agenttesla | b67c98d61821c20cee68007e1c4dedcc40faae142361866e2340bba3c55f7b96

General

Target

f808d1fe0406d1f118f1d5bfc312b0a7_JaffaCakes118.exe
Size

844KB
MD5

f808d1fe0406d1f118f1d5bfc312b0a7
SHA1

1004d0ec9e9224216073c2a1ab254ad4bcaea2e9
SHA256

b67c98d61821c20cee68007e1c4dedcc40faae142361866e2340bba3c55f7b96
SHA512

dc298b0564134cc2c5743b43b2ae494bdb90686ac23e2ae8a0bda197f8bdb22178f548d6b3efd02e6ecabca5c4e712c4a9ae49847bfb62de324971ad20774b1d
SSDEEP

24576:nGPdnVamxuT7V11u14tlz3Vby3FtfnVN:nMdnVaQp14tlz3Vby3FtfnVN

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.unalanguvenlik.com
Port:
587
Username:
david.b@unalanguvenlik.com
Password:
selection2018

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4524-45-0x0000000000400000-0x0000000000450000-memory.dmp	family_agenttesla

Executes dropped EXE 1 IoCs

Processes:

winint.exe

pid process

3956 winint.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

winint.exe

description pid process target process

PID 3956 set thread context of 4524 3956 winint.exe AppLaunch.exe

pid	process
3956	winint.exe

description	pid	process	target process
PID 3956 set thread context of 4524	3956	winint.exe	AppLaunch.exe

Suspicious behavior: EnumeratesProcesses 27 IoCs

Processes:

f808d1fe0406d1f118f1d5bfc312b0a7_JaffaCakes118.exepowershell.exewinint.exeAppLaunch.exe

pid	process
4200	f808d1fe0406d1f118f1d5bfc312b0a7_JaffaCakes118.exe
4200	f808d1fe0406d1f118f1d5bfc312b0a7_JaffaCakes118.exe
4200	f808d1fe0406d1f118f1d5bfc312b0a7_JaffaCakes118.exe
4200	f808d1fe0406d1f118f1d5bfc312b0a7_JaffaCakes118.exe
4200	f808d1fe0406d1f118f1d5bfc312b0a7_JaffaCakes118.exe
4200	f808d1fe0406d1f118f1d5bfc312b0a7_JaffaCakes118.exe
4200	f808d1fe0406d1f118f1d5bfc312b0a7_JaffaCakes118.exe
4200	f808d1fe0406d1f118f1d5bfc312b0a7_JaffaCakes118.exe
4200	f808d1fe0406d1f118f1d5bfc312b0a7_JaffaCakes118.exe
4200	f808d1fe0406d1f118f1d5bfc312b0a7_JaffaCakes118.exe
4200	f808d1fe0406d1f118f1d5bfc312b0a7_JaffaCakes118.exe
4200	f808d1fe0406d1f118f1d5bfc312b0a7_JaffaCakes118.exe
4200	f808d1fe0406d1f118f1d5bfc312b0a7_JaffaCakes118.exe
4200	f808d1fe0406d1f118f1d5bfc312b0a7_JaffaCakes118.exe
4200	f808d1fe0406d1f118f1d5bfc312b0a7_JaffaCakes118.exe
4200	f808d1fe0406d1f118f1d5bfc312b0a7_JaffaCakes118.exe
4200	f808d1fe0406d1f118f1d5bfc312b0a7_JaffaCakes118.exe
4200	f808d1fe0406d1f118f1d5bfc312b0a7_JaffaCakes118.exe
4200	f808d1fe0406d1f118f1d5bfc312b0a7_JaffaCakes118.exe
4200	f808d1fe0406d1f118f1d5bfc312b0a7_JaffaCakes118.exe
4952	powershell.exe
4952	powershell.exe
3956	winint.exe
3956	winint.exe
3956	winint.exe
4524	AppLaunch.exe
4524	AppLaunch.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

f808d1fe0406d1f118f1d5bfc312b0a7_JaffaCakes118.exepowershell.exewinint.exeAppLaunch.exe

description	pid	process
Token: SeDebugPrivilege	4200	f808d1fe0406d1f118f1d5bfc312b0a7_JaffaCakes118.exe
Token: SeDebugPrivilege	4952	powershell.exe
Token: SeDebugPrivilege	3956	winint.exe
Token: SeDebugPrivilege	4524	AppLaunch.exe

Suspicious use of WriteProcessMemory 26 IoCs

Processes:

f808d1fe0406d1f118f1d5bfc312b0a7_JaffaCakes118.execmd.exepowershell.exewinint.execmd.exe

description	pid	process	target process
PID 4200 wrote to memory of 3880	4200	f808d1fe0406d1f118f1d5bfc312b0a7_JaffaCakes118.exe	cmd.exe
PID 4200 wrote to memory of 3880	4200	f808d1fe0406d1f118f1d5bfc312b0a7_JaffaCakes118.exe	cmd.exe
PID 4200 wrote to memory of 3880	4200	f808d1fe0406d1f118f1d5bfc312b0a7_JaffaCakes118.exe	cmd.exe
PID 3880 wrote to memory of 4376	3880	cmd.exe	reg.exe
PID 3880 wrote to memory of 4376	3880	cmd.exe	reg.exe
PID 3880 wrote to memory of 4376	3880	cmd.exe	reg.exe
PID 4200 wrote to memory of 4952	4200	f808d1fe0406d1f118f1d5bfc312b0a7_JaffaCakes118.exe	powershell.exe
PID 4200 wrote to memory of 4952	4200	f808d1fe0406d1f118f1d5bfc312b0a7_JaffaCakes118.exe	powershell.exe
PID 4200 wrote to memory of 4952	4200	f808d1fe0406d1f118f1d5bfc312b0a7_JaffaCakes118.exe	powershell.exe
PID 4952 wrote to memory of 3956	4952	powershell.exe	winint.exe
PID 4952 wrote to memory of 3956	4952	powershell.exe	winint.exe
PID 4952 wrote to memory of 3956	4952	powershell.exe	winint.exe
PID 3956 wrote to memory of 3816	3956	winint.exe	cmd.exe
PID 3956 wrote to memory of 3816	3956	winint.exe	cmd.exe
PID 3956 wrote to memory of 3816	3956	winint.exe	cmd.exe
PID 3816 wrote to memory of 3608	3816	cmd.exe	reg.exe
PID 3816 wrote to memory of 3608	3816	cmd.exe	reg.exe
PID 3816 wrote to memory of 3608	3816	cmd.exe	reg.exe
PID 3956 wrote to memory of 4524	3956	winint.exe	AppLaunch.exe
PID 3956 wrote to memory of 4524	3956	winint.exe	AppLaunch.exe
PID 3956 wrote to memory of 4524	3956	winint.exe	AppLaunch.exe
PID 3956 wrote to memory of 4524	3956	winint.exe	AppLaunch.exe
PID 3956 wrote to memory of 4524	3956	winint.exe	AppLaunch.exe
PID 3956 wrote to memory of 4524	3956	winint.exe	AppLaunch.exe
PID 3956 wrote to memory of 4524	3956	winint.exe	AppLaunch.exe
PID 3956 wrote to memory of 4524	3956	winint.exe	AppLaunch.exe

C:\Users\Admin\AppData\Local\Temp\f808d1fe0406d1f118f1d5bfc312b0a7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f808d1fe0406d1f118f1d5bfc312b0a7_JaffaCakes118.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4200

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /c REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v windows display manager /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Roaming\winint.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:3880

C:\Windows\SysWOW64\reg.exe
REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v windows display manager /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Roaming\winint.exe"
3⤵
PID:4376

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Process C:\Users\Admin\AppData\Roaming\winint.exe
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4952

C:\Users\Admin\AppData\Roaming\winint.exe
"C:\Users\Admin\AppData\Roaming\winint.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3956

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /c REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v windows display manager /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Roaming\winint.exe"
4⤵
- Suspicious use of WriteProcessMemory
PID:3816

C:\Windows\SysWOW64\reg.exe
REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v windows display manager /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Roaming\winint.exe"
5⤵
PID:3608

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4524

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_m2l23015.skt.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\winint.exe
Filesize
844KB

MD5
f808d1fe0406d1f118f1d5bfc312b0a7

SHA1
1004d0ec9e9224216073c2a1ab254ad4bcaea2e9

SHA256
b67c98d61821c20cee68007e1c4dedcc40faae142361866e2340bba3c55f7b96

SHA512
dc298b0564134cc2c5743b43b2ae494bdb90686ac23e2ae8a0bda197f8bdb22178f548d6b3efd02e6ecabca5c4e712c4a9ae49847bfb62de324971ad20774b1d

Download Submit
memory/3956-43-0x0000000074CC0000-0x0000000075470000-memory.dmp

Filesize
7.7MB

Download
memory/3956-40-0x0000000074CC0000-0x0000000075470000-memory.dmp

Filesize
7.7MB

Download
memory/3956-48-0x0000000074CC0000-0x0000000075470000-memory.dmp

Filesize
7.7MB

Download
memory/3956-44-0x0000000005350000-0x0000000005360000-memory.dmp

Filesize
64KB

Download
memory/3956-42-0x0000000005350000-0x0000000005360000-memory.dmp

Filesize
64KB

Download
memory/4200-1-0x0000000074CC0000-0x0000000075470000-memory.dmp

Filesize
7.7MB

Download
memory/4200-4-0x0000000004C10000-0x0000000004CA2000-memory.dmp

Filesize
584KB

Download
memory/4200-9-0x0000000004E00000-0x0000000004E10000-memory.dmp

Filesize
64KB

Download
memory/4200-2-0x0000000004A70000-0x0000000004A92000-memory.dmp

Filesize
136KB

Download
memory/4200-11-0x0000000074CC0000-0x0000000075470000-memory.dmp

Filesize
7.7MB

Download
memory/4200-12-0x0000000004E00000-0x0000000004E10000-memory.dmp

Filesize
64KB

Download
memory/4200-16-0x0000000074CC0000-0x0000000075470000-memory.dmp

Filesize
7.7MB

Download
memory/4200-3-0x0000000004B00000-0x0000000004B66000-memory.dmp

Filesize
408KB

Download
memory/4200-0-0x00000000000F0000-0x00000000001CA000-memory.dmp

Filesize
872KB

Download
memory/4200-8-0x0000000005600000-0x0000000005BA4000-memory.dmp

Filesize
5.6MB

Download
memory/4200-5-0x0000000004E80000-0x0000000005042000-memory.dmp

Filesize
1.8MB

Download
memory/4200-6-0x0000000004B70000-0x0000000004B92000-memory.dmp

Filesize
136KB

Download
memory/4200-7-0x0000000004BA0000-0x0000000004BC2000-memory.dmp

Filesize
136KB

Download
memory/4200-10-0x0000000005470000-0x00000000054B4000-memory.dmp

Filesize
272KB

Download
memory/4524-52-0x0000000074CC0000-0x0000000075470000-memory.dmp

Filesize
7.7MB

Download
memory/4524-47-0x0000000074CC0000-0x0000000075470000-memory.dmp

Filesize
7.7MB

Download
memory/4524-50-0x00000000053A0000-0x000000000543C000-memory.dmp

Filesize
624KB

Download
memory/4524-45-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/4524-49-0x00000000051C0000-0x00000000051D0000-memory.dmp

Filesize
64KB

Download
memory/4524-51-0x0000000005360000-0x0000000005378000-memory.dmp

Filesize
96KB

Download
memory/4524-53-0x00000000051C0000-0x00000000051D0000-memory.dmp

Filesize
64KB

Download
memory/4952-18-0x0000000000CE0000-0x0000000000CF0000-memory.dmp

Filesize
64KB

Download
memory/4952-41-0x0000000074CC0000-0x0000000075470000-memory.dmp

Filesize
7.7MB

Download
memory/4952-32-0x0000000005BA0000-0x0000000005BBE000-memory.dmp

Filesize
120KB

Download
memory/4952-35-0x0000000006070000-0x000000000608A000-memory.dmp

Filesize
104KB

Download
memory/4952-34-0x0000000006C40000-0x0000000006CD6000-memory.dmp

Filesize
600KB

Download
memory/4952-33-0x0000000005BF0000-0x0000000005C3C000-memory.dmp

Filesize
304KB

Download
memory/4952-21-0x0000000004C20000-0x0000000004C86000-memory.dmp

Filesize
408KB

Download
memory/4952-20-0x0000000004C90000-0x00000000052B8000-memory.dmp

Filesize
6.2MB

Download
memory/4952-19-0x0000000000CE0000-0x0000000000CF0000-memory.dmp

Filesize
64KB

Download
memory/4952-17-0x0000000074CC0000-0x0000000075470000-memory.dmp

Filesize
7.7MB

Download
memory/4952-31-0x0000000005560000-0x00000000058B4000-memory.dmp

Filesize
3.3MB

Download
memory/4952-15-0x0000000002280000-0x00000000022B6000-memory.dmp

Filesize
216KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads