agenttesla | f7a260beec427f7863a82db269e34d3742a984354bdd9da45b99488f3f9f2c5b

General

Target

Purchase order 50048205_JPG.exe
Size

689KB
MD5

ceba3a31aeda8eea8efc26bb787ec690
SHA1

b3a8b39e8438984ba680fe597df728940ed09a66
SHA256

1430fc7b02d27de2472ec82b085e6c12a1c9a236bf9f10607d39cff2cfcf3406
SHA512

139ce4a7e0fc91450beb6ab7a29711081db0e033902b5c385bc6408e65dbbcbd35e0621bdd4c2010ff15e91a818311f314d4f15e8f5d636e9d9994f3922a7e5f
SSDEEP

12288:2cMkhWAEQ0J6rpEretKUjQ0kKSMtpSe2Tahcjd/1FhUxsBPGtVppPNF:czQ0J+EreVFkKSekehm/1FuxsetrhX

Score

10^/10

agenttesla guloader discovery downloader keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: ftp
Host:
ftp://ftp.mcmprint.net
Port:
21
Username:
klogz@mcmprint.net
Password:
l9Hh{#_(0shZ

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Checks QEMU agent file 2 TTPs 2 IoCs

Checks presence of QEMU agent, possibly to detect virtualization.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Purchase order 50048205_JPG.execaspol.exe

description	ioc	process
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	Purchase order 50048205_JPG.exe
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	caspol.exe

Loads dropped DLL 1 IoCs

Processes:

Purchase order 50048205_JPG.exe

pid process

4376 Purchase order 50048205_JPG.exe
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

43 api.ipify.org
44 api.ipify.org
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

Processes:

caspol.exe

pid process

4020 caspol.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

Purchase order 50048205_JPG.execaspol.exe

pid process

4376 Purchase order 50048205_JPG.exe
4020 caspol.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

Purchase order 50048205_JPG.exe

description pid process target process

PID 4376 set thread context of 4020 4376 Purchase order 50048205_JPG.exe caspol.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3428 4020 WerFault.exe caspol.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

Purchase order 50048205_JPG.exe

pid process

4376 Purchase order 50048205_JPG.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

caspol.exe

description pid process

Token: SeDebugPrivilege 4020 caspol.exe

pid	process
4376	Purchase order 50048205_JPG.exe

flow	ioc
43	api.ipify.org
44	api.ipify.org

pid	process
4020	caspol.exe

pid	process
4376	Purchase order 50048205_JPG.exe
4020	caspol.exe

description	pid	process	target process
PID 4376 set thread context of 4020	4376	Purchase order 50048205_JPG.exe	caspol.exe

pid	pid_target	process	target process
3428	4020	WerFault.exe	caspol.exe

pid	process
4376	Purchase order 50048205_JPG.exe

description	pid	process
Token: SeDebugPrivilege	4020	caspol.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

Purchase order 50048205_JPG.exe

description	pid	process	target process
PID 4376 wrote to memory of 4020	4376	Purchase order 50048205_JPG.exe	caspol.exe
PID 4376 wrote to memory of 4020	4376	Purchase order 50048205_JPG.exe	caspol.exe
PID 4376 wrote to memory of 4020	4376	Purchase order 50048205_JPG.exe	caspol.exe
PID 4376 wrote to memory of 4020	4376	Purchase order 50048205_JPG.exe	caspol.exe

C:\Users\Admin\AppData\Local\Temp\Purchase order 50048205_JPG.exe
"C:\Users\Admin\AppData\Local\Temp\Purchase order 50048205_JPG.exe"
1⤵
- Checks QEMU agent file
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4376

C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe
"C:\Users\Admin\AppData\Local\Temp\Purchase order 50048205_JPG.exe"
2⤵
- Checks QEMU agent file
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:4020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4020 -s 2168
3⤵
- Program crash
PID:3428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 180 -p 4020 -ip 4020
1⤵
PID:2088

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsfA176.tmp\System.dll
Filesize
12KB

MD5
8cf2ac271d7679b1d68eefc1ae0c5618

SHA1
7cc1caaa747ee16dc894a600a4256f64fa65a9b8

SHA256
6950991102462d84fdc0e3b0ae30c95af8c192f77ce3d78e8d54e6b22f7c09ba

SHA512
ce828fb9ecd7655cc4c974f78f209d3326ba71ced60171a45a437fc3fff3bd0d69a0997adaca29265c7b5419bdea2b17f8cc8ceae1b8ce6b22b7ed9120bb5ad3

Download Submit
memory/4020-142-0x0000000077140000-0x00000000772E3000-memory.dmp

Filesize
1.6MB

Download
memory/4020-137-0x0000000000000000-mapping.dmp

Download
memory/4020-143-0x0000000000400000-0x000000000062B000-memory.dmp

Filesize
2.2MB

Download
memory/4020-146-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/4020-144-0x0000000000401000-0x000000000062B000-memory.dmp

Filesize
2.2MB

Download
memory/4020-154-0x00007FF967790000-0x00007FF967985000-memory.dmp

Filesize
2.0MB

Download
memory/4020-139-0x0000000001030000-0x00000000027B6000-memory.dmp

Filesize
23.5MB

Download
memory/4020-140-0x00007FF967790000-0x00007FF967985000-memory.dmp

Filesize
2.0MB

Download
memory/4020-141-0x0000000001030000-0x00000000027B6000-memory.dmp

Filesize
23.5MB

Download
memory/4020-153-0x0000000001030000-0x00000000027B6000-memory.dmp

Filesize
23.5MB

Download
memory/4020-152-0x0000000077140000-0x00000000772E3000-memory.dmp

Filesize
1.6MB

Download
memory/4020-151-0x0000000036510000-0x000000003651A000-memory.dmp

Filesize
40KB

Download
memory/4020-150-0x00000000365A0000-0x0000000036632000-memory.dmp

Filesize
584KB

Download
memory/4020-147-0x0000000035A90000-0x0000000036034000-memory.dmp

Filesize
5.6MB

Download
memory/4020-148-0x0000000035650000-0x00000000356B6000-memory.dmp

Filesize
408KB

Download
memory/4020-149-0x00007FF967790000-0x00007FF967985000-memory.dmp

Filesize
2.0MB

Download
memory/4376-136-0x0000000077140000-0x00000000772E3000-memory.dmp

Filesize
1.6MB

Download
memory/4376-134-0x00000000033A0000-0x0000000004B26000-memory.dmp

Filesize
23.5MB

Download
memory/4376-135-0x00007FF967790000-0x00007FF967985000-memory.dmp

Filesize
2.0MB

Download
memory/4376-133-0x00000000033A0000-0x0000000004B26000-memory.dmp

Filesize
23.5MB

Download
memory/4376-138-0x0000000077140000-0x00000000772E3000-memory.dmp

Filesize
1.6MB

Download

Analysis

Sharing