agenttesla | ce45f8e14c6ad2c325d7b4037dbcdc5f3308a9e9aec290ed9b91809054a4a4b8

General

Target

RFQ.exe
Size

519KB
MD5

59addf908576fc93f44a53596bfd79b6
SHA1

b62ffb71adbe02aa75fec583d3b9e68f16b6acfa
SHA256

ce45f8e14c6ad2c325d7b4037dbcdc5f3308a9e9aec290ed9b91809054a4a4b8
SHA512

8d97a7abade54313e896f6725fe2aa76fb2bec30ccf4d1bceed218cd8fe711bc5b53627bd4a080380f97e198f16fd466e6ef1a8d50cc2942cbe18252400fccbc

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot1430995407:AAHXagqOb3lOiloF-tdsg1GOLPStlDuzDNw/sendDocument

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/324-10-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/324-11-0x000000000043765E-mapping.dmp	family_agenttesla
behavioral1/memory/324-13-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

Processes:

RFQ.exe

description pid process target process

PID 1012 set thread context of 324 1012 RFQ.exe RFQ.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1272 schtasks.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

RFQ.exeRFQ.exe

pid process

1012 RFQ.exe
1012 RFQ.exe
324 RFQ.exe
324 RFQ.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

RFQ.exeRFQ.exe

description pid process

Token: SeDebugPrivilege 1012 RFQ.exe
Token: SeDebugPrivilege 324 RFQ.exe

description	pid	process	target process
PID 1012 set thread context of 324	1012	RFQ.exe	RFQ.exe

pid	process
1272	schtasks.exe

pid	process
1012	RFQ.exe
1012	RFQ.exe
324	RFQ.exe
324	RFQ.exe

description	pid	process
Token: SeDebugPrivilege	1012	RFQ.exe
Token: SeDebugPrivilege	324	RFQ.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

RFQ.exe

description	pid	process	target process
PID 1012 wrote to memory of 1272	1012	RFQ.exe	schtasks.exe
PID 1012 wrote to memory of 1272	1012	RFQ.exe	schtasks.exe
PID 1012 wrote to memory of 1272	1012	RFQ.exe	schtasks.exe
PID 1012 wrote to memory of 1272	1012	RFQ.exe	schtasks.exe
PID 1012 wrote to memory of 932	1012	RFQ.exe	RFQ.exe
PID 1012 wrote to memory of 932	1012	RFQ.exe	RFQ.exe
PID 1012 wrote to memory of 932	1012	RFQ.exe	RFQ.exe
PID 1012 wrote to memory of 932	1012	RFQ.exe	RFQ.exe
PID 1012 wrote to memory of 324	1012	RFQ.exe	RFQ.exe
PID 1012 wrote to memory of 324	1012	RFQ.exe	RFQ.exe
PID 1012 wrote to memory of 324	1012	RFQ.exe	RFQ.exe
PID 1012 wrote to memory of 324	1012	RFQ.exe	RFQ.exe
PID 1012 wrote to memory of 324	1012	RFQ.exe	RFQ.exe
PID 1012 wrote to memory of 324	1012	RFQ.exe	RFQ.exe
PID 1012 wrote to memory of 324	1012	RFQ.exe	RFQ.exe
PID 1012 wrote to memory of 324	1012	RFQ.exe	RFQ.exe
PID 1012 wrote to memory of 324	1012	RFQ.exe	RFQ.exe

C:\Users\Admin\AppData\Local\Temp\RFQ.exe
"C:\Users\Admin\AppData\Local\Temp\RFQ.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1012

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\nWlomDVuvkU" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD1A1.tmp"
2⤵
- Creates scheduled task(s)
PID:1272

C:\Users\Admin\AppData\Local\Temp\RFQ.exe
"C:\Users\Admin\AppData\Local\Temp\RFQ.exe"
2⤵
PID:932

C:\Users\Admin\AppData\Local\Temp\RFQ.exe
"C:\Users\Admin\AppData\Local\Temp\RFQ.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:324

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpD1A1.tmp
MD5
2796fdd453308b2a056eccc36e500a7d

SHA1
a3d9187641088655ed9a70e5e643fac444c36a70

SHA256
878af53b9a8d851aa204a4383f1343ae96884c6d8276a60ad77e6eec74f47580

SHA512
a4f66cb70e0238255fb81b29365773fd365f8c23c14e355d3d6e19c8a05b4cf27b65e51988f3794fcb5b3dd572bbfe77ec947b36fd92eec8ae7ae0d88a7e8270

Download Submit
memory/324-10-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/324-11-0x000000000043765E-mapping.dmp

Download
memory/324-12-0x0000000074D20000-0x000000007540E000-memory.dmp

Filesize
6.9MB

Download
memory/324-13-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/324-15-0x0000000004500000-0x0000000004501000-memory.dmp

Filesize
4KB

Download
memory/1012-2-0x0000000074D20000-0x000000007540E000-memory.dmp

Filesize
6.9MB

Download
memory/1012-3-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/1012-5-0x0000000004800000-0x0000000004801000-memory.dmp

Filesize
4KB

Download
memory/1012-6-0x0000000000660000-0x0000000000663000-memory.dmp

Filesize
12KB

Download
memory/1012-7-0x0000000004840000-0x000000000489C000-memory.dmp

Filesize
368KB

Download
memory/1272-8-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads