agenttesla | 2f12d12ac06ba0762329e9d02c10d4202117c2201b9eaa8361a8e57c908373a6

General

Target

JaffaCakes118_c86a89bfbb6695378fb207de8578d206.ps1
Size

356KB
MD5

c86a89bfbb6695378fb207de8578d206
SHA1

f9a2ab9b571a77c51d5ef5ed90a1a62f4f0f98d5
SHA256

2f12d12ac06ba0762329e9d02c10d4202117c2201b9eaa8361a8e57c908373a6
SHA512

9dec301fe44b8a4f6966a5de911ba8dd8ed60c56cb67008a12feb6c21a6924dd978e0f787dc286cbc530ea5b5a8a73d6c3bcfb7fc2079bbc257f6c4722daad12
SSDEEP

1536:EUKRwevEPGKAjHFTNva119BaPffP5Cfx54awKUZDpUfIvXN9Ll68JxE9g5qvEgzJ:NeG

Score

10^/10

agenttesla collection credential_access discovery execution keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

C2

http://103.125.190.248/j/p12m/mawa/30b1acecbda6c5d6ed4c.php

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Agenttesla family
agenttesla

AgentTesla payload 1 IoCs

resource	yara_rule
behavioral2/memory/620-28-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	RegAsm.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe
Key opened	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe
Key opened	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4796 set thread context of 620	4796	powershell.exe	86

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4796	powershell.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4796	powershell.exe
4796	powershell.exe
620	RegAsm.exe
620	RegAsm.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4796	powershell.exe
Token: SeDebugPrivilege	620	RegAsm.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
620	RegAsm.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4796 wrote to memory of 5020	4796	powershell.exe	84
PID 4796 wrote to memory of 5020	4796	powershell.exe	84
PID 5020 wrote to memory of 1860	5020	csc.exe	85
PID 5020 wrote to memory of 1860	5020	csc.exe	85
PID 4796 wrote to memory of 620	4796	powershell.exe	86
PID 4796 wrote to memory of 620	4796	powershell.exe	86
PID 4796 wrote to memory of 620	4796	powershell.exe	86
PID 4796 wrote to memory of 620	4796	powershell.exe	86
PID 4796 wrote to memory of 620	4796	powershell.exe	86
PID 4796 wrote to memory of 620	4796	powershell.exe	86
PID 4796 wrote to memory of 620	4796	powershell.exe	86
PID 4796 wrote to memory of 620	4796	powershell.exe	86

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c86a89bfbb6695378fb207de8578d206.ps1
1⤵
- Suspicious use of SetThreadContext
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4796
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\rya45rwh\rya45rwh.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5020
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8240.tmp" "c:\Users\Admin\AppData\Local\Temp\rya45rwh\CSC2A39FF8AC43045C9A1E8FE8B3BAF2A86.TMP"
    3⤵
    PID:1860
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - Drops file in Drivers directory
  - Accesses Microsoft Outlook profiles
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - outlook_office_path
  - outlook_win_path
  PID:620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

5

T1552

Credentials In Files

4

T1552.001

Credentials in Registry

1

T1552.002

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RES8240.tmp

Filesize
1KB

MD5
f02baed5d6296facff84e6a787827f80

SHA1
20120f7a42784831d8bb82e6f6380f84e067628c

SHA256
a0bc11eeb95078331c828f9df3c0be437aa89efe8bf51606afb25bc159e48508

SHA512
9806e0aa8365e503c09a4a78ea4e6c3931f7ae29c562594755dd23da6c909a77242acbba847037d7ecdec74cdae7c2b4979a310f5b2f7732b1c2d04b6b26de4a

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_m4l0yvlp.3to.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\rya45rwh\rya45rwh.dll

Filesize
13KB

MD5
b53b18370574c9a99cce4de99178e40b

SHA1
6def0c0942ce8fbf763fce1280fa4c3941d81e52

SHA256
f59ff15809704e45c658782a1b3a8d5d419113f5792bfad9c2031e9297e262b3

SHA512
1370df28fa6ded28d3182c4ea28c53d76e620b224986f0da0ce2ca86414747e6250f6d3484a125f2741320b0d635bd548523b5666313adb0bf85ceecfbcad68d

