agenttesla | 49c55ffef42b3ed1dd062d395bfa9c9c700f198bfd4f31cacf957b2640f4bc9a

Analysis

max time kernel
141s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 18:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1bf74dffc0628802538de0922ed14a89_JaffaCakes118.exe
Size

666KB
MD5

1bf74dffc0628802538de0922ed14a89
SHA1

bbf7d9be48007ee6b9f6553586582347aacf1f3d
SHA256

49c55ffef42b3ed1dd062d395bfa9c9c700f198bfd4f31cacf957b2640f4bc9a
SHA512

289a7c763f418b5535e3d8f69b90d2b414ce0321e1a3edc4ffcc55511e61df49848bc2ed7f12fe32f09a2b817cee167a6f02ee6654cf6d9488337a337aa63e35
SSDEEP

12288:1t8NixtIr+aHRX/5t+KwXIr2k4DbF53e0IUFLcg6:1qUkr+YXn+/XIEi

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.a2zfacilityservices.in
Port:
587
Username:
[email protected]
Password:
n*2Uy~]v;.sa

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
AgentTesla payload 1 IoCs

Processes:

resource yara_rule

behavioral2/memory/4684-12-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla
Suspicious use of SetThreadContext 1 IoCs

Processes:

1bf74dffc0628802538de0922ed14a89_JaffaCakes118.exe

description pid process target process

PID 2640 set thread context of 4684 2640 1bf74dffc0628802538de0922ed14a89_JaffaCakes118.exe 1bf74dffc0628802538de0922ed14a89_JaffaCakes118.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

1bf74dffc0628802538de0922ed14a89_JaffaCakes118.exe

pid process

4684 1bf74dffc0628802538de0922ed14a89_JaffaCakes118.exe
4684 1bf74dffc0628802538de0922ed14a89_JaffaCakes118.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

1bf74dffc0628802538de0922ed14a89_JaffaCakes118.exe

description pid process

Token: SeDebugPrivilege 4684 1bf74dffc0628802538de0922ed14a89_JaffaCakes118.exe

resource	yara_rule
behavioral2/memory/4684-12-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

description	pid	process	target process
PID 2640 set thread context of 4684	2640	1bf74dffc0628802538de0922ed14a89_JaffaCakes118.exe	1bf74dffc0628802538de0922ed14a89_JaffaCakes118.exe

pid	process
4684	1bf74dffc0628802538de0922ed14a89_JaffaCakes118.exe
4684	1bf74dffc0628802538de0922ed14a89_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	4684	1bf74dffc0628802538de0922ed14a89_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

1bf74dffc0628802538de0922ed14a89_JaffaCakes118.exe

description	pid	process	target process
PID 2640 wrote to memory of 4684	2640	1bf74dffc0628802538de0922ed14a89_JaffaCakes118.exe	1bf74dffc0628802538de0922ed14a89_JaffaCakes118.exe
PID 2640 wrote to memory of 4684	2640	1bf74dffc0628802538de0922ed14a89_JaffaCakes118.exe	1bf74dffc0628802538de0922ed14a89_JaffaCakes118.exe
PID 2640 wrote to memory of 4684	2640	1bf74dffc0628802538de0922ed14a89_JaffaCakes118.exe	1bf74dffc0628802538de0922ed14a89_JaffaCakes118.exe
PID 2640 wrote to memory of 4684	2640	1bf74dffc0628802538de0922ed14a89_JaffaCakes118.exe	1bf74dffc0628802538de0922ed14a89_JaffaCakes118.exe
PID 2640 wrote to memory of 4684	2640	1bf74dffc0628802538de0922ed14a89_JaffaCakes118.exe	1bf74dffc0628802538de0922ed14a89_JaffaCakes118.exe
PID 2640 wrote to memory of 4684	2640	1bf74dffc0628802538de0922ed14a89_JaffaCakes118.exe	1bf74dffc0628802538de0922ed14a89_JaffaCakes118.exe
PID 2640 wrote to memory of 4684	2640	1bf74dffc0628802538de0922ed14a89_JaffaCakes118.exe	1bf74dffc0628802538de0922ed14a89_JaffaCakes118.exe
PID 2640 wrote to memory of 4684	2640	1bf74dffc0628802538de0922ed14a89_JaffaCakes118.exe	1bf74dffc0628802538de0922ed14a89_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\1bf74dffc0628802538de0922ed14a89_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1bf74dffc0628802538de0922ed14a89_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2640

C:\Users\Admin\AppData\Local\Temp\1bf74dffc0628802538de0922ed14a89_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1bf74dffc0628802538de0922ed14a89_JaffaCakes118.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4684

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=2804 --field-trial-handle=2292,i,2103142837140538807,15881446839139365070,262144 --variations-seed-version /prefetch:8
1⤵
PID:3308

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2640-8-0x0000000007EB0000-0x0000000007F4C000-memory.dmp

Filesize
624KB

Download
memory/2640-16-0x0000000074DC0000-0x0000000075570000-memory.dmp

Filesize
7.7MB

Download
memory/2640-0-0x0000000074DCE000-0x0000000074DCF000-memory.dmp

Filesize
4KB

Download
memory/2640-3-0x0000000004DE0000-0x0000000004E72000-memory.dmp

Filesize
584KB

Download
memory/2640-4-0x0000000074DC0000-0x0000000075570000-memory.dmp

Filesize
7.7MB

Download
memory/2640-5-0x0000000004DC0000-0x0000000004DCA000-memory.dmp

Filesize
40KB

Download
memory/2640-6-0x0000000074DCE000-0x0000000074DCF000-memory.dmp

Filesize
4KB

Download
memory/2640-7-0x0000000007DF0000-0x0000000007DFE000-memory.dmp

Filesize
56KB

Download
memory/2640-2-0x0000000005390000-0x0000000005934000-memory.dmp

Filesize
5.6MB

Download
memory/2640-1-0x0000000000360000-0x000000000040C000-memory.dmp

Filesize
688KB

Download
memory/2640-11-0x000000000A8D0000-0x000000000A90C000-memory.dmp

Filesize
240KB

Download
memory/2640-10-0x00000000081B0000-0x0000000008214000-memory.dmp

Filesize
400KB

Download
memory/2640-9-0x0000000074DC0000-0x0000000075570000-memory.dmp

Filesize
7.7MB

Download
memory/4684-19-0x0000000074DC0000-0x0000000075570000-memory.dmp

Filesize
7.7MB

Download
memory/4684-15-0x0000000074DC0000-0x0000000075570000-memory.dmp

Filesize
7.7MB

Download
memory/4684-14-0x0000000074DC0000-0x0000000075570000-memory.dmp

Filesize
7.7MB

Download
memory/4684-17-0x00000000052A0000-0x00000000052B8000-memory.dmp

Filesize
96KB

Download
memory/4684-18-0x00000000060F0000-0x0000000006156000-memory.dmp

Filesize
408KB

Download
memory/4684-12-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download