download
memory/308-18-0x0000000000F10000-0x0000000000FEA000-memory.dmp

Filesize
872KB

Download
memory/308-21-0x0000000000460000-0x00000000004A0000-memory.dmp

Filesize
256KB

Download
memory/308-22-0x0000000070B80000-0x000000007126E000-memory.dmp

Filesize
6.9MB

Download
memory/308-23-0x0000000000460000-0x00000000004A0000-memory.dmp

Filesize
256KB

Download
memory/1676-3-0x00000000006E0000-0x0000000000720000-memory.dmp

Filesize
256KB

Download
memory/1676-0-0x0000000000E10000-0x0000000000EEA000-memory.dmp

Filesize
872KB

Download
memory/1676-7-0x0000000074800000-0x0000000074EEE000-memory.dmp

Filesize
6.9MB

Download
memory/1676-5-0x00000000006E0000-0x0000000000720000-memory.dmp

Filesize
256KB

Download
memory/1676-4-0x0000000074800000-0x0000000074EEE000-memory.dmp

Filesize
6.9MB

Download
memory/1676-2-0x00000000002F0000-0x0000000000312000-memory.dmp

Filesize
136KB

Download
memory/1676-1-0x0000000074800000-0x0000000074EEE000-memory.dmp

Filesize
6.9MB

Download
memory/1832-26-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1832-28-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/1832-37-0x00000000003C0000-0x0000000000400000-memory.dmp

Filesize
256KB

Download
memory/1832-36-0x0000000070B80000-0x000000007126E000-memory.dmp

Filesize
6.9MB

Download
memory/1832-34-0x0000000070B80000-0x000000007126E000-memory.dmp

Filesize
6.9MB

Download
memory/1832-24-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1832-25-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1832-33-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1832-27-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1832-31-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1832-29-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/2468-20-0x00000000748F0000-0x0000000074E9B000-memory.dmp

Filesize
5.7MB

Download
memory/2468-11-0x00000000748F0000-0x0000000074E9B000-memory.dmp

Filesize
5.7MB

Download
memory/2468-10-0x00000000748F0000-0x0000000074E9B000-memory.dmp

Filesize
5.7MB

Download
memory/2468-12-0x0000000002B40000-0x0000000002B80000-memory.dmp

Filesize
256KB

Download
memory/2468-14-0x0000000002B40000-0x0000000002B80000-memory.dmp

Filesize
256KB

Download
memory/2468-13-0x0000000002B40000-0x0000000002B80000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads