Analysis
-
max time kernel
112s -
max time network
22s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
22-07-2021 12:42
Static task
static1
Behavioral task
behavioral1
Sample
RFQ.pif.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
RFQ.pif.exe
Resource
win10v20210408
General
-
Target
RFQ.pif.exe
-
Size
793KB
-
MD5
8faf3df57f1bf78beea427593b0910c4
-
SHA1
34f825ae4105d49603ca58ce36eed47ccce94f62
-
SHA256
7b1d2f2e48d2f1c83a5524ae8febc8594f67d1bfdd76955b9a98e91bd6494279
-
SHA512
d6113bbdd60af4f667ad5e6cf47edc5fe4b445a6696458bc18a4ab4bea114689f32b3a474c230a9152e175f4bec2c8289f0d2c13c9d699211d4ef3051b7807d9
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.yandex.com - Port:
587 - Username:
[email protected] - Password:
myrecords1248
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1644-110-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla behavioral1/memory/1644-111-0x00000000004375DE-mapping.dmp family_agenttesla behavioral1/memory/1644-112-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla -
Suspicious use of SetThreadContext 1 IoCs
Processes:
RFQ.pif.exedescription pid process target process PID 1028 set thread context of 1644 1028 RFQ.pif.exe RFQ.pif.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs ping.exe 1 TTPs 4 IoCs
Processes:
PING.EXEPING.EXEPING.EXEPING.EXEpid process 664 PING.EXE 1268 PING.EXE 1596 PING.EXE 1292 PING.EXE -
Suspicious behavior: EnumeratesProcesses 11 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exeRFQ.pif.exeRFQ.pif.exepid process 1636 powershell.exe 1636 powershell.exe 1100 powershell.exe 1100 powershell.exe 512 powershell.exe 512 powershell.exe 2032 powershell.exe 2032 powershell.exe 1028 RFQ.pif.exe 1644 RFQ.pif.exe 1644 RFQ.pif.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exeRFQ.pif.exeRFQ.pif.exedescription pid process Token: SeDebugPrivilege 1636 powershell.exe Token: SeDebugPrivilege 1100 powershell.exe Token: SeDebugPrivilege 512 powershell.exe Token: SeDebugPrivilege 2032 powershell.exe Token: SeDebugPrivilege 1028 RFQ.pif.exe Token: SeDebugPrivilege 1644 RFQ.pif.exe -
Suspicious use of WriteProcessMemory 41 IoCs
Processes:
RFQ.pif.exepowershell.exepowershell.exepowershell.exepowershell.exedescription pid process target process PID 1028 wrote to memory of 1636 1028 RFQ.pif.exe powershell.exe PID 1028 wrote to memory of 1636 1028 RFQ.pif.exe powershell.exe PID 1028 wrote to memory of 1636 1028 RFQ.pif.exe powershell.exe PID 1028 wrote to memory of 1636 1028 RFQ.pif.exe powershell.exe PID 1636 wrote to memory of 664 1636 powershell.exe PING.EXE PID 1636 wrote to memory of 664 1636 powershell.exe PING.EXE PID 1636 wrote to memory of 664 1636 powershell.exe PING.EXE PID 1636 wrote to memory of 664 1636 powershell.exe PING.EXE PID 1028 wrote to memory of 1100 1028 RFQ.pif.exe powershell.exe PID 1028 wrote to memory of 1100 1028 RFQ.pif.exe powershell.exe PID 1028 wrote to memory of 1100 1028 RFQ.pif.exe powershell.exe PID 1028 wrote to memory of 1100 1028 RFQ.pif.exe powershell.exe PID 1100 wrote to memory of 1268 1100 powershell.exe PING.EXE PID 1100 wrote to memory of 1268 1100 powershell.exe PING.EXE PID 1100 wrote to memory of 1268 1100 powershell.exe PING.EXE PID 1100 wrote to memory of 1268 1100 powershell.exe PING.EXE PID 1028 wrote to memory of 512 1028 RFQ.pif.exe powershell.exe PID 1028 wrote to memory of 512 1028 RFQ.pif.exe powershell.exe PID 1028 wrote to memory of 512 1028 RFQ.pif.exe powershell.exe PID 1028 wrote to memory of 512 1028 RFQ.pif.exe powershell.exe PID 512 wrote to memory of 1596 512 powershell.exe PING.EXE PID 512 wrote to memory of 1596 512 powershell.exe PING.EXE PID 512 wrote to memory of 1596 512 powershell.exe PING.EXE PID 512 wrote to memory of 1596 512 powershell.exe PING.EXE PID 1028 wrote to memory of 2032 1028 RFQ.pif.exe powershell.exe PID 1028 wrote to memory of 2032 1028 RFQ.pif.exe powershell.exe PID 1028 wrote to memory of 2032 1028 RFQ.pif.exe powershell.exe PID 1028 wrote to memory of 2032 1028 RFQ.pif.exe powershell.exe PID 2032 wrote to memory of 1292 2032 powershell.exe PING.EXE PID 2032 wrote to memory of 1292 2032 powershell.exe PING.EXE PID 2032 wrote to memory of 1292 2032 powershell.exe PING.EXE PID 2032 wrote to memory of 1292 2032 powershell.exe PING.EXE PID 1028 wrote to memory of 1644 1028 RFQ.pif.exe RFQ.pif.exe PID 1028 wrote to memory of 1644 1028 RFQ.pif.exe RFQ.pif.exe PID 1028 wrote to memory of 1644 1028 RFQ.pif.exe RFQ.pif.exe PID 1028 wrote to memory of 1644 1028 RFQ.pif.exe RFQ.pif.exe PID 1028 wrote to memory of 1644 1028 RFQ.pif.exe RFQ.pif.exe PID 1028 wrote to memory of 1644 1028 RFQ.pif.exe RFQ.pif.exe PID 1028 wrote to memory of 1644 1028 RFQ.pif.exe RFQ.pif.exe PID 1028 wrote to memory of 1644 1028 RFQ.pif.exe RFQ.pif.exe PID 1028 wrote to memory of 1644 1028 RFQ.pif.exe RFQ.pif.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\RFQ.pif.exe"C:\Users\Admin\AppData\Local\Temp\RFQ.pif.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ping gooogle.com2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXE"C:\Windows\system32\PING.EXE" gooogle.com3⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ping gooogle.com2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXE"C:\Windows\system32\PING.EXE" gooogle.com3⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ping gooogle.com2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXE"C:\Windows\system32\PING.EXE" gooogle.com3⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ping gooogle.com2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXE"C:\Windows\system32\PING.EXE" gooogle.com3⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Local\Temp\RFQ.pif.exeC:\Users\Admin\AppData\Local\Temp\RFQ.pif.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msMD5
e3f42543f790c14aeace623109f3d4f6
SHA1aff0b3c10dec7ab7960b0bee5fe1b4b707c50a77
SHA256344891bd81fe477d55fcea0464ba463207aab4c687591b7f769effb30ec58d45
SHA5121874b75e81a02cb4a9f18220e71aace2fc2bc8602baed91a9ba55d1a5616316a0001db4a7a839ece7dffc212daa047051339d7ad367386b495b3d23c889131ab
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msMD5
e3f42543f790c14aeace623109f3d4f6
SHA1aff0b3c10dec7ab7960b0bee5fe1b4b707c50a77
SHA256344891bd81fe477d55fcea0464ba463207aab4c687591b7f769effb30ec58d45
SHA5121874b75e81a02cb4a9f18220e71aace2fc2bc8602baed91a9ba55d1a5616316a0001db4a7a839ece7dffc212daa047051339d7ad367386b495b3d23c889131ab
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msMD5
e3f42543f790c14aeace623109f3d4f6
SHA1aff0b3c10dec7ab7960b0bee5fe1b4b707c50a77
SHA256344891bd81fe477d55fcea0464ba463207aab4c687591b7f769effb30ec58d45
SHA5121874b75e81a02cb4a9f18220e71aace2fc2bc8602baed91a9ba55d1a5616316a0001db4a7a839ece7dffc212daa047051339d7ad367386b495b3d23c889131ab
-
memory/512-89-0x0000000004A10000-0x0000000004A11000-memory.dmpFilesize
4KB
-
memory/512-88-0x00000000027D0000-0x00000000027D1000-memory.dmpFilesize
4KB
-
memory/512-87-0x0000000004A70000-0x0000000004A71000-memory.dmpFilesize
4KB
-
memory/512-86-0x0000000002470000-0x0000000002471000-memory.dmpFilesize
4KB
-
memory/512-83-0x0000000000000000-mapping.dmp
-
memory/512-92-0x0000000004A32000-0x0000000004A33000-memory.dmpFilesize
4KB
-
memory/512-90-0x0000000004A30000-0x0000000004A31000-memory.dmpFilesize
4KB
-
memory/664-72-0x0000000000000000-mapping.dmp
-
memory/1028-60-0x00000000010B0000-0x00000000010B1000-memory.dmpFilesize
4KB
-
memory/1028-103-0x0000000004CC0000-0x0000000004D10000-memory.dmpFilesize
320KB
-
memory/1028-108-0x0000000007D90000-0x0000000007DF2000-memory.dmpFilesize
392KB
-
memory/1028-109-0x0000000004D36000-0x0000000004D37000-memory.dmpFilesize
4KB
-
memory/1028-63-0x0000000004D25000-0x0000000004D36000-memory.dmpFilesize
68KB
-
memory/1028-62-0x0000000004D20000-0x0000000004D21000-memory.dmpFilesize
4KB
-
memory/1100-73-0x0000000000000000-mapping.dmp
-
memory/1100-81-0x0000000004992000-0x0000000004993000-memory.dmpFilesize
4KB
-
memory/1100-80-0x0000000004990000-0x0000000004991000-memory.dmpFilesize
4KB
-
memory/1268-82-0x0000000000000000-mapping.dmp
-
memory/1292-102-0x0000000000000000-mapping.dmp
-
memory/1596-91-0x0000000000000000-mapping.dmp
-
memory/1636-71-0x0000000005290000-0x0000000005291000-memory.dmpFilesize
4KB
-
memory/1636-66-0x0000000000AE0000-0x0000000000AE1000-memory.dmpFilesize
4