agenttesla | 1cbb3fb595a28aa7551d0c4e5c50dc0a3f8efbb918534f4d1d6cabceee7bb80a

Analysis

max time kernel
140s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
24-06-2024 23:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0b464d037c923a4a3c8735d610fb86b9_JaffaCakes118.exe
Size

696KB
MD5

0b464d037c923a4a3c8735d610fb86b9
SHA1

b4d28f06c20daeec9907c69bd068f75219c6fbbe
SHA256

1cbb3fb595a28aa7551d0c4e5c50dc0a3f8efbb918534f4d1d6cabceee7bb80a
SHA512

4d391a7aa16cce8e7d4ce73e4584034b29f41dfc8394f960b36bc10cfcab7c5e1d0d10655bbc3d50c37f6ef658f1aa81cb5f31fb1352a642cbc2b8f9bf88ac6e
SSDEEP

12288:Oy3N+70pKXQlNhGTLkM8jaQ9kWflw480+sDpjhh+0dn1LFzJ:h0TLk7aDah8M5h8q1LFz

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.vietthinhfumiture.com
Port:
587
Username:
[email protected]
Password:
FD(jEPr0

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla payload 1 IoCs

resource	yara_rule
behavioral2/memory/3976-12-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3508 set thread context of 3976	3508	0b464d037c923a4a3c8735d610fb86b9_JaffaCakes118.exe	100

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3976	0b464d037c923a4a3c8735d610fb86b9_JaffaCakes118.exe
3976	0b464d037c923a4a3c8735d610fb86b9_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3976	0b464d037c923a4a3c8735d610fb86b9_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3508 wrote to memory of 3976	3508	0b464d037c923a4a3c8735d610fb86b9_JaffaCakes118.exe	100
PID 3508 wrote to memory of 3976	3508	0b464d037c923a4a3c8735d610fb86b9_JaffaCakes118.exe	100
PID 3508 wrote to memory of 3976	3508	0b464d037c923a4a3c8735d610fb86b9_JaffaCakes118.exe	100
PID 3508 wrote to memory of 3976	3508	0b464d037c923a4a3c8735d610fb86b9_JaffaCakes118.exe	100
PID 3508 wrote to memory of 3976	3508	0b464d037c923a4a3c8735d610fb86b9_JaffaCakes118.exe	100
PID 3508 wrote to memory of 3976	3508	0b464d037c923a4a3c8735d610fb86b9_JaffaCakes118.exe	100
PID 3508 wrote to memory of 3976	3508	0b464d037c923a4a3c8735d610fb86b9_JaffaCakes118.exe	100
PID 3508 wrote to memory of 3976	3508	0b464d037c923a4a3c8735d610fb86b9_JaffaCakes118.exe	100

C:\Users\Admin\AppData\Local\Temp\0b464d037c923a4a3c8735d610fb86b9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0b464d037c923a4a3c8735d610fb86b9_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3508
- C:\Users\Admin\AppData\Local\Temp\0b464d037c923a4a3c8735d610fb86b9_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\0b464d037c923a4a3c8735d610fb86b9_JaffaCakes118.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3976

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3808 --field-trial-handle=2280,i,716736634476467098,11449718822158202904,262144 --variations-seed-version /prefetch:8
1⤵
PID:3272

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\0b464d037c923a4a3c8735d610fb86b9_JaffaCakes118.exe.log

Filesize
1KB

MD5
17573558c4e714f606f997e5157afaac

SHA1
13e16e9415ceef429aaf124139671ebeca09ed23

SHA256
c18db6aecad2436da4a63ff26af4e3a337cca48f01c21b8db494fe5ccc60e553

SHA512
f4edf13f05a0d142e4dd42802098c8c44988ee8869621a62c2b565a77c9a95857f636583ff8d6d9baa366603d98b9bfbf1fc75bc6f9f8f83c80cb1215b2941cc

Download Submit
memory/3508-10-0x00000000747C0000-0x0000000074F70000-memory.dmp

Filesize
7.7MB

Download
memory/3508-17-0x00000000747C0000-0x0000000074F70000-memory.dmp

Filesize
7.7MB

Download
memory/3508-9-0x00000000747CE000-0x00000000747CF000-memory.dmp

Filesize
4KB

Download
memory/3508-4-0x0000000005220000-0x00000000052B2000-memory.dmp

Filesize
584KB

Download
memory/3508-5-0x00000000747C0000-0x0000000074F70000-memory.dmp

Filesize
7.7MB

Download
memory/3508-6-0x0000000005180000-0x000000000518A000-memory.dmp

Filesize
40KB

Download
memory/3508-7-0x00000000052C0000-0x0000000005316000-memory.dmp

Filesize
344KB

Download
memory/3508-8-0x00000000055E0000-0x00000000055EA000-memory.dmp

Filesize
40KB

Download
memory/3508-3-0x0000000005730000-0x0000000005CD4000-memory.dmp

Filesize
5.6MB

Download
memory/3508-2-0x00000000050E0000-0x000000000517C000-memory.dmp

Filesize
624KB

Download
memory/3508-0-0x00000000747CE000-0x00000000747CF000-memory.dmp

Filesize
4KB

Download
memory/3508-11-0x00000000010D0000-0x0000000001144000-memory.dmp

Filesize
464KB

Download
memory/3508-1-0x0000000000670000-0x0000000000724000-memory.dmp

Filesize
720KB

Download
memory/3976-20-0x00000000747C0000-0x0000000074F70000-memory.dmp

Filesize
7.7MB

Download
memory/3976-16-0x00000000747C0000-0x0000000074F70000-memory.dmp

Filesize
7.7MB

Download
memory/3976-15-0x00000000747C0000-0x0000000074F70000-memory.dmp

Filesize
7.7MB

Download
memory/3976-18-0x00000000058B0000-0x00000000058C8000-memory.dmp

Filesize
96KB

Download
memory/3976-19-0x00000000066D0000-0x0000000006736000-memory.dmp

Filesize
408KB

Download
memory/3976-12-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download