agenttesla | 7eafd68528456b8716f600f930244a127395599274ed708ed8f02e6e7a68f373

General

Target

RFQ.exe

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot1430995407:AAHXagqOb3lOiloF-tdsg1GOLPStlDuzDNw/sendDocument

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/436-10-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/436-11-0x000000000043765E-mapping.dmp	family_agenttesla
behavioral1/memory/436-13-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

Processes:

RFQ.exe

description pid process target process

PID 296 set thread context of 436 296 RFQ.exe RFQ.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1704 schtasks.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

RFQ.exeRFQ.exe

pid process

296 RFQ.exe
436 RFQ.exe
436 RFQ.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

RFQ.exeRFQ.exe

description pid process

Token: SeDebugPrivilege 296 RFQ.exe
Token: SeDebugPrivilege 436 RFQ.exe

description	pid	process	target process
PID 296 set thread context of 436	296	RFQ.exe	RFQ.exe

pid	process
1704	schtasks.exe

pid	process
296	RFQ.exe
436	RFQ.exe
436	RFQ.exe

description	pid	process
Token: SeDebugPrivilege	296	RFQ.exe
Token: SeDebugPrivilege	436	RFQ.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

RFQ.exe

description	pid	process	target process
PID 296 wrote to memory of 1704	296	RFQ.exe	schtasks.exe
PID 296 wrote to memory of 1704	296	RFQ.exe	schtasks.exe
PID 296 wrote to memory of 1704	296	RFQ.exe	schtasks.exe
PID 296 wrote to memory of 1704	296	RFQ.exe	schtasks.exe
PID 296 wrote to memory of 436	296	RFQ.exe	RFQ.exe
PID 296 wrote to memory of 436	296	RFQ.exe	RFQ.exe
PID 296 wrote to memory of 436	296	RFQ.exe	RFQ.exe
PID 296 wrote to memory of 436	296	RFQ.exe	RFQ.exe
PID 296 wrote to memory of 436	296	RFQ.exe	RFQ.exe
PID 296 wrote to memory of 436	296	RFQ.exe	RFQ.exe
PID 296 wrote to memory of 436	296	RFQ.exe	RFQ.exe
PID 296 wrote to memory of 436	296	RFQ.exe	RFQ.exe
PID 296 wrote to memory of 436	296	RFQ.exe	RFQ.exe

C:\Users\Admin\AppData\Local\Temp\RFQ.exe
"C:\Users\Admin\AppData\Local\Temp\RFQ.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:296

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\nWlomDVuvkU" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA5A2.tmp"
2⤵
- Creates scheduled task(s)
PID:1704

C:\Users\Admin\AppData\Local\Temp\RFQ.exe
"C:\Users\Admin\AppData\Local\Temp\RFQ.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:436

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpA5A2.tmp
MD5
2796fdd453308b2a056eccc36e500a7d

SHA1
a3d9187641088655ed9a70e5e643fac444c36a70

SHA256
878af53b9a8d851aa204a4383f1343ae96884c6d8276a60ad77e6eec74f47580

SHA512
a4f66cb70e0238255fb81b29365773fd365f8c23c14e355d3d6e19c8a05b4cf27b65e51988f3794fcb5b3dd572bbfe77ec947b36fd92eec8ae7ae0d88a7e8270

Download Submit
memory/296-2-0x00000000748D0000-0x0000000074FBE000-memory.dmp

Filesize
6.9MB

Download
memory/296-3-0x0000000000DC0000-0x0000000000DC1000-memory.dmp

Filesize
4KB

Download
memory/296-5-0x0000000004E80000-0x0000000004E81000-memory.dmp

Filesize
4KB

Download
memory/296-6-0x00000000004C0000-0x00000000004C3000-memory.dmp

Filesize
12KB

Download
memory/296-7-0x0000000000D50000-0x0000000000DAC000-memory.dmp

Filesize
368KB

Download
memory/436-10-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/436-11-0x000000000043765E-mapping.dmp

Download
memory/436-12-0x00000000748D0000-0x0000000074FBE000-memory.dmp

Filesize
6.9MB

Download
memory/436-13-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/436-15-0x0000000004B80000-0x0000000004B81000-memory.dmp

Filesize
4KB

Download
memory/1704-8-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads