agenttesla | 6fbf92e7feb171af3ba08bfc6a87cdd5f6226a2b7a38c3b586fc677464774974

General

Target

493dc3802cad640021e2a78ba2bd270c_JaffaCakes118.exe
Size

572KB
MD5

493dc3802cad640021e2a78ba2bd270c
SHA1

c79f9d5a3953db71e44a89a5185abf81586ce812
SHA256

6fbf92e7feb171af3ba08bfc6a87cdd5f6226a2b7a38c3b586fc677464774974
SHA512

2de1d744500854e60446e3146058a8a9979f0b1dd6b30b1a6dfdf0fd582db42876fefd1e51a360db94b84981e4048781ebf70de571c4168474d010e1c275a8d7
SSDEEP

6144:Qj0QBlWjrvtRcOLFvMPuQ+A5yPDsyfG+H0DWOEFHWu+Q5C0/HAJPnuXU4gl/AM73:5RcGCNyPffGNrEgLyJAJPukFV3+n

Score

10^/10

agenttesla discovery keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.emergencyleavedpt.com
Port:
587
Username:
[email protected]
Password:
zQ@xw*c1

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla payload 5 IoCs

resource	yara_rule
behavioral1/memory/2816-17-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/2816-21-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/2816-19-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/2816-14-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/2816-11-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2432 set thread context of 2816	2432	493dc3802cad640021e2a78ba2bd270c_JaffaCakes118.exe	33

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	493dc3802cad640021e2a78ba2bd270c_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dw20.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	493dc3802cad640021e2a78ba2bd270c_JaffaCakes118.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2788	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2816	493dc3802cad640021e2a78ba2bd270c_JaffaCakes118.exe
2816	493dc3802cad640021e2a78ba2bd270c_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2816	493dc3802cad640021e2a78ba2bd270c_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 2432 wrote to memory of 2788	2432	493dc3802cad640021e2a78ba2bd270c_JaffaCakes118.exe	31
PID 2432 wrote to memory of 2788	2432	493dc3802cad640021e2a78ba2bd270c_JaffaCakes118.exe	31
PID 2432 wrote to memory of 2788	2432	493dc3802cad640021e2a78ba2bd270c_JaffaCakes118.exe	31
PID 2432 wrote to memory of 2788	2432	493dc3802cad640021e2a78ba2bd270c_JaffaCakes118.exe	31
PID 2432 wrote to memory of 2816	2432	493dc3802cad640021e2a78ba2bd270c_JaffaCakes118.exe	33
PID 2432 wrote to memory of 2816	2432	493dc3802cad640021e2a78ba2bd270c_JaffaCakes118.exe	33
PID 2432 wrote to memory of 2816	2432	493dc3802cad640021e2a78ba2bd270c_JaffaCakes118.exe	33
PID 2432 wrote to memory of 2816	2432	493dc3802cad640021e2a78ba2bd270c_JaffaCakes118.exe	33
PID 2432 wrote to memory of 2816	2432	493dc3802cad640021e2a78ba2bd270c_JaffaCakes118.exe	33
PID 2432 wrote to memory of 2816	2432	493dc3802cad640021e2a78ba2bd270c_JaffaCakes118.exe	33
PID 2432 wrote to memory of 2816	2432	493dc3802cad640021e2a78ba2bd270c_JaffaCakes118.exe	33
PID 2432 wrote to memory of 2816	2432	493dc3802cad640021e2a78ba2bd270c_JaffaCakes118.exe	33
PID 2432 wrote to memory of 2816	2432	493dc3802cad640021e2a78ba2bd270c_JaffaCakes118.exe	33
PID 2816 wrote to memory of 2168	2816	493dc3802cad640021e2a78ba2bd270c_JaffaCakes118.exe	34
PID 2816 wrote to memory of 2168	2816	493dc3802cad640021e2a78ba2bd270c_JaffaCakes118.exe	34
PID 2816 wrote to memory of 2168	2816	493dc3802cad640021e2a78ba2bd270c_JaffaCakes118.exe	34
PID 2816 wrote to memory of 2168	2816	493dc3802cad640021e2a78ba2bd270c_JaffaCakes118.exe	34

C:\Users\Admin\AppData\Local\Temp\493dc3802cad640021e2a78ba2bd270c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\493dc3802cad640021e2a78ba2bd270c_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2432
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\fgTRNOIeBmtp" /XML "C:\Users\Admin\AppData\Local\Temp\tmp65A6.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:2788
- C:\Users\Admin\AppData\Local\Temp\493dc3802cad640021e2a78ba2bd270c_JaffaCakes118.exe
  "{path}"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2816
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
    dw20.exe -x -s 516
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp65A6.tmp

Filesize
1KB

MD5
13b49da0d531058ad83765da8fc3634b

SHA1
5678718a91191a42c69b4e677ff410f80bbe1a8f

SHA256
cddd1abd7562cfd53a277ce94b12b4349e623cefe7ae57812ae4e0651bc08f7d

SHA512
1b0db9c421537ec4423c94084bd936917ead00becf5a9eb6e26726d97d134f00e368996be64c31f4c165bd13ff6e93e9f767952498bcc2e51f6a52afb04a8919

Download Submit
memory/2432-0-0x0000000074381000-0x0000000074382000-memory.dmp

Filesize
4KB

Download
memory/2432-1-0x0000000074380000-0x000000007492B000-memory.dmp

Filesize
5.7MB

Download
memory/2432-2-0x0000000074380000-0x000000007492B000-memory.dmp

Filesize
5.7MB

Download
memory/2432-3-0x0000000074380000-0x000000007492B000-memory.dmp

Filesize
5.7MB

Download
memory/2432-4-0x0000000074380000-0x000000007492B000-memory.dmp

Filesize
5.7MB

Download
memory/2432-22-0x0000000074380000-0x000000007492B000-memory.dmp

Filesize
5.7MB

Download
memory/2816-23-0x0000000074380000-0x000000007492B000-memory.dmp

Filesize
5.7MB

Download
memory/2816-21-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2816-17-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2816-19-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2816-15-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2816-14-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2816-11-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2816-10-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2816-9-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2816-24-0x0000000074380000-0x000000007492B000-memory.dmp

Filesize
5.7MB

Download
memory/2816-25-0x0000000074380000-0x000000007492B000-memory.dmp

Filesize
5.7MB

Download
memory/2816-26-0x0000000074380000-0x000000007492B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads