agenttesla | 3d533cd7d00545ceec9bea14004c3e15891a769143f19009631068cea3acf150

General

Target

Purchase Order PO20211027STK.exe
Size

127KB
MD5

2f2102ec5776497950e89e419515efee
SHA1

1d3dd4ed88af22c3de29c918b37db6f0b73c94c4
SHA256

7768da29cc4ef93cb4790f664e139d1d8c2972e22fe8840b6b86c50e15dba347
SHA512

963b79cb63703ea6a6e8d70bbe76fadc660e10b801283a3812a76f773ee36210171437794dad0b4ee11e8a2f34645c88c7463526be03274ffdf48ec81823032a

Score

10^/10

agenttesla guloader downloader keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.construccionsjpallas.com
Port:
587
Username:
qualitat@construccionsjpallas.com
Password:
zXHR1YDJL5

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

AgentTesla Payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/500-127-0x0000000000400000-0x0000000000553000-memory.dmp	family_agenttesla
behavioral2/memory/500-128-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Executes dropped EXE 1 IoCs

Processes:

SPORENE.exe

pid process

2752 SPORENE.exe

pid	process
2752	SPORENE.exe

Checks QEMU agent file 2 TTPs 2 IoCs

Checks presence of QEMU agent, possibly to detect virtualization.

Query Registry

T1012

System Information Discovery

T1082

Processes:

SPORENE.execaspol.exe

description	ioc	process
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	SPORENE.exe
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	caspol.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

Processes:

caspol.exe

pid process

500 caspol.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

SPORENE.execaspol.exe

pid process

2752 SPORENE.exe
500 caspol.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

SPORENE.exe

description pid process target process

PID 2752 set thread context of 500 2752 SPORENE.exe caspol.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

caspol.exe

pid process

500 caspol.exe
500 caspol.exe
Suspicious behavior: MapViewOfSection 3 IoCs

Processes:

SPORENE.exe

pid process

2752 SPORENE.exe
2752 SPORENE.exe
2752 SPORENE.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

caspol.exe

description pid process

Token: SeDebugPrivilege 500 caspol.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

SPORENE.exe

pid process

2752 SPORENE.exe

pid	process
500	caspol.exe

pid	process
2752	SPORENE.exe
500	caspol.exe

description	pid	process	target process
PID 2752 set thread context of 500	2752	SPORENE.exe	caspol.exe

pid	process
500	caspol.exe
500	caspol.exe

pid	process
2752	SPORENE.exe
2752	SPORENE.exe
2752	SPORENE.exe

description	pid	process
Token: SeDebugPrivilege	500	caspol.exe

pid	process
2752	SPORENE.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

Purchase Order PO20211027STK.exeSPORENE.exe

description	pid	process	target process
PID 2336 wrote to memory of 2752	2336	Purchase Order PO20211027STK.exe	SPORENE.exe
PID 2336 wrote to memory of 2752	2336	Purchase Order PO20211027STK.exe	SPORENE.exe
PID 2336 wrote to memory of 2752	2336	Purchase Order PO20211027STK.exe	SPORENE.exe
PID 2752 wrote to memory of 2844	2752	SPORENE.exe	caspol.exe
PID 2752 wrote to memory of 2844	2752	SPORENE.exe	caspol.exe
PID 2752 wrote to memory of 2844	2752	SPORENE.exe	caspol.exe
PID 2752 wrote to memory of 60	2752	SPORENE.exe	caspol.exe
PID 2752 wrote to memory of 60	2752	SPORENE.exe	caspol.exe
PID 2752 wrote to memory of 60	2752	SPORENE.exe	caspol.exe
PID 2752 wrote to memory of 500	2752	SPORENE.exe	caspol.exe
PID 2752 wrote to memory of 500	2752	SPORENE.exe	caspol.exe
PID 2752 wrote to memory of 500	2752	SPORENE.exe	caspol.exe
PID 2752 wrote to memory of 500	2752	SPORENE.exe	caspol.exe

C:\Users\Admin\AppData\Local\Temp\Purchase Order PO20211027STK.exe
"C:\Users\Admin\AppData\Local\Temp\Purchase Order PO20211027STK.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2336

C:\Users\Admin\AppData\Local\Temp\SPORENE.exe
C:\Users\Admin\AppData\Local\Temp\SPORENE.exe
2⤵
- Executes dropped EXE
- Checks QEMU agent file
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2752

C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe
C:\Users\Admin\AppData\Local\Temp\SPORENE.exe
3⤵
PID:2844

C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe
C:\Users\Admin\AppData\Local\Temp\SPORENE.exe
3⤵
PID:60

C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe
C:\Users\Admin\AppData\Local\Temp\SPORENE.exe
3⤵
- Checks QEMU agent file
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:500

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\SPORENE.exe
MD5
582a642df36cdac38982e4842f370b44

SHA1
3dd6d0cecd4cd9414d7df148f7c46548c5709d62

SHA256
361deddf3e436753730dbb20842fbd6d1ef2ec27c56cd9da99e87751c3bbe890

SHA512
e9c94417acef2b33ded79182c8b397e2693a74d290e78e286ae7576c998bf14f39f370c06bc40c9dffdf2de2e7f680aa0f33d74db508e15eeaf1d31be8d06bb6

Download Submit
C:\Users\Admin\AppData\Local\Temp\SPORENE.exe
MD5
582a642df36cdac38982e4842f370b44

SHA1
3dd6d0cecd4cd9414d7df148f7c46548c5709d62

SHA256
361deddf3e436753730dbb20842fbd6d1ef2ec27c56cd9da99e87751c3bbe890

SHA512
e9c94417acef2b33ded79182c8b397e2693a74d290e78e286ae7576c998bf14f39f370c06bc40c9dffdf2de2e7f680aa0f33d74db508e15eeaf1d31be8d06bb6

Download Submit
memory/500-129-0x0000000020CC0000-0x00000000211BE000-memory.dmp

Filesize
5.0MB

Download
memory/500-130-0x0000000020930000-0x00000000209CC000-memory.dmp

Filesize
624KB

Download
memory/500-133-0x0000000001270000-0x00000000012D6000-memory.dmp

Filesize
408KB

Download
memory/500-132-0x0000000000FB0000-0x0000000000FC8000-memory.dmp

Filesize
96KB

Download
memory/500-131-0x00000000207C0000-0x0000000020CBE000-memory.dmp

Filesize
5.0MB

Download
memory/500-124-0x0000000001310000-0x00000000014F0000-memory.dmp

Filesize
1.9MB

Download
memory/500-125-0x00007FFE7E8B0000-0x00007FFE7EA8B000-memory.dmp

Filesize
1.9MB

Download
memory/500-126-0x0000000077300000-0x000000007748E000-memory.dmp

Filesize
1.6MB

Download
memory/500-127-0x0000000000400000-0x0000000000553000-memory.dmp

Filesize
1.3MB

Download
memory/500-128-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2752-123-0x0000000077300000-0x000000007748E000-memory.dmp

Filesize
1.6MB

Download
memory/2752-119-0x0000000001A50000-0x0000000001A69000-memory.dmp

Filesize
100KB

Download
memory/2752-120-0x00007FFE7E8B0000-0x00007FFE7EA8B000-memory.dmp

Filesize
1.9MB

Download
memory/2752-122-0x0000000077300000-0x000000007748E000-memory.dmp

Filesize
1.6MB

Download
memory/2752-121-0x0000000077300000-0x000000007748E000-memory.dmp

Filesize
1.6MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads