agenttesla | 536a5d0e0a0283a2037d9a01efaf92c4e119647ad3b8aa4d644461de984399f8

General

Target

RFQ 071.23 020.23.exe
Size

672KB
MD5

482763510b94fcba0f140baf71913c52
SHA1

0b80a3603e6a919232fb2ef003e56baa15f52f75
SHA256

536a5d0e0a0283a2037d9a01efaf92c4e119647ad3b8aa4d644461de984399f8
SHA512

c0a81e3898082ca3e416162b6a4a17779f16479025af51702c3e7c158a16cc24f9f9d7cbcce10e3b51d214e5f3297be2586d78284ba02d37800578018501f181
SSDEEP

12288:vMw4EAPcLqbFLPc3eBxnt8pxlZT3yZrn0aHDyq9DSXALFW+JGcaLUn:vMwtAPcLqbFPseBxyB3yBDyq0GlBn

Score

10^/10

agenttesla guloader downloader keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
us2.smtp.mailhostbox.com
Port:
587
Username:
[email protected]
Password:
N!hfzy$8

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Checks QEMU agent file 2 TTPs 2 IoCs

Checks presence of QEMU agent, possibly to detect virtualization.

Query Registry

T1012

System Information Discovery

T1082

Processes:

RFQ 071.23 020.23.execaspol.exe

description	ioc	process
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	RFQ 071.23 020.23.exe
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	caspol.exe

Loads dropped DLL 2 IoCs

Processes:

RFQ 071.23 020.23.exe

pid process

4132 RFQ 071.23 020.23.exe
4132 RFQ 071.23 020.23.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

Processes:

caspol.exe

pid process

832 caspol.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

RFQ 071.23 020.23.execaspol.exe

pid process

4132 RFQ 071.23 020.23.exe
832 caspol.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

RFQ 071.23 020.23.exe

description pid process target process

PID 4132 set thread context of 832 4132 RFQ 071.23 020.23.exe caspol.exe
Drops file in Windows directory 1 IoCs

Processes:

RFQ 071.23 020.23.exe

description ioc process

File opened for modification C:\Windows\resources\0409\Ledetekstens\smrokkerne\Slowheartedness.ini RFQ 071.23 020.23.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

caspol.exe

pid process

832 caspol.exe
832 caspol.exe
Suspicious behavior: MapViewOfSection 3 IoCs

Processes:

RFQ 071.23 020.23.exe

pid process

4132 RFQ 071.23 020.23.exe
4132 RFQ 071.23 020.23.exe
4132 RFQ 071.23 020.23.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

caspol.exe

description pid process

Token: SeDebugPrivilege 832 caspol.exe

pid	process
4132	RFQ 071.23 020.23.exe
4132	RFQ 071.23 020.23.exe

pid	process
832	caspol.exe

pid	process
4132	RFQ 071.23 020.23.exe
832	caspol.exe

description	pid	process	target process
PID 4132 set thread context of 832	4132	RFQ 071.23 020.23.exe	caspol.exe

description	ioc	process
File opened for modification	C:\Windows\resources\0409\Ledetekstens\smrokkerne\Slowheartedness.ini	RFQ 071.23 020.23.exe

pid	process
832	caspol.exe
832	caspol.exe

pid	process
4132	RFQ 071.23 020.23.exe
4132	RFQ 071.23 020.23.exe
4132	RFQ 071.23 020.23.exe

description	pid	process
Token: SeDebugPrivilege	832	caspol.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

