agenttesla | cf23992cf7f5c21c94e6ee8a8fcc4f6b5f086924811e874f5d6ba13f5b845f1a

General

Target

reefpq.exe
Size

120KB
MD5

2ebb8bd7be7187f911ce264c3f572f27
SHA1

73c1b0561c7cbbd88cd796b181a99a411e7b7187
SHA256

cf23992cf7f5c21c94e6ee8a8fcc4f6b5f086924811e874f5d6ba13f5b845f1a
SHA512

9c5216716367619fd2e8492b2ce63f117493ab6f4190d377e1da7adb992c1180be7d5795af7bed80313ba28d11e4211d9ef70bb31246dfa2d1f1a571345a3b45
SSDEEP

3072:JDxaVzwmg4CSW8JSulArbSBAlmhP+JbZZX4EOTUAuXjT65AAJnHPSB:5Mm4CCgSBAlmt+l5AuXjT659Hm

Score

10^/10

agenttesla guloader collection downloader keylogger spyware stealer trojan

Malware Config

Extracted

Credentials

Protocol: ftp
Host:
ftp.womens-healthcare.co.uk
Port:
21
Username:
[email protected]
Password:
njQGrywUXJ6I

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Checks QEMU agent file 2 TTPs 2 IoCs

Checks presence of QEMU agent, possibly to detect virtualization.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	reefpq.exe
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	caspol.exe

Loads dropped DLL 1 IoCs

pid	Process
956	reefpq.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	caspol.exe
Key opened	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	caspol.exe
Key opened	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	caspol.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
1392	caspol.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
956	reefpq.exe
1392	caspol.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 956 set thread context of 1392	956	reefpq.exe	27

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1392	caspol.exe
1392	caspol.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
956	reefpq.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1392	caspol.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1392	caspol.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 956 wrote to memory of 1392	956	reefpq.exe	27
PID 956 wrote to memory of 1392	956	reefpq.exe	27
PID 956 wrote to memory of 1392	956	reefpq.exe	27
PID 956 wrote to memory of 1392	956	reefpq.exe	27
PID 956 wrote to memory of 1392	956	reefpq.exe	27

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	caspol.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	caspol.exe

C:\Users\Admin\AppData\Local\Temp\reefpq.exe
"C:\Users\Admin\AppData\Local\Temp\reefpq.exe"
1⤵
- Checks QEMU agent file
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:956
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe
  "C:\Users\Admin\AppData\Local\Temp\reefpq.exe"
  2⤵
  - Checks QEMU agent file
  - Accesses Microsoft Outlook profiles
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - outlook_office_path
  - outlook_win_path
  PID:1392

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsd1CB6.tmp\System.dll

Filesize
12KB

MD5
a1da6788aeaf78ca4ae1dece8019e49d

SHA1
d770155e6e9aa69223be198c44a8da26a1756d89

SHA256
b7823a15e7b1866ba3d77248f750b66505859d264cfc39d8c8c5e812f8ae4a81

SHA512
eada9c1528563ddfe3d4d8ed5dbc52b85a9190765535b68da90e6d623288bf0090adac5118e1ed6e3cb3e0abb9af025d3a2a73121413a4471a90fd04bc861e18

Download Submit
memory/956-72-0x0000000003880000-0x0000000003980000-memory.dmp

Filesize
1024KB

Download
memory/956-56-0x0000000003880000-0x0000000003980000-memory.dmp

Filesize
1024KB

Download
memory/956-54-0x0000000076561000-0x0000000076563000-memory.dmp

Filesize
8KB

Download
memory/956-60-0x0000000003880000-0x0000000003980000-memory.dmp

Filesize
1024KB

Download
memory/956-61-0x0000000077700000-0x00000000778A9000-memory.dmp

Filesize
1.7MB

Download
memory/956-62-0x00000000778E0000-0x0000000077A60000-memory.dmp

Filesize
1.5MB

Download
memory/956-73-0x00000000778E0000-0x0000000077A60000-memory.dmp

Filesize
1.5MB

Download
memory/1392-67-0x00000000000F0000-0x00000000001F0000-memory.dmp

Filesize
1024KB

Download
memory/1392-69-0x0000000000401000-0x0000000000615000-memory.dmp

Filesize
2.1MB

Download
memory/1392-68-0x0000000000400000-0x0000000000615000-memory.dmp

Filesize
2.1MB

Download
memory/1392-71-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1392-66-0x0000000077700000-0x00000000778A9000-memory.dmp

Filesize
1.7MB

Download
memory/1392-63-0x00000000000F0000-0x00000000001F0000-memory.dmp

Filesize
1024KB

Download

Analysis

Sharing