agenttesla | 2732029a466cf6c066f468d43b058d2ccda9d0681f73e22f091bd2cf6372c9b1

Analysis

max time kernel
122s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
24/06/2024, 17:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

09ee0caf424df3b1070a23913fe3d016_JaffaCakes118.exe
Size

439KB
MD5

09ee0caf424df3b1070a23913fe3d016
SHA1

75edbc9eff06d5d15c907338c24ed6c2fcf58d61
SHA256

2732029a466cf6c066f468d43b058d2ccda9d0681f73e22f091bd2cf6372c9b1
SHA512

0d996f5ed0748fd8322ff7adbacd54f7b0f66f0b8d5944ab42eb2a5166e00aef074155f00a45cc00f8d576f2e87071a68c8ec111cf07b5477c77b94448519f87
SSDEEP

12288:C1z2V14oFNP0TShN1QbeSr9LK6jqPLeqjVVOScZ1w1:C1z2V14ojBNKjr9O0qPL5jmnw1

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

https://api.telegram.org/bot1463238323:AAGtI1JM_Kj38d1Y2cvi15DJ_j42pVQvMNI/sendDocument

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla payload 5 IoCs

resource	yara_rule
behavioral1/memory/2904-17-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/2904-21-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/2904-19-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/2904-13-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/2904-11-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1612 set thread context of 2904	1612	09ee0caf424df3b1070a23913fe3d016_JaffaCakes118.exe	30

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2904	09ee0caf424df3b1070a23913fe3d016_JaffaCakes118.exe
2904	09ee0caf424df3b1070a23913fe3d016_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2904	09ee0caf424df3b1070a23913fe3d016_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1612 wrote to memory of 2904	1612	09ee0caf424df3b1070a23913fe3d016_JaffaCakes118.exe	30
PID 1612 wrote to memory of 2904	1612	09ee0caf424df3b1070a23913fe3d016_JaffaCakes118.exe	30
PID 1612 wrote to memory of 2904	1612	09ee0caf424df3b1070a23913fe3d016_JaffaCakes118.exe	30
PID 1612 wrote to memory of 2904	1612	09ee0caf424df3b1070a23913fe3d016_JaffaCakes118.exe	30
PID 1612 wrote to memory of 2904	1612	09ee0caf424df3b1070a23913fe3d016_JaffaCakes118.exe	30
PID 1612 wrote to memory of 2904	1612	09ee0caf424df3b1070a23913fe3d016_JaffaCakes118.exe	30
PID 1612 wrote to memory of 2904	1612	09ee0caf424df3b1070a23913fe3d016_JaffaCakes118.exe	30
PID 1612 wrote to memory of 2904	1612	09ee0caf424df3b1070a23913fe3d016_JaffaCakes118.exe	30
PID 1612 wrote to memory of 2904	1612	09ee0caf424df3b1070a23913fe3d016_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\09ee0caf424df3b1070a23913fe3d016_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\09ee0caf424df3b1070a23913fe3d016_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Users\Admin\AppData\Local\Temp\09ee0caf424df3b1070a23913fe3d016_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\09ee0caf424df3b1070a23913fe3d016_JaffaCakes118.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2904

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1612-0-0x00000000742DE000-0x00000000742DF000-memory.dmp

Filesize
4KB

Download
memory/1612-1-0x0000000000830000-0x00000000008A4000-memory.dmp

Filesize
464KB

Download
memory/1612-2-0x00000000742D0000-0x00000000749BE000-memory.dmp

Filesize
6.9MB

Download
memory/1612-3-0x00000000005A0000-0x00000000005AA000-memory.dmp

Filesize
40KB

Download
memory/1612-4-0x00000000742DE000-0x00000000742DF000-memory.dmp

Filesize
4KB

Download
memory/1612-5-0x00000000742D0000-0x00000000749BE000-memory.dmp

Filesize
6.9MB

Download
memory/1612-6-0x00000000051D0000-0x000000000523C000-memory.dmp

Filesize
432KB

Download
memory/1612-24-0x00000000742D0000-0x00000000749BE000-memory.dmp

Filesize
6.9MB

Download
memory/2904-17-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2904-21-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2904-19-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2904-15-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2904-13-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2904-11-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2904-9-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2904-22-0x00000000742D0000-0x00000000749BE000-memory.dmp

Filesize
6.9MB

Download
memory/2904-23-0x00000000742D0000-0x00000000749BE000-memory.dmp

Filesize
6.9MB

Download
memory/2904-7-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2904-25-0x00000000742D0000-0x00000000749BE000-memory.dmp

Filesize
6.9MB

Download