agenttesla | faf83abe9e43331e7186fac8394ced4d044a2398ecd66c125ba02a4040bf4b67

General

Target
b5eb9a47c96a3abb78285cc521969ef0_JaffaCakes118.exe
Size 1.7MB
Sample240617-aklq3azamn
SHA256 faf83abe9e43331e7186fac8394ced4d044a2398ecd66c125ba02a4040bf4b67
MD5 b5eb9a47c96a3abb78285cc521969ef0
SHA1 00c624b3e7e12c485fd5c76e1df9b6bca1648419
SHA512 8c4ce1c9e9a9da9403c840cd5856e0271a78dfabfe2a99a93f0a8ce5290295824a1aba56c18e776ea74ceeed56c11c3fce98f3a3ed6df935d14337f63fb65ee8
SSDEEP 24576:oAHnh+eWsN3skA4RV1Hom2KXSmdayTaKSEgJtMHlza78rz4lLOinapsK/s9KUk1M:vh+ZkldoPKi2ayUWH914tfaG9KUkxyF
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

agenttesla collection keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
smtp.yandex.com
Port
587
Username
[email protected]
Password
mike63976460

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla payload 1 IoCs

resource	yara_rule
behavioral2/memory/2572-1-0x0000000000400000-0x0000000000450000-memory.dmp	family_agenttesla

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe
Key opened	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe
Key opened	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GQBIf = "C:\\Users\\Admin\\AppData\\Roaming\\GQBIf\\GQBIf.exe"	RegAsm.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2468 set thread context of 2572	2468	b5eb9a47c96a3abb78285cc521969ef0_JaffaCakes118.exe	84

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2572	RegAsm.exe
2572	RegAsm.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2468	b5eb9a47c96a3abb78285cc521969ef0_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2572	RegAsm.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2468	b5eb9a47c96a3abb78285cc521969ef0_JaffaCakes118.exe
2468	b5eb9a47c96a3abb78285cc521969ef0_JaffaCakes118.exe
2468	b5eb9a47c96a3abb78285cc521969ef0_JaffaCakes118.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
2468	b5eb9a47c96a3abb78285cc521969ef0_JaffaCakes118.exe
2468	b5eb9a47c96a3abb78285cc521969ef0_JaffaCakes118.exe
2468	b5eb9a47c96a3abb78285cc521969ef0_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2572	RegAsm.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2468 wrote to memory of 2572	2468	b5eb9a47c96a3abb78285cc521969ef0_JaffaCakes118.exe	84
PID 2468 wrote to memory of 2572	2468	b5eb9a47c96a3abb78285cc521969ef0_JaffaCakes118.exe	84
PID 2468 wrote to memory of 2572	2468	b5eb9a47c96a3abb78285cc521969ef0_JaffaCakes118.exe	84
PID 2468 wrote to memory of 2572	2468	b5eb9a47c96a3abb78285cc521969ef0_JaffaCakes118.exe	84
PID 2572 wrote to memory of 4424	2572	RegAsm.exe	87
PID 2572 wrote to memory of 4424	2572	RegAsm.exe	87
PID 2572 wrote to memory of 4424	2572	RegAsm.exe	87

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe

C:\Users\Admin\AppData\Local\Temp\b5eb9a47c96a3abb78285cc521969ef0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b5eb9a47c96a3abb78285cc521969ef0_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2468
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
  "C:\\\\Windows\\\\Microsoft.NET\\\\Framework\\\\v2.0.50727\\\\RegAsm.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  - outlook_win_path
  PID:2572
- - C:\Windows\SysWOW64\netsh.exe
    "netsh" wlan show profile
    3⤵
    PID:4424