agenttesla | 7d6e9247de0527fa4c0939c4f6e6726a35cb5f39492a7aeab5614ac1ab29b294

General

Target

MT103009767643 JPG.exe
Size

452KB
MD5

406b3d0752bdde1706509e02f449dc1d
SHA1

a88933d9f0cff0102f089615c9580bcc10a1e405
SHA256

7d6e9247de0527fa4c0939c4f6e6726a35cb5f39492a7aeab5614ac1ab29b294
SHA512

ab4ed78658b7c5146f10cecb799fd7c6eed855f0b1a2264918ca6df6d3974441bccde6d277adeaff2efc1a4702ce2835f4303d2627300ab8ae63a40f7d900d60
SSDEEP

6144:8pdgaK9poZuKEliNUHFIhMbLpGdPhCXgz0cWZp1IUl5BCZ6v0:eg7OZuXcNNynpGPCXk09Zp+0zCN

Score

10^/10

agenttesla guloader collection downloader keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: ftp
Host:
ftp://ftp.mcmprint.net
Port:
21
Username:
[email protected]
Password:
FpFpVzJdTV!d

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Checks QEMU agent file 2 TTPs 2 IoCs

Checks presence of QEMU agent, possibly to detect virtualization.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	MT103009767643 JPG.exe
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	caspol.exe

Loads dropped DLL 1 IoCs

pid	Process
1424	MT103009767643 JPG.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	caspol.exe
Key opened	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	caspol.exe
Key opened	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	caspol.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
6	api.ipify.org
7	api.ipify.org

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
520	caspol.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1424	MT103009767643 JPG.exe
520	caspol.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1424 set thread context of 520	1424	MT103009767643 JPG.exe	27

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Fonts\Xeric\Clonking\centralstyrelse\Patenthavere.ini	MT103009767643 JPG.exe
File opened for modification	C:\Windows\resources\crummy\Shanked\Tiggerbrevene.ini	MT103009767643 JPG.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1424	MT103009767643 JPG.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	520	caspol.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1424 wrote to memory of 520	1424	MT103009767643 JPG.exe	27
PID 1424 wrote to memory of 520	1424	MT103009767643 JPG.exe	27
PID 1424 wrote to memory of 520	1424	MT103009767643 JPG.exe	27
PID 1424 wrote to memory of 520	1424	MT103009767643 JPG.exe	27
PID 1424 wrote to memory of 520	1424	MT103009767643 JPG.exe	27

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	caspol.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	caspol.exe

C:\Users\Admin\AppData\Local\Temp\MT103009767643 JPG.exe
"C:\Users\Admin\AppData\Local\Temp\MT103009767643 JPG.exe"
1⤵
- Checks QEMU agent file
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1424
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe
  "C:\Users\Admin\AppData\Local\Temp\MT103009767643 JPG.exe"
  2⤵
  - Checks QEMU agent file
  - Accesses Microsoft Outlook profiles
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of AdjustPrivilegeToken
  - outlook_office_path
  - outlook_win_path
  PID:520

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nso31AD.tmp\System.dll

Filesize
11KB

MD5
3f176d1ee13b0d7d6bd92e1c7a0b9bae

SHA1
fe582246792774c2c9dd15639ffa0aca90d6fd0b

SHA256
fa4ab1d6f79fd677433a31ada7806373a789d34328da46ccb0449bbf347bd73e

SHA512
0a69124819b7568d0dea4e9e85ce8fe61c7ba697c934e3a95e2dcfb9f252b1d9da7faf8774b6e8efd614885507acc94987733eba09a2f5e7098b774dfc8524b6

Download Submit
memory/520-67-0x00000000013A0000-0x0000000002D7F000-memory.dmp

Filesize
25.9MB

Download
memory/520-68-0x00000000013A0000-0x0000000002D7F000-memory.dmp

Filesize
25.9MB

Download
memory/520-69-0x0000000000400000-0x0000000000615000-memory.dmp

Filesize
2.1MB

Download
memory/520-70-0x00000000013A0000-0x0000000002D7F000-memory.dmp

Filesize
25.9MB

Download
memory/520-71-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/520-73-0x0000000000340000-0x0000000000380000-memory.dmp

Filesize
256KB

Download
memory/520-92-0x0000000000340000-0x0000000000380000-memory.dmp

Filesize
256KB

Download
memory/1424-65-0x00000000024E0000-0x0000000003EBF000-memory.dmp

Filesize
25.9MB

Download
memory/1424-66-0x00000000024E0000-0x0000000003EBF000-memory.dmp

Filesize
25.9MB

Download

Analysis

Sharing