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\rya45rwh\CSC2A39FF8AC43045C9A1E8FE8B3BAF2A86.TMP

Filesize
652B

MD5
73cf10bab1752787071f6f15ec7dd1c9

SHA1
d604bd7d229e2a45b2a1ea28df59a86a6005a7c0

SHA256
6af436a6f395414739a5690976d9da847982539d28a34e9f3ab98e412ed6650d

SHA512
d16297b5681605128478888a9d85d622cadda15e89232c61e0886e5454b4cdbf2147aaa4fa9bfd3dc9c1ebd29ecb660ca9c9bc592409c9a6ad8d4edeae507350

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\rya45rwh\rya45rwh.0.cs

Filesize
13KB

MD5
e03b1e7ba7f1a53a7e10c0fd9049f437

SHA1
3bb851a42717eeb588eb7deadfcd04c571c15f41

SHA256
3ca2d456cf2f8d781f2134e1481bd787a9cb6f4bcaa2131ebbe0d47a0eb36427

SHA512
a098a8e2a60a75357ee202ed4bbe6b86fa7b2ebae30574791e0d13dcf3ee95b841a14b51553c23b95af32a29cc2265afc285b3b0442f0454ea730de4d647383f

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\rya45rwh\rya45rwh.cmdline

Filesize
327B

MD5
7d960a1a4d29f72743608d08b064cf47

SHA1
d18120aab8332f0fead838b99493566671c5914f

SHA256
0fec07e8e4c13d95ec814ead02994ca5759a90535541a0281a6991138c0c7816

SHA512
bf6f4b1eb261742c04fefd700da7c7f94390044177f65151e5b49fcf71a6d5fdad20a3385fd9418cec0d3a9f176af72a4f85b1e92d891e8e6a13a2c1e60a2e10

Download Submit
memory/620-33-0x0000000005C40000-0x00000000061E4000-memory.dmp

Filesize
5.6MB

Download
memory/620-34-0x0000000005730000-0x00000000057C2000-memory.dmp

Filesize
584KB

Download
memory/620-41-0x0000000002EA0000-0x0000000002EAA000-memory.dmp

Filesize
40KB

Download
memory/620-40-0x0000000006A10000-0x0000000006A60000-memory.dmp

Filesize
320KB

Download
memory/620-38-0x0000000074FEE000-0x0000000074FEF000-memory.dmp

Filesize
4KB

Download
memory/620-37-0x00000000066A0000-0x0000000006706000-memory.dmp

Filesize
408KB

Download
memory/620-28-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/620-36-0x0000000005BE0000-0x0000000005BF8000-memory.dmp

Filesize
96KB

Download
memory/620-32-0x0000000074FEE000-0x0000000074FEF000-memory.dmp

Filesize
4KB

Download
memory/620-35-0x00000000058C0000-0x000000000595C000-memory.dmp

Filesize
624KB

Download
memory/4796-26-0x0000015DDB530000-0x0000015DDB53A000-memory.dmp

Filesize
40KB

Download
memory/4796-0-0x00007FFF59F73000-0x00007FFF59F75000-memory.dmp

Filesize
8KB

Download
memory/4796-31-0x00007FFF59F70000-0x00007FFF5AA31000-memory.dmp

Filesize
10.8MB

Download
memory/4796-13-0x0000015DF47B0000-0x0000015DF4826000-memory.dmp

Filesize
472KB

Download
memory/4796-10-0x0000015DF4380000-0x0000015DF43A2000-memory.dmp

Filesize
136KB

Download
memory/4796-11-0x00007FFF59F70000-0x00007FFF5AA31000-memory.dmp

Filesize
10.8MB

Download
memory/4796-12-0x00007FFF59F70000-0x00007FFF5AA31000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing