agenttesla | 5f72eaac08827dde28d9fb7e945856329d8e06a5557557f300ae67b13f967745

General

Target

5fc640b52af0bd71a56f22622520e2f5_JaffaCakes118.exe
Size

1.9MB
MD5

5fc640b52af0bd71a56f22622520e2f5
SHA1

52ef9db0719881a02d5d56b28c499607bccd6d95
SHA256

5f72eaac08827dde28d9fb7e945856329d8e06a5557557f300ae67b13f967745
SHA512

ca65d050aeff678152d6694c8c5e4c39d724a7fe953e757f7d9f038f61d330a7ebfd51e9776cbeab9bc289c10c08d1275ec8c98687f51cb262c7dd4f30c0567f
SSDEEP

24576:iavuwCYVVVxg7y61og65VQUUaoEp9W64UJKW1mPLFeCXDMDYA:zvZTVD61SVVW64UJKW1mPLFeCXDMDYA

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.shakurjay.com
Port:
587
Username:
[email protected]
Password:
zpwXtxm7

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla payload 5 IoCs

resource	yara_rule
behavioral1/memory/2616-17-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/2616-15-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/2616-13-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/2616-9-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/2616-7-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1048 set thread context of 2616	1048	5fc640b52af0bd71a56f22622520e2f5_JaffaCakes118.exe	31

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2616	5fc640b52af0bd71a56f22622520e2f5_JaffaCakes118.exe
2616	5fc640b52af0bd71a56f22622520e2f5_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2616	5fc640b52af0bd71a56f22622520e2f5_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1048 wrote to memory of 2616	1048	5fc640b52af0bd71a56f22622520e2f5_JaffaCakes118.exe	31
PID 1048 wrote to memory of 2616	1048	5fc640b52af0bd71a56f22622520e2f5_JaffaCakes118.exe	31
PID 1048 wrote to memory of 2616	1048	5fc640b52af0bd71a56f22622520e2f5_JaffaCakes118.exe	31
PID 1048 wrote to memory of 2616	1048	5fc640b52af0bd71a56f22622520e2f5_JaffaCakes118.exe	31
PID 1048 wrote to memory of 2616	1048	5fc640b52af0bd71a56f22622520e2f5_JaffaCakes118.exe	31
PID 1048 wrote to memory of 2616	1048	5fc640b52af0bd71a56f22622520e2f5_JaffaCakes118.exe	31
PID 1048 wrote to memory of 2616	1048	5fc640b52af0bd71a56f22622520e2f5_JaffaCakes118.exe	31
PID 1048 wrote to memory of 2616	1048	5fc640b52af0bd71a56f22622520e2f5_JaffaCakes118.exe	31
PID 1048 wrote to memory of 2616	1048	5fc640b52af0bd71a56f22622520e2f5_JaffaCakes118.exe	31
PID 2616 wrote to memory of 1780	2616	5fc640b52af0bd71a56f22622520e2f5_JaffaCakes118.exe	32
PID 2616 wrote to memory of 1780	2616	5fc640b52af0bd71a56f22622520e2f5_JaffaCakes118.exe	32
PID 2616 wrote to memory of 1780	2616	5fc640b52af0bd71a56f22622520e2f5_JaffaCakes118.exe	32
PID 2616 wrote to memory of 1780	2616	5fc640b52af0bd71a56f22622520e2f5_JaffaCakes118.exe	32

C:\Users\Admin\AppData\Local\Temp\5fc640b52af0bd71a56f22622520e2f5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5fc640b52af0bd71a56f22622520e2f5_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1048
- C:\Users\Admin\AppData\Local\Temp\5fc640b52af0bd71a56f22622520e2f5_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\5fc640b52af0bd71a56f22622520e2f5_JaffaCakes118.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2616
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
    dw20.exe -x -s 516
    3⤵
    PID:1780

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1048-0-0x0000000074131000-0x0000000074132000-memory.dmp

Filesize
4KB

Download
memory/1048-1-0x0000000074130000-0x00000000746DB000-memory.dmp

Filesize
5.7MB

Download
memory/1048-2-0x0000000074130000-0x00000000746DB000-memory.dmp

Filesize
5.7MB

Download
memory/1048-3-0x0000000074130000-0x00000000746DB000-memory.dmp

Filesize
5.7MB

Download
memory/1048-4-0x0000000074130000-0x00000000746DB000-memory.dmp

Filesize
5.7MB

Download
memory/1048-19-0x0000000074130000-0x00000000746DB000-memory.dmp

Filesize
5.7MB

Download
memory/1780-21-0x00000000003D0000-0x00000000003D1000-memory.dmp

Filesize
4KB

Download
memory/2616-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2616-13-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2616-9-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2616-7-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2616-6-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2616-5-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2616-18-0x0000000074130000-0x00000000746DB000-memory.dmp

Filesize
5.7MB

Download
memory/2616-20-0x0000000074130000-0x00000000746DB000-memory.dmp

Filesize
5.7MB

Download
memory/2616-15-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2616-17-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2616-22-0x0000000074130000-0x00000000746DB000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing