Analysis

  • max time kernel
    144s
  • max time network
    96s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16-09-2024 06:46

General

  • Target

    e4376f930649066f6616f4701e8793fe_JaffaCakes118.exe

  • Size

    819KB

  • MD5

    e4376f930649066f6616f4701e8793fe

  • SHA1

    f3b69714acd37bdf5d0021d0ccca2dbd58a41dee

  • SHA256

    acf8e588808d06c6e5ab45187f753aa03a2a38a176a220749885bf1d5651c874

  • SHA512

    a978fa4d3fc086e64e6e8bfe4daf7103596bc9404df5ec8eb81b9607eee86e9b0ae9c3bdbdfaba8948f8fcb27a44cb47197c9992e2f8a33baec1f6566bb65263

  • SSDEEP

    12288:RLfZIethKajTaWoj9p+SORQhcvqWC+ZqglbOlKOM99:7Ieth1a/PF/n4bX9

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    mail.pars-science.ir
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    y&7nup,*CQLa

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • AgentTesla payload 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e4376f930649066f6616f4701e8793fe_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\e4376f930649066f6616f4701e8793fe_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1944
    • C:\Users\Admin\AppData\Local\Temp\e4376f930649066f6616f4701e8793fe_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\e4376f930649066f6616f4701e8793fe_JaffaCakes118.exe"
      2⤵
        PID:4084
      • C:\Users\Admin\AppData\Local\Temp\e4376f930649066f6616f4701e8793fe_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\e4376f930649066f6616f4701e8793fe_JaffaCakes118.exe"
        2⤵
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2888

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\e4376f930649066f6616f4701e8793fe_JaffaCakes118.exe.log

      Filesize

      594B

      MD5

      fdb26b3b547022b45cfaeee57eafd566

      SHA1

      11c6798b8a59233f404014c5e79b3363cd564b37

      SHA256

      2707fc7f074413881b7bafca05079327b188db6005709951e7f69d39a2af97c0

      SHA512

      44d9bb8c0f0b341690d00eda86e15a50f7f29ce9595925c1a2a7e19ad26202d10049a7a97bea278ecb7d429ad555de8edceeffff664d4b06309a9410a09bb700

    • memory/1944-1-0x00000000746F0000-0x0000000074CA1000-memory.dmp

      Filesize

      5.7MB

    • memory/1944-2-0x00000000746F0000-0x0000000074CA1000-memory.dmp

      Filesize

      5.7MB

    • memory/1944-3-0x00000000746F2000-0x00000000746F3000-memory.dmp

      Filesize

      4KB

    • memory/1944-4-0x00000000746F0000-0x0000000074CA1000-memory.dmp

      Filesize

      5.7MB

    • memory/1944-10-0x00000000746F0000-0x0000000074CA1000-memory.dmp

      Filesize

      5.7MB

    • memory/1944-0-0x00000000746F2000-0x00000000746F3000-memory.dmp

      Filesize

      4KB

    • memory/2888-8-0x00000000746F0000-0x0000000074CA1000-memory.dmp

      Filesize

      5.7MB

    • memory/2888-5-0x0000000000400000-0x000000000043C000-memory.dmp

      Filesize

      240KB

    • memory/2888-9-0x00000000746F0000-0x0000000074CA1000-memory.dmp

      Filesize

      5.7MB

    • memory/2888-11-0x00000000746F0000-0x0000000074CA1000-memory.dmp

      Filesize

      5.7MB

    • memory/2888-12-0x00000000746F0000-0x0000000074CA1000-memory.dmp

      Filesize

      5.7MB

    • memory/2888-13-0x00000000746F0000-0x0000000074CA1000-memory.dmp

      Filesize

      5.7MB

    • memory/2888-14-0x00000000746F0000-0x0000000074CA1000-memory.dmp

      Filesize

      5.7MB