agenttesla | 6c77b74f73e42bf0e33a59ad800ef692d834ef272beff77e2c60919e6a0ccc4c

General

Target

5193149e55e9ed83fad3ad981ba16230771cc2d3a90ef1f9fba9d9f5b5b2519d.exe
Size

232KB
MD5

be1519bcbdb5a58fb2bb3ab5dd51ae1f
SHA1

ba25e963f2c56380d82188203aec956dd2c81a91
SHA256

5193149e55e9ed83fad3ad981ba16230771cc2d3a90ef1f9fba9d9f5b5b2519d
SHA512

efae646f8238a389e207f063e7f3ae8819caf151c72db290e08c8c0ef820d03dbd3d680861c510d4083f1cc3d3250d07d134768bac5c2d205a372f4fc0b3532f
SSDEEP

6144:+PX7iNebSdJ8DckdV+opbGA5Siwrd987k:5PYckdbGmSiwBH

Score

10^/10

agenttesla guloader discovery downloader keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot6090824543:AAGDjc8qY74kVvTCL6JGfHdJaauZXSH2oek/

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Checks QEMU agent file 2 TTPs 2 IoCs

Checks presence of QEMU agent, possibly to detect virtualization.

Query Registry

T1012

System Information Discovery

T1082

Processes:

5193149e55e9ed83fad3ad981ba16230771cc2d3a90ef1f9fba9d9f5b5b2519d.execaspol.exe

description	ioc	process
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	5193149e55e9ed83fad3ad981ba16230771cc2d3a90ef1f9fba9d9f5b5b2519d.exe
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	caspol.exe

Loads dropped DLL 1 IoCs

Processes:

5193149e55e9ed83fad3ad981ba16230771cc2d3a90ef1f9fba9d9f5b5b2519d.exe

pid process

1244 5193149e55e9ed83fad3ad981ba16230771cc2d3a90ef1f9fba9d9f5b5b2519d.exe
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

173 api.ipify.org
174 api.ipify.org

pid	process
1244	5193149e55e9ed83fad3ad981ba16230771cc2d3a90ef1f9fba9d9f5b5b2519d.exe

flow	ioc
173	api.ipify.org
174	api.ipify.org

Drops file in System32 directory 1 IoCs

Processes:

5193149e55e9ed83fad3ad981ba16230771cc2d3a90ef1f9fba9d9f5b5b2519d.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\Ichthyophagous213\Disentranced.Eff	5193149e55e9ed83fad3ad981ba16230771cc2d3a90ef1f9fba9d9f5b5b2519d.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

Processes:

caspol.exe

pid process

2596 caspol.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

5193149e55e9ed83fad3ad981ba16230771cc2d3a90ef1f9fba9d9f5b5b2519d.execaspol.exe

pid process

1244 5193149e55e9ed83fad3ad981ba16230771cc2d3a90ef1f9fba9d9f5b5b2519d.exe
2596 caspol.exe

pid	process
2596	caspol.exe

pid	process
1244	5193149e55e9ed83fad3ad981ba16230771cc2d3a90ef1f9fba9d9f5b5b2519d.exe
2596	caspol.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

5193149e55e9ed83fad3ad981ba16230771cc2d3a90ef1f9fba9d9f5b5b2519d.exe

description	pid	process	target process
PID 1244 set thread context of 2596	1244	5193149e55e9ed83fad3ad981ba16230771cc2d3a90ef1f9fba9d9f5b5b2519d.exe	caspol.exe

Drops file in Windows directory 1 IoCs

Processes:

5193149e55e9ed83fad3ad981ba16230771cc2d3a90ef1f9fba9d9f5b5b2519d.exe

description	ioc	process
File opened for modification	C:\Windows\Fonts\Idioterne\Hyperrealize.ini	5193149e55e9ed83fad3ad981ba16230771cc2d3a90ef1f9fba9d9f5b5b2519d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1832 2596 WerFault.exe caspol.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

5193149e55e9ed83fad3ad981ba16230771cc2d3a90ef1f9fba9d9f5b5b2519d.exe

pid process

1244 5193149e55e9ed83fad3ad981ba16230771cc2d3a90ef1f9fba9d9f5b5b2519d.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

caspol.exe

description pid process

Token: SeDebugPrivilege 2596 caspol.exe

pid	pid_target	process	target process
1832	2596	WerFault.exe	caspol.exe

pid	process
1244	5193149e55e9ed83fad3ad981ba16230771cc2d3a90ef1f9fba9d9f5b5b2519d.exe

description	pid	process
Token: SeDebugPrivilege	2596	caspol.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

5193149e55e9ed83fad3ad981ba16230771cc2d3a90ef1f9fba9d9f5b5b2519d.exe

description	pid	process	target process
PID 1244 wrote to memory of 2596	1244	5193149e55e9ed83fad3ad981ba16230771cc2d3a90ef1f9fba9d9f5b5b2519d.exe	caspol.exe
PID 1244 wrote to memory of 2596	1244	5193149e55e9ed83fad3ad981ba16230771cc2d3a90ef1f9fba9d9f5b5b2519d.exe	caspol.exe
PID 1244 wrote to memory of 2596	1244	5193149e55e9ed83fad3ad981ba16230771cc2d3a90ef1f9fba9d9f5b5b2519d.exe	caspol.exe
PID 1244 wrote to memory of 2596	1244	5193149e55e9ed83fad3ad981ba16230771cc2d3a90ef1f9fba9d9f5b5b2519d.exe	caspol.exe

C:\Users\Admin\AppData\Local\Temp\5193149e55e9ed83fad3ad981ba16230771cc2d3a90ef1f9fba9d9f5b5b2519d.exe
"C:\Users\Admin\AppData\Local\Temp\5193149e55e9ed83fad3ad981ba16230771cc2d3a90ef1f9fba9d9f5b5b2519d.exe"
1⤵
- Checks QEMU agent file
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1244
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe
  "C:\Users\Admin\AppData\Local\Temp\5193149e55e9ed83fad3ad981ba16230771cc2d3a90ef1f9fba9d9f5b5b2519d.exe"
  2⤵
  - Checks QEMU agent file
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of AdjustPrivilegeToken
  PID:2596
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2596 -s 2652
    3⤵
    - Program crash
    PID:1832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2596 -ip 2596
1⤵
PID:4556

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Web Service

1

T1102

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsn9CD3.tmp\System.dll

Filesize
11KB

MD5
34442e1e0c2870341df55e1b7b3cccdc

SHA1
99b2fa21aead4b6ccd8ff2f6d3d3453a51d9c70c

SHA256
269d232712c86983336badb40b9e55e80052d8389ed095ebf9214964d43b6bb1

SHA512
4a8c57fb12997438b488b862f3fc9dc0f236e07bb47b2bce6053dcb03ac7ad171842f02ac749f02dda4719c681d186330524cd2953d33cb50854844e74b33d51

Download Submit
memory/1244-140-0x00000000049B0000-0x00000000057A5000-memory.dmp

Filesize
14.0MB

Download
memory/1244-141-0x00000000049B0000-0x00000000057A5000-memory.dmp

Filesize
14.0MB

Download
memory/2596-142-0x0000000001100000-0x0000000001EF5000-memory.dmp

Filesize
14.0MB

Download
memory/2596-155-0x0000000000400000-0x000000000062B000-memory.dmp

Filesize
2.2MB

Download
memory/2596-156-0x0000000001100000-0x0000000001EF5000-memory.dmp

Filesize
14.0MB

Download
memory/2596-157-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2596-158-0x0000000035530000-0x0000000035AD4000-memory.dmp

Filesize
5.6MB

Download
memory/2596-160-0x0000000034E60000-0x0000000034EC6000-memory.dmp

Filesize
408KB

Download
memory/2596-161-0x0000000034ED0000-0x0000000034EE0000-memory.dmp

Filesize
64KB

Download
memory/2596-162-0x0000000035DC0000-0x0000000035E52000-memory.dmp

Filesize
584KB

Download
memory/2596-163-0x0000000035D20000-0x0000000035D2A000-memory.dmp

Filesize
40KB

Download
memory/2596-164-0x0000000001100000-0x0000000001EF5000-memory.dmp

Filesize
14.0MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads