Analysis
-
max time kernel
136s -
max time network
134s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 22:58
Static task
static1
Behavioral task
behavioral1
Sample
6c8b4064ab664708e7723cb1aad27294_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
6c8b4064ab664708e7723cb1aad27294_JaffaCakes118.exe
Resource
win10v2004-20240426-en
General
-
Target
6c8b4064ab664708e7723cb1aad27294_JaffaCakes118.exe
-
Size
395KB
-
MD5
6c8b4064ab664708e7723cb1aad27294
-
SHA1
2d525542f95fdc8a4a93793f5780101ae65ce5fa
-
SHA256
ee279c6b7a4debbd93a6aea65ad694d611fd54865a4af2afe304a284d13fa633
-
SHA512
57eabf864ebaa9b1265b23077c0b11c1b79a7f27e632ff8c755a153765423119526fc63077452bd452c4b9236668c8ce331b4fd96fb751e215e8e73939cd70a0
-
SSDEEP
6144:wJZj3XBjlkq27zgxR3pB/PtLwag4j1vkF5vaa2HjUSpu:4zZo7cv5BXdwafkFVaRH
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot1160330796:AAF3SAwgW-OTi9M5kDhSZUlENwhKRvFOWe8/sendDocument
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/856-207-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla -
Executes dropped EXE 1 IoCs
Processes:
AddInProcess32.exepid process 856 AddInProcess32.exe -
Loads dropped DLL 1 IoCs
Processes:
6c8b4064ab664708e7723cb1aad27294_JaffaCakes118.exepid process 3144 6c8b4064ab664708e7723cb1aad27294_JaffaCakes118.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
AddInProcess32.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AddInProcess32.exe Key opened \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AddInProcess32.exe Key opened \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AddInProcess32.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
AddInProcess32.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GnWfumZ = "C:\\Users\\Admin\\AppData\\Roaming\\GnWfumZ\\GnWfumZ.exe" AddInProcess32.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 66 api.ipify.org 67 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
6c8b4064ab664708e7723cb1aad27294_JaffaCakes118.exedescription pid process target process PID 3144 set thread context of 856 3144 6c8b4064ab664708e7723cb1aad27294_JaffaCakes118.exe AddInProcess32.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
6c8b4064ab664708e7723cb1aad27294_JaffaCakes118.exeAddInProcess32.exepid process 3144 6c8b4064ab664708e7723cb1aad27294_JaffaCakes118.exe 856 AddInProcess32.exe 856 AddInProcess32.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
6c8b4064ab664708e7723cb1aad27294_JaffaCakes118.exeAddInProcess32.exedescription pid process Token: SeDebugPrivilege 3144 6c8b4064ab664708e7723cb1aad27294_JaffaCakes118.exe Token: SeDebugPrivilege 856 AddInProcess32.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
AddInProcess32.exepid process 856 AddInProcess32.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
