agenttesla | 8331e9eaaa9b2296086c9b8e32c8a6146719c81dd48503a974615135cdbf73ef

General

Target

359780d66d0e8a4ec780199a5a3b0455_JaffaCakes118.exe
Size

862KB
MD5

359780d66d0e8a4ec780199a5a3b0455
SHA1

726cd9787b0d7642646bdb74f5f39fe842afb86a
SHA256

8331e9eaaa9b2296086c9b8e32c8a6146719c81dd48503a974615135cdbf73ef
SHA512

344f1f18e595582a40525c3bafd30924470287b32b75f52cd7a9659d6ce06eff9017e4e94cbac401ef9e64bd28a91ed7cc4363619b0cd5c5166a3d3673adfb82
SSDEEP

24576:zC0khGMNjrp2i1uSNRT09JNXd/3s74x7:vkVh13uSH0dXd/3sY

Score

10^/10

agenttesla discovery keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.privateemail.com
Port:
587
Username:
[email protected]
Password:
snookiep@123

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla payload 1 IoCs

resource	yara_rule
behavioral2/memory/1716-18-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	359780d66d0e8a4ec780199a5a3b0455_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\newapp = "C:\\Users\\Admin\\AppData\\Roaming\\newapp\\newapp.exe"	359780d66d0e8a4ec780199a5a3b0455_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3336 set thread context of 1716	3336	359780d66d0e8a4ec780199a5a3b0455_JaffaCakes118.exe	94

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	359780d66d0e8a4ec780199a5a3b0455_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	359780d66d0e8a4ec780199a5a3b0455_JaffaCakes118.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1908	schtasks.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3336	359780d66d0e8a4ec780199a5a3b0455_JaffaCakes118.exe
1716	359780d66d0e8a4ec780199a5a3b0455_JaffaCakes118.exe
1716	359780d66d0e8a4ec780199a5a3b0455_JaffaCakes118.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1716	359780d66d0e8a4ec780199a5a3b0455_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3336	359780d66d0e8a4ec780199a5a3b0455_JaffaCakes118.exe
Token: SeDebugPrivilege	1716	359780d66d0e8a4ec780199a5a3b0455_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3336 wrote to memory of 1908	3336	359780d66d0e8a4ec780199a5a3b0455_JaffaCakes118.exe	92
PID 3336 wrote to memory of 1908	3336	359780d66d0e8a4ec780199a5a3b0455_JaffaCakes118.exe	92
PID 3336 wrote to memory of 1908	3336	359780d66d0e8a4ec780199a5a3b0455_JaffaCakes118.exe	92
PID 3336 wrote to memory of 1716	3336	359780d66d0e8a4ec780199a5a3b0455_JaffaCakes118.exe	94
PID 3336 wrote to memory of 1716	3336	359780d66d0e8a4ec780199a5a3b0455_JaffaCakes118.exe	94
PID 3336 wrote to memory of 1716	3336	359780d66d0e8a4ec780199a5a3b0455_JaffaCakes118.exe	94
PID 3336 wrote to memory of 1716	3336	359780d66d0e8a4ec780199a5a3b0455_JaffaCakes118.exe	94
PID 3336 wrote to memory of 1716	3336	359780d66d0e8a4ec780199a5a3b0455_JaffaCakes118.exe	94
PID 3336 wrote to memory of 1716	3336	359780d66d0e8a4ec780199a5a3b0455_JaffaCakes118.exe	94
PID 3336 wrote to memory of 1716	3336	359780d66d0e8a4ec780199a5a3b0455_JaffaCakes118.exe	94
PID 3336 wrote to memory of 1716	3336	359780d66d0e8a4ec780199a5a3b0455_JaffaCakes118.exe	94

C:\Users\Admin\AppData\Local\Temp\359780d66d0e8a4ec780199a5a3b0455_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\359780d66d0e8a4ec780199a5a3b0455_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3336
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\SmngqGmYYGY" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB949.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:1908
- C:\Users\Admin\AppData\Local\Temp\359780d66d0e8a4ec780199a5a3b0455_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\359780d66d0e8a4ec780199a5a3b0455_JaffaCakes118.exe"
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: RenamesItself
  - Suspicious use of AdjustPrivilegeToken
  PID:1716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\359780d66d0e8a4ec780199a5a3b0455_JaffaCakes118.exe.log

Filesize
1KB

MD5
0935be101a4e34e520699d3f1974faed

SHA1
f0cafba784073a280996f5751994b4b856938859

SHA256
3f22b8f1925056e79638708d82cb8ebdaf22d409bcea2a79fe779cef2665583d

SHA512
3fd2236ac414612432c52ca9c810ce148a52678c04eac04e470fb1c4a918a6aaf4f55a31b73697c7b05a23d031bc428b309cbd93b4534fe789d10613f5ef123b

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpB949.tmp

Filesize
1KB

MD5
d05127dc03369cd4ad0351e40a31f3e9

SHA1
9c1afc2a6609d7e6091aa57eb87e974ece557803

SHA256
75755de1c4b4da04a14848d5ef5e255a2fc5b4a9ef174eb708a66cd79c43ec2d

SHA512
4a57133e729e52c0e91bcab297e1905b32108f491cbb0d7198b5a36a046c0803da861856a05f6c927dd21410ab5cfea21ade4d9b8ba485555540cbdd24de25d5

Download Submit
C:\Users\Admin\AppData\Roaming\newapp\newapp.exe

Filesize
862KB

MD5
359780d66d0e8a4ec780199a5a3b0455

SHA1
726cd9787b0d7642646bdb74f5f39fe842afb86a

SHA256
8331e9eaaa9b2296086c9b8e32c8a6146719c81dd48503a974615135cdbf73ef

SHA512
344f1f18e595582a40525c3bafd30924470287b32b75f52cd7a9659d6ce06eff9017e4e94cbac401ef9e64bd28a91ed7cc4363619b0cd5c5166a3d3673adfb82

Download Submit
memory/1716-27-0x00000000753A0000-0x0000000075B50000-memory.dmp

Filesize
7.7MB

Download
memory/1716-26-0x00000000753A0000-0x0000000075B50000-memory.dmp

Filesize
7.7MB

Download
memory/1716-25-0x0000000006090000-0x00000000060F6000-memory.dmp

Filesize
408KB

Download
memory/1716-24-0x00000000052F0000-0x0000000005308000-memory.dmp

Filesize
96KB

Download
memory/1716-23-0x00000000753A0000-0x0000000075B50000-memory.dmp

Filesize
7.7MB

Download
memory/1716-21-0x00000000753A0000-0x0000000075B50000-memory.dmp

Filesize
7.7MB

Download
memory/1716-18-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3336-6-0x00000000753A0000-0x0000000075B50000-memory.dmp

Filesize
7.7MB

Download
memory/3336-22-0x00000000753A0000-0x0000000075B50000-memory.dmp

Filesize
7.7MB

Download
memory/3336-12-0x00000000090E0000-0x000000000911C000-memory.dmp

Filesize
240KB

Download
memory/3336-10-0x00000000753A0000-0x0000000075B50000-memory.dmp

Filesize
7.7MB

Download
memory/3336-9-0x00000000753AE000-0x00000000753AF000-memory.dmp

Filesize
4KB

Download
memory/3336-8-0x0000000006620000-0x0000000006974000-memory.dmp

Filesize
3.3MB

Download
memory/3336-7-0x00000000052E0000-0x00000000052FA000-memory.dmp

Filesize
104KB

Download
memory/3336-11-0x0000000006A90000-0x0000000006B32000-memory.dmp

Filesize
648KB

Download
memory/3336-0-0x00000000753AE000-0x00000000753AF000-memory.dmp

Filesize
4KB

Download
memory/3336-5-0x0000000004F70000-0x0000000004F7A000-memory.dmp

Filesize
40KB

Download
memory/3336-4-0x0000000004FF0000-0x000000000508C000-memory.dmp

Filesize
624KB

Download
memory/3336-3-0x0000000004E90000-0x0000000004F22000-memory.dmp

Filesize
584KB

Download
memory/3336-2-0x0000000005500000-0x0000000005AA4000-memory.dmp

Filesize
5.6MB

Download
memory/3336-1-0x0000000000420000-0x00000000004FC000-memory.dmp

Filesize
880KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads