agenttesla | 4da86275e812956ff0873926fc947334e4a398a623241028babaabf252a2ea0e

General

Target

ungziped_file.exe
Size

504KB
MD5

4e779addb4aeb32182ad139fdf0b5045
SHA1

8313c21225aaaa03d09947843d44e33d3e513257
SHA256

4da86275e812956ff0873926fc947334e4a398a623241028babaabf252a2ea0e
SHA512

a603d57a958c815c5c353fb18c150325bd614ab2b708ceadce6677f6dc5cd324ce668e90edfa5e23113604d43764a639daac7f1d73cf93236eee93cba08f63bc
SSDEEP

12288:nz9GxaChlC3qKOcVbNUW+YCt/JSyhtrVtYHe4P1vg:cC3iKNUWuSyhtTYH7P1g

Score

10^/10

agenttesla guloader downloader keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: ftp
Host:
ftp://ftp.homesteadgroove.com
Port:
21
Username:
[email protected]
Password:
430M=DwOtIfm

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Checks QEMU agent file 2 TTPs 2 IoCs

Checks presence of QEMU agent, possibly to detect virtualization.

Query Registry

T1012

System Information Discovery

T1082

Processes:

ungziped_file.execaspol.exe

description	ioc	process
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	ungziped_file.exe
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	caspol.exe

Loads dropped DLL 1 IoCs

Processes:

ungziped_file.exe

pid process

4848 ungziped_file.exe
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

45 api.ipify.org
46 api.ipify.org
Drops file in System32 directory 1 IoCs

Processes:

ungziped_file.exe

description ioc process

File opened for modification C:\Windows\SysWOW64\Corymbosely.For ungziped_file.exe
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

Processes:

caspol.exe

pid process

1480 caspol.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

ungziped_file.execaspol.exe

pid process

4848 ungziped_file.exe
1480 caspol.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

ungziped_file.exe

description pid process target process

PID 4848 set thread context of 1480 4848 ungziped_file.exe caspol.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4732 1480 WerFault.exe caspol.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

ungziped_file.exe

pid process

4848 ungziped_file.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

caspol.exe

description pid process

Token: SeDebugPrivilege 1480 caspol.exe

pid	process
4848	ungziped_file.exe

flow	ioc
45	api.ipify.org
46	api.ipify.org

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\Corymbosely.For	ungziped_file.exe

pid	process
1480	caspol.exe

pid	process
4848	ungziped_file.exe
1480	caspol.exe

description	pid	process	target process
PID 4848 set thread context of 1480	4848	ungziped_file.exe	caspol.exe

pid	pid_target	process	target process
4732	1480	WerFault.exe	caspol.exe

pid	process
4848	ungziped_file.exe

description	pid	process
Token: SeDebugPrivilege	1480	caspol.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

ungziped_file.exe

description	pid	process	target process
PID 4848 wrote to memory of 1480	4848	ungziped_file.exe	caspol.exe
PID 4848 wrote to memory of 1480	4848	ungziped_file.exe	caspol.exe
PID 4848 wrote to memory of 1480	4848	ungziped_file.exe	caspol.exe
PID 4848 wrote to memory of 1480	4848	ungziped_file.exe	caspol.exe

C:\Users\Admin\AppData\Local\Temp\ungziped_file.exe
"C:\Users\Admin\AppData\Local\Temp\ungziped_file.exe"
1⤵
- Checks QEMU agent file
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4848

C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe
"C:\Users\Admin\AppData\Local\Temp\ungziped_file.exe"
2⤵
- Checks QEMU agent file
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:1480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1480 -s 1820
3⤵
- Program crash
PID:4732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 1480 -ip 1480
1⤵
PID:4524

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsh8D43.tmp\System.dll
Filesize
11KB

MD5
17ed1c86bd67e78ade4712be48a7d2bd

SHA1
1cc9fe86d6d6030b4dae45ecddce5907991c01a0

SHA256
bd046e6497b304e4ea4ab102cab2b1f94ce09bde0eebba4c59942a732679e4eb

SHA512
0cbed521e7d6d1f85977b3f7d3ca7ac34e1b5495b69fd8c7bfa1a846baf53b0ecd06fe1ad02a3599082ffacaf8c71a3bb4e32dec05f8e24859d736b828092cd5

Download Submit
memory/1480-148-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1480-144-0x0000000001340000-0x00000000042F0000-memory.dmp

Filesize
47.7MB

Download
memory/1480-145-0x0000000000400000-0x000000000062B000-memory.dmp

Filesize
2.2MB

Download
memory/1480-147-0x0000000001340000-0x00000000042F0000-memory.dmp

Filesize
47.7MB

Download
memory/1480-149-0x0000000001340000-0x00000000042F0000-memory.dmp

Filesize
47.7MB

Download
memory/1480-150-0x00000000372B0000-0x0000000037854000-memory.dmp

Filesize
5.6MB

Download
memory/1480-151-0x00000000012D0000-0x0000000001336000-memory.dmp

Filesize
408KB

Download
memory/1480-152-0x0000000036E20000-0x0000000036E30000-memory.dmp

Filesize
64KB

Download
memory/1480-153-0x0000000038050000-0x00000000380E2000-memory.dmp

Filesize
584KB

Download
memory/1480-154-0x0000000038020000-0x000000003802A000-memory.dmp

Filesize
40KB

Download
memory/1480-156-0x0000000001340000-0x00000000042F0000-memory.dmp

Filesize
47.7MB

Download
memory/4848-143-0x00000000030E0000-0x0000000006090000-memory.dmp

Filesize
47.7MB

Download
memory/4848-142-0x00000000030E0000-0x0000000006090000-memory.dmp

Filesize
47.7MB

Download

Analysis

Sharing