6c8b4064ab664708e7723cb1aad27294_JaffaCakes118.exedescription pid process target process PID 3144 wrote to memory of 856 3144 6c8b4064ab664708e7723cb1aad27294_JaffaCakes118.exe AddInProcess32.exe PID 3144 wrote to memory of 856 3144 6c8b4064ab664708e7723cb1aad27294_JaffaCakes118.exe AddInProcess32.exe PID 3144 wrote to memory of 856 3144 6c8b4064ab664708e7723cb1aad27294_JaffaCakes118.exe AddInProcess32.exe PID 3144 wrote to memory of 856 3144 6c8b4064ab664708e7723cb1aad27294_JaffaCakes118.exe AddInProcess32.exe PID 3144 wrote to memory of 856 3144 6c8b4064ab664708e7723cb1aad27294_JaffaCakes118.exe AddInProcess32.exe PID 3144 wrote to memory of 856 3144 6c8b4064ab664708e7723cb1aad27294_JaffaCakes118.exe AddInProcess32.exe PID 3144 wrote to memory of 856 3144 6c8b4064ab664708e7723cb1aad27294_JaffaCakes118.exe AddInProcess32.exe PID 3144 wrote to memory of 856 3144 6c8b4064ab664708e7723cb1aad27294_JaffaCakes118.exe AddInProcess32.exe -
outlook_office_path 1 IoCs
Processes:
AddInProcess32.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AddInProcess32.exe -
outlook_win_path 1 IoCs
Processes:
AddInProcess32.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AddInProcess32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6c8b4064ab664708e7723cb1aad27294_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\6c8b4064ab664708e7723cb1aad27294_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"2⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exeFilesize
42KB
MD59827ff3cdf4b83f9c86354606736ca9c
SHA1e73d73f42bb2a310f03eb1bcbb22be2b8eb7c723
SHA256c1cf3dc8fa1c7fc00f88e07ad539979b3706ca8d69223cffd1d58bc8f521f63a
SHA5128261828d55f3b5134c0aeb98311c04e20c5395d4347251746f3be0fb854f36cc7e118713cd00c9867537e6e47d5e71f2b2384fc00c67f0ae1b285b8310321579
-
C:\Users\Admin\AppData\Local\Temp\a6a0b8a6-4761-4357-9a31-0eca6ad70093\f.dllFilesize
94KB
MD514ff402962ad21b78ae0b4c43cd1f194
SHA1f8a510eb26666e875a5bdd1cadad40602763ad72
SHA256fb9646cb956945bdc503e69645f6b5316d3826b780d3c36738d6b944e884d15b
SHA512daa7a08bf3709119a944bce28f6ebdd24e54a22b18cd9f86a87873e958df121a3881dcdd5e162f6b4e543238c7aef20f657c9830df01d4c79290f7c9a4fcc54b
-
memory/856-206-0x00000000752B0000-0x0000000075A60000-memory.dmpFilesize
7.7MB
-
memory/856-207-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/856-208-0x00000000752B0000-0x0000000075A60000-memory.dmpFilesize
7.7MB
-
memory/856-217-0x00000000752B0000-0x0000000075A60000-memory.dmpFilesize
7.7MB
-
memory/856-216-0x0000000007080000-0x000000000708A000-memory.dmpFilesize
40KB
-
memory/856-215-0x0000000007030000-0x0000000007080000-memory.dmpFilesize
320KB
-
memory/856-214-0x00000000752B0000-0x0000000075A60000-memory.dmpFilesize
7.7MB
-
memory/856-211-0x00000000066C0000-0x0000000006726000-memory.dmpFilesize
408KB
-
memory/856-210-0x0000000006610000-0x0000000006628000-memory.dmpFilesize
96KB
-
memory/856-209-0x0000000005A20000-0x0000000005ABC000-memory.dmpFilesize
624KB
-
memory/3144-44-0x0000000002850000-0x0000000002875000-memory.dmpFilesize
148KB
-
memory/3144-28-0x0000000002850000-0x0000000002875000-memory.dmpFilesize
148KB
-
memory/3144-74-0x0000000002850000-0x0000000002875000-memory.dmpFilesize
148KB
-
memory/3144-70-0x0000000002850000-0x0000000002875000-memory.dmpFilesize
148KB
-
memory/3144-68-0x0000000002850000-0x0000000002875000-memory.dmpFilesize
148KB
-
memory/3144-67-0x0000000002850000-0x0000000002875000-memory.dmpFilesize
148KB
-
memory/3144-64-0x0000000002850000-0x0000000002875000-memory.dmpFilesize
148KB
-
memory/3144-62-0x0000000002850000-0x0000000002875000-memory.dmpFilesize
148KB
-
memory/3144-60-0x0000000002850000-0x0000000002875000-memory.dmpFilesize
148KB
-
memory/3144-58-0x0000000002850000-0x0000000002875000-memory.dmpFilesize
148KB
-
memory/3144-56-0x0000000002850000-0x0000000002875000-memory.dmpFilesize
148KB
-
memory/3144-54-0x0000000002850000-0x0000000002875000-memory.dmpFilesize
148KB
-
memory/3144-52-0x0000000002850000-0x0000000002875000-memory.dmpFilesize
148KB
-
memory/3144-50-0x0000000002850000-0x0000000002875000-memory.dmpFilesize
148KB
-
memory/3144-48-0x0000000002850000-0x0000000002875000-memory.dmpFilesize
148KB
-
memory/3144-46-0x0000000002850000-0x0000000002875000-memory.dmpFilesize
148KB
-
memory/3144-72-0x0000000002850000-0x0000000002875000-memory.dmpFilesize
148KB
-
memory/3144-42-0x0000000002850000-0x0000000002875000-memory.dmpFilesize
148KB
-
memory/3144-38-0x0000000002850000-0x0000000002875000-memory.dmpFilesize
148KB
-
memory/3144-36-0x0000000002850000-0x0000000002875000-memory.dmpFilesize
148KB
-
memory/3144-34-0x0000000002850000-0x0000000002875000-memory.dmpFilesize
148KB
-
memory/3144-32-0x0000000002850000-0x0000000002875000-memory.dmpFilesize
148KB
-
memory/3144-30-0x0000000002850000-0x0000000002875000-memory.dmpFilesize
148KB
-
memory/3144-76-0x0000000002850000-0x0000000002875000-memory.dmpFilesize
148KB
-
memory/3144-26-0x0000000002850000-0x0000000002875000-memory.dmpFilesize
148KB
-
memory/3144-24-0x0000000002850000-0x0000000002875000-memory.dmpFilesize
148KB
-
memory/3144-22-0x0000000002850000-0x0000000002875000-memory.dmpFilesize
148KB
-
memory/3144-14-0x000000006FF00000-0x000000006FF89000-memory.dmpFilesize
548KB
-
memory/3144-15-0x0000000002850000-0x0000000002875000-memory.dmpFilesize
148KB
-
memory/3144-40-0x0000000002850000-0x0000000002875000-memory.dmpFilesize
148KB
-
memory/3144-20-0x0000000002850000-0x0000000002875000-memory.dmpFilesize
148KB
-
memory/3144-18-0x0000000002850000-0x0000000002875000-memory.dmpFilesize
148KB
-
memory/3144-16-0x0000000002850000-0x0000000002875000-memory.dmpFilesize
148KB
-
memory/3144-195-0x00000000752BE000-0x00000000752BF000-memory.dmpFilesize
4KB
-
memory/3144-196-0x00000000752B0000-0x0000000075A60000-memory.dmpFilesize
7.7MB
-
memory/3144-197-0x00000000752B0000-0x0000000075A60000-memory.dmpFilesize
7.7MB
-
memory/3144-5-0x0000000004ED0000-0x0000000004F14000-memory.dmpFilesize
272KB
-
memory/3144-6-0x0000000005040000-0x00000000050D2000-memory.dmpFilesize
584KB
-
memory/3144-3-0x00000000752B0000-0x0000000075A60000-memory.dmpFilesize
7.7MB
-
memory/3144-4-0x0000000005550000-0x0000000005AF4000-memory.dmpFilesize
5.6MB
-
memory/3144-2-0x0000000002850000-0x000000000287C000-memory.dmpFilesize
176KB
-
memory/3144-1-0x0000000000480000-0x00000000004EA000-memory.dmpFilesize
424KB
-
memory/3144-0-0x00000000752BE000-0x00000000752BF000-memory.dmpFilesize
4KB
-
memory/3144-199-0x0000000006B80000-0x0000000006B8C000-memory.dmpFilesize
48KB
-
memory/3144-205-0x00000000752B0000-0x0000000075A60000-memory.dmpFilesize
7.7MB