Analysis
-
max time kernel
142s -
max time network
144s -
platform
windows10_x64 -
resource
win10 -
submitted
24-06-2020 15:08
General
-
Target
RFQ.exe
-
Size
1.3MB
-
MD5
078c44464a42878961a16fcabf731114
-
SHA1
8be1ce5318546a2f68bf58ed0507bc419058ef05
-
SHA256
90cca0bc037f3b3e5ac45af4d2c3233da62776630d330113621d1a4f531c4dfd
-
SHA512
f19968ea8a490db9424c3c746ec6acde2a6522b52f947a2532cad12fd65916199032ff7cf76760af5ff904426dd27258bfe4af6a0035df8ae2e2cba6e5866176
Score
10/10
Malware Config
Extracted
Credentials
Protocol: smtp- Host:
mail.travelsapphire.com - Port:
587 - Username:
sharwan.kumar@travelsapphire.com - Password:
A7dth4xADt{61
Extracted
Family
agenttesla
Credentials
Protocol: smtp- Host:
mail.travelsapphire.com - Port:
587 - Username:
sharwan.kumar@travelsapphire.com - Password:
A7dth4xADt{61
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 2 IoCs
-
Drops startup file 1 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 3 IoCs
-
Suspicious use of SendNotifyMessage 3 IoCs
-
Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\RFQ.exe"C:\Users\Admin\AppData\Local\Temp\RFQ.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"C:\\\\Windows\\\\Microsoft.NET\\\\Framework\\\\v2.0.50727\\\\MSBuild.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2296-1-0x000000000085700E-mapping.dmp
-
memory/2296-0-0x0000000000810000-0x000000000085C000-memory.dmpFilesize
304KB