agenttesla | 698dee67ffc5a82e25e75e3adb337b0d4869d2c2f5ff1362c4b8ef881ac84f54

General

Target

SecuriteInfo.com.Gen.Variant.Nemesis.8199.18591.exe
Size

134KB
MD5

fa642af59bc3f678e8c64942de1ea1b5
SHA1

cb5a9a2b97969938efffe74a2961936853239a04
SHA256

698dee67ffc5a82e25e75e3adb337b0d4869d2c2f5ff1362c4b8ef881ac84f54
SHA512

c03a62db947abe6f2994df3c54b6e6322dd07a9e4c843b8821495579f51deec5ad038fae580d2733da0350e691111f6ad07f875a91c85216566a126c4ef715e1
SSDEEP

3072:tNRCywDw1DiJkupabH2rCcSla0qN/vwfFfdLQ861CxBbFhnQ7Cx:tT4DtyWrCjlSSB61CxQ

Score

10^/10

agenttesla guloader collection discovery downloader keylogger spyware stealer trojan

Malware Config

Extracted

Credentials

Protocol: ftp
Host:
ftp.overviewsupplies.com
Port:
21
Username:
[email protected]
Password:
w[3c2r?B,Of+

Extracted

Family

agenttesla

Credentials

Protocol: ftp
Host:
ftp://ftp.overviewsupplies.com/
Port:
21
Username:
[email protected]
Password:
w[3c2r?B,Of+

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Checks QEMU agent file 2 TTPs 2 IoCs

Checks presence of QEMU agent, possibly to detect virtualization.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	SecuriteInfo.com.Gen.Variant.Nemesis.8199.18591.exe
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	caspol.exe

Loads dropped DLL 1 IoCs

pid	Process
3096	SecuriteInfo.com.Gen.Variant.Nemesis.8199.18591.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	caspol.exe
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	caspol.exe
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	caspol.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
4148	caspol.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
3096	SecuriteInfo.com.Gen.Variant.Nemesis.8199.18591.exe
4148	caspol.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3096 set thread context of 4148	3096	SecuriteInfo.com.Gen.Variant.Nemesis.8199.18591.exe	97

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Aestus.ini	SecuriteInfo.com.Gen.Variant.Nemesis.8199.18591.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4148	caspol.exe
4148	caspol.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
3096	SecuriteInfo.com.Gen.Variant.Nemesis.8199.18591.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4148	caspol.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3096 wrote to memory of 4148	3096	SecuriteInfo.com.Gen.Variant.Nemesis.8199.18591.exe	97
PID 3096 wrote to memory of 4148	3096	SecuriteInfo.com.Gen.Variant.Nemesis.8199.18591.exe	97
PID 3096 wrote to memory of 4148	3096	SecuriteInfo.com.Gen.Variant.Nemesis.8199.18591.exe	97
PID 3096 wrote to memory of 4148	3096	SecuriteInfo.com.Gen.Variant.Nemesis.8199.18591.exe	97

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	caspol.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	caspol.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Gen.Variant.Nemesis.8199.18591.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Gen.Variant.Nemesis.8199.18591.exe"
1⤵
- Checks QEMU agent file
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3096
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\caspol.exe
  "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Gen.Variant.Nemesis.8199.18591.exe"
  2⤵
  - Checks QEMU agent file
  - Accesses Microsoft Outlook profiles
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - outlook_office_path
  - outlook_win_path
  PID:4148

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsoD0D3.tmp\System.dll

Filesize
12KB

MD5
a1da6788aeaf78ca4ae1dece8019e49d

SHA1
d770155e6e9aa69223be198c44a8da26a1756d89

SHA256
b7823a15e7b1866ba3d77248f750b66505859d264cfc39d8c8c5e812f8ae4a81

SHA512
eada9c1528563ddfe3d4d8ed5dbc52b85a9190765535b68da90e6d623288bf0090adac5118e1ed6e3cb3e0abb9af025d3a2a73121413a4471a90fd04bc861e18

Download Submit
memory/3096-133-0x00000000028A0000-0x00000000029A0000-memory.dmp

Filesize
1024KB

Download
memory/3096-134-0x00000000028A0000-0x00000000029A0000-memory.dmp

Filesize
1024KB

Download
memory/3096-135-0x00007FFA25810000-0x00007FFA25A05000-memory.dmp

Filesize
2.0MB

Download
memory/3096-136-0x0000000077D50000-0x0000000077EF3000-memory.dmp

Filesize
1.6MB

Download
memory/3096-148-0x00000000028A0000-0x00000000029A0000-memory.dmp

Filesize
1024KB

Download
memory/3096-138-0x0000000077D50000-0x0000000077EF3000-memory.dmp

Filesize
1.6MB

Download
memory/4148-140-0x0000000000F00000-0x0000000001000000-memory.dmp

Filesize
1024KB

Download
memory/4148-139-0x0000000000F00000-0x0000000001000000-memory.dmp

Filesize
1024KB

Download
memory/4148-141-0x00007FFA25810000-0x00007FFA25A05000-memory.dmp

Filesize
2.0MB

Download
memory/4148-142-0x0000000077D50000-0x0000000077EF3000-memory.dmp

Filesize
1.6MB

Download
memory/4148-143-0x0000000000400000-0x000000000062B000-memory.dmp

Filesize
2.2MB

Download
memory/4148-144-0x0000000000401000-0x000000000062B000-memory.dmp

Filesize
2.2MB

Download
memory/4148-146-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/4148-147-0x00000000734B0000-0x0000000073A61000-memory.dmp

Filesize
5.7MB

Download
memory/4148-137-0x0000000000000000-mapping.dmp

Download
memory/4148-149-0x00007FFA25810000-0x00007FFA25A05000-memory.dmp

Filesize
2.0MB

Download
memory/4148-150-0x0000000077D50000-0x0000000077EF3000-memory.dmp

Filesize
1.6MB

Download
memory/4148-151-0x00000000734B0000-0x0000000073A61000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads