Overview

overview

10

Static

static

RFQ Our R...43.exe

windows7_x64

10

RFQ Our R...43.exe

windows10_x64

10

Analysis

  • max time kernel
    132s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7v20210410
  • submitted
    23-04-2021 09:37

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    RFQ Our Reference 2021-1143.exe

  • Size

    684KB

  • MD5

    a1ef7cc0e83d9d8ede4311bfe8e124c7

  • SHA1

    a87429754bed0dfff38aa6cc63fbe8d5568a91c9

  • SHA256

    6594b68c027f44465b539374abe5791c970a82b3be282911d2e95a9f459f61f3

  • SHA512

    4bc38dc390a63a369eed9bca032de8f9b0a1b720dcd976a7753e5c3c9bb940f8497ff872f200b279f84a6b26b8e68dc1239a421bc0fd785308ca037eb86bd8cc

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    smtp.mehtagroup.in
  • Port:
    587
  • Username:
    dinesh@mehtagroup.in
  • Password:
    1234@DP#

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla
  • AgentTesla Payload 3 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\RFQ Our Reference 2021-1143.exe
    "C:\Users\Admin\AppData\Local\Temp\RFQ Our Reference 2021-1143.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:296
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "{path}"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:844

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/296-59-0x0000000000C00000-0x0000000000C01000-memory.dmp
    Filesize

    4KB

    Download
  • memory/296-61-0x0000000004F20000-0x0000000004F21000-memory.dmp
    Filesize

    4KB

    Download
  • memory/296-62-0x0000000000260000-0x000000000026E000-memory.dmp
    Filesize

    56KB

    Download
  • memory/296-63-0x0000000004E30000-0x0000000004ECF000-memory.dmp
    Filesize

    636KB

    Download
  • memory/296-64-0x0000000005300000-0x0000000005361000-memory.dmp
    Filesize

    388KB

    Download
  • memory/844-65-0x0000000000400000-0x000000000043C000-memory.dmp
    Filesize

    240KB

    Download
  • memory/844-66-0x000000000043751E-mapping.dmp
    Download
  • memory/844-67-0x0000000000400000-0x000000000043C000-memory.dmp
    Filesize

    240KB

    Download
  • memory/844-69-0x0000000000210000-0x0000000000211000-memory.dmp
    Filesize

    4KB

    Download
  • memory/844-70-0x0000000000211000-0x0000000000212000-memory.dmp
    Filesize

    4KB

    Download