RFQ 071.23 020.23.exe

description	pid	process	target process
PID 4132 wrote to memory of 3008	4132	RFQ 071.23 020.23.exe	caspol.exe
PID 4132 wrote to memory of 3008	4132	RFQ 071.23 020.23.exe	caspol.exe
PID 4132 wrote to memory of 3008	4132	RFQ 071.23 020.23.exe	caspol.exe
PID 4132 wrote to memory of 2296	4132	RFQ 071.23 020.23.exe	caspol.exe
PID 4132 wrote to memory of 2296	4132	RFQ 071.23 020.23.exe	caspol.exe
PID 4132 wrote to memory of 2296	4132	RFQ 071.23 020.23.exe	caspol.exe
PID 4132 wrote to memory of 832	4132	RFQ 071.23 020.23.exe	caspol.exe
PID 4132 wrote to memory of 832	4132	RFQ 071.23 020.23.exe	caspol.exe
PID 4132 wrote to memory of 832	4132	RFQ 071.23 020.23.exe	caspol.exe
PID 4132 wrote to memory of 832	4132	RFQ 071.23 020.23.exe	caspol.exe

C:\Users\Admin\AppData\Local\Temp\RFQ 071.23 020.23.exe
"C:\Users\Admin\AppData\Local\Temp\RFQ 071.23 020.23.exe"
1⤵
- Checks QEMU agent file
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4132
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe
  "C:\Users\Admin\AppData\Local\Temp\RFQ 071.23 020.23.exe"
  2⤵
  PID:3008
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe
  "C:\Users\Admin\AppData\Local\Temp\RFQ 071.23 020.23.exe"
  2⤵
  PID:2296
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe
  "C:\Users\Admin\AppData\Local\Temp\RFQ 071.23 020.23.exe"
  2⤵
  - Checks QEMU agent file
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:832

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Web Service

1

T1102

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsz9F82.tmp\AdvSplash.dll

Filesize
6KB

MD5
1871af84805057b5ebc05ee46b56625d

SHA1
50e1c315ad30f5f3f300c7cd9dd0d5d626fe0167

SHA256
62b3db0446750ca9fd693733eec927acc1f50012a47785343286e63b650b7621

SHA512
c1979ee98dfdb807776c439218528d80b4b244a87e692f1538e40f9c2c82db8b77485eb1429325b6f44419bf1f4cd454e43ff381eff077a8b4f4d9eb0d7e54d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz9F82.tmp\System.dll

Filesize
12KB

MD5
564bb0373067e1785cba7e4c24aab4bf

SHA1
7c9416a01d821b10b2eef97b80899d24014d6fc1

SHA256
7a9ddee34562cd3703f1502b5c70e99cd5bba15de2b6845a3555033d7f6cb2a5

SHA512
22c61a323cb9293d7ec5c7e7e60674d0e2f7b29d55be25eb3c128ea2cd7440a1400cee17c43896b996278007c0d247f331a9b8964e3a40a0eb1404a9596c4472

Download Submit
memory/832-169-0x0000000034A20000-0x0000000034ABC000-memory.dmp

Filesize
624KB

Download
memory/832-152-0x0000000001000000-0x00000000019E5000-memory.dmp

Filesize
9.9MB

Download
memory/832-165-0x0000000000400000-0x000000000062B000-memory.dmp

Filesize
2.2MB

Download
memory/832-166-0x0000000001000000-0x00000000019E5000-memory.dmp

Filesize
9.9MB

Download
memory/832-167-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/832-168-0x0000000034F30000-0x00000000354D4000-memory.dmp

Filesize
5.6MB

Download
memory/832-170-0x0000000000CE0000-0x0000000000D46000-memory.dmp

Filesize
408KB

Download
memory/832-171-0x0000000034AC0000-0x0000000034AD0000-memory.dmp

Filesize
64KB

Download
memory/832-173-0x00000000355C0000-0x0000000035652000-memory.dmp

Filesize
584KB

Download
memory/832-174-0x0000000035930000-0x000000003593A000-memory.dmp

Filesize
40KB

Download
memory/832-175-0x0000000001000000-0x00000000019E5000-memory.dmp

Filesize
9.9MB

Download
memory/4132-151-0x0000000007090000-0x0000000007A75000-memory.dmp

Filesize
9.9MB

Download
memory/4132-150-0x0000000007090000-0x0000000007A75000-memory.dmp

Filesize
9.9MB

Download

Analysis

Sharing