agenttesla | c202341f6d54b9b2bc6ee1c53e51260a0adf11a81f9a509429f9039ef1d00600

General

Target

EXTRACTO BANCARIO.PDF.bat.exe
Size

803KB
MD5

7d131fe663e316890234bd712c7412a4
SHA1

6cf5321a87b37bf68a1000cf6e2ea0ffff8cae71
SHA256

c202341f6d54b9b2bc6ee1c53e51260a0adf11a81f9a509429f9039ef1d00600
SHA512

471bd90a2b0ce8c629d709383d0353a8a5ae20ad24f890583eea65ef1207a693d8bfeb6901ed50ae9a95f6cc0db27caade1656fb182aaf4ae9659d6f33d96fa7
SSDEEP

12288:9PKcWfPW1nUOMaq2LFbicxjMOJQVZq+F5S9vqI7a2CRbB:FWonUZaqMx2DvSxh7a31

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.phytomer.es
Port:
587
Username:
[email protected]
Password:
@Paqui0033-*
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Checks QEMU agent file 2 TTPs 2 IoCs

Checks presence of QEMU agent, possibly to detect virtualization.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	EXTRACTO BANCARIO.PDF.bat.exe
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	caspol.exe

Loads dropped DLL 1 IoCs

pid	Process
4212	EXTRACTO BANCARIO.PDF.bat.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
3488	caspol.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
4212	EXTRACTO BANCARIO.PDF.bat.exe
3488	caspol.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4212 set thread context of 3488	4212	EXTRACTO BANCARIO.PDF.bat.exe	94

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\Counterargues\Sydkoreaners\Overprecision.ini	EXTRACTO BANCARIO.PDF.bat.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4604	3488	WerFault.exe	94

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3488	caspol.exe
3488	caspol.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
4212	EXTRACTO BANCARIO.PDF.bat.exe
4212	EXTRACTO BANCARIO.PDF.bat.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3488	caspol.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4212 wrote to memory of 2660	4212	EXTRACTO BANCARIO.PDF.bat.exe	93
PID 4212 wrote to memory of 2660	4212	EXTRACTO BANCARIO.PDF.bat.exe	93
PID 4212 wrote to memory of 2660	4212	EXTRACTO BANCARIO.PDF.bat.exe	93
PID 4212 wrote to memory of 3488	4212	EXTRACTO BANCARIO.PDF.bat.exe	94
PID 4212 wrote to memory of 3488	4212	EXTRACTO BANCARIO.PDF.bat.exe	94
PID 4212 wrote to memory of 3488	4212	EXTRACTO BANCARIO.PDF.bat.exe	94
PID 4212 wrote to memory of 3488	4212	EXTRACTO BANCARIO.PDF.bat.exe	94

C:\Users\Admin\AppData\Local\Temp\EXTRACTO BANCARIO.PDF.bat.exe
"C:\Users\Admin\AppData\Local\Temp\EXTRACTO BANCARIO.PDF.bat.exe"
1⤵
- Checks QEMU agent file
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4212
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe
  "C:\Users\Admin\AppData\Local\Temp\EXTRACTO BANCARIO.PDF.bat.exe"
  2⤵
  PID:2660
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe
  "C:\Users\Admin\AppData\Local\Temp\EXTRACTO BANCARIO.PDF.bat.exe"
  2⤵
  - Checks QEMU agent file
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3488
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3488 -s 2336
    3⤵
    - Program crash
    PID:4604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3488 -ip 3488
1⤵
PID:2144

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Web Service

1

T1102

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsg986E.tmp\System.dll

Filesize
11KB

MD5
8b3830b9dbf87f84ddd3b26645fed3a0

SHA1
223bef1f19e644a610a0877d01eadc9e28299509

SHA256
f004c568d305cd95edbd704166fcd2849d395b595dff814bcc2012693527ac37

SHA512
d13cfd98db5ca8dc9c15723eee0e7454975078a776bce26247228be4603a0217e166058ebadc68090afe988862b7514cb8cb84de13b3de35737412a6f0a8ac03

Download Submit
C:\Users\Admin\Desktop\Cream.ini

Filesize
47B

MD5
d433d70ff7e5bd12df3fe030ae10cd13

SHA1
2f3366764cabb08288b71a0430c953a566100be1

SHA256
9a4c87e19523123883e40363a84d37412c7563b92781677a51ab870318565403

SHA512
7024cb6b81c70838cdd740642a64115db5fb4fe76a7a8d428f12a6de89f374f1706e06483e2b0935c91f3b140fd648a4b3ca8f5ba32b507add29e4cb33c1d560

Download Submit
memory/3488-149-0x0000000000400000-0x000000000062B000-memory.dmp

Filesize
2.2MB

Download
memory/3488-162-0x0000000000400000-0x000000000062B000-memory.dmp

Filesize
2.2MB

Download
memory/3488-163-0x0000000000B00000-0x0000000004221000-memory.dmp

Filesize
55.1MB

Download
memory/3488-165-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/3488-166-0x00000000378C0000-0x0000000037E64000-memory.dmp

Filesize
5.6MB

Download
memory/3488-167-0x0000000000A90000-0x0000000000AF6000-memory.dmp

Filesize
408KB

Download
memory/3488-168-0x0000000037500000-0x0000000037510000-memory.dmp

Filesize
64KB

Download
memory/3488-169-0x0000000000B00000-0x0000000004221000-memory.dmp

Filesize
55.1MB

Download

Analysis

Sharing