Overview

overview

10

Static

static

RFQ Our R...43.exe

windows7_x64

10

RFQ Our R...43.exe

windows10_x64

10

Analysis

  • max time kernel
    123s
  • max time network
    135s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    23-04-2021 09:37

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    RFQ Our Reference 2021-1143.exe

  • Size

    684KB

  • MD5

    a1ef7cc0e83d9d8ede4311bfe8e124c7

  • SHA1

    a87429754bed0dfff38aa6cc63fbe8d5568a91c9

  • SHA256

    6594b68c027f44465b539374abe5791c970a82b3be282911d2e95a9f459f61f3

  • SHA512

    4bc38dc390a63a369eed9bca032de8f9b0a1b720dcd976a7753e5c3c9bb940f8497ff872f200b279f84a6b26b8e68dc1239a421bc0fd785308ca037eb86bd8cc

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    smtp.mehtagroup.in
  • Port:
    587
  • Username:
    dinesh@mehtagroup.in
  • Password:
    1234@DP#

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla
  • AgentTesla Payload 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\RFQ Our Reference 2021-1143.exe
    "C:\Users\Admin\AppData\Local\Temp\RFQ Our Reference 2021-1143.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:500
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "{path}"
      2⤵
        PID:1484
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        "{path}"
        2⤵
          PID:4052
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
          "{path}"
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4060

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/500-114-0x0000000000310000-0x0000000000311000-memory.dmp
        Filesize

        4KB

        Download
      • memory/500-116-0x00000000050B0000-0x00000000050B1000-memory.dmp
        Filesize

        4KB

        Download
      • memory/500-117-0x0000000004C50000-0x0000000004C51000-memory.dmp
        Filesize

        4KB

        Download
      • memory/500-118-0x0000000004C20000-0x0000000004C21000-memory.dmp
        Filesize

        4KB

        Download
      • memory/500-119-0x0000000004BB0000-0x00000000050AE000-memory.dmp
        Filesize

        5.0MB

        Download
      • memory/500-120-0x0000000008150000-0x0000000008151000-memory.dmp
        Filesize

        4KB

        Download
      • memory/500-121-0x0000000004FA0000-0x0000000004FAE000-memory.dmp
        Filesize

        56KB

        Download
      • memory/500-122-0x0000000008320000-0x00000000083BF000-memory.dmp
        Filesize

        636KB

        Download
      • memory/500-123-0x000000000AAD0000-0x000000000AB31000-memory.dmp
        Filesize

        388KB

        Download
      • memory/4060-124-0x0000000000400000-0x000000000043C000-memory.dmp
        Filesize

        240KB

        Download
      • memory/4060-125-0x000000000043751E-mapping.dmp
        Download
      • memory/4060-130-0x0000000004F30000-0x0000000004F31000-memory.dmp
        Filesize

        4KB

        Download
      • memory/4060-131-0x0000000004F10000-0x0000000004F11000-memory.dmp
        Filesize

        4KB

        Download
      • memory/4060-132-0x0000000005BB0000-0x0000000005BB1000-memory.dmp
        Filesize

        4KB

        Download
      • memory/4060-135-0x0000000004F31000-0x0000000004F32000-memory.dmp
        Filesize

        4KB

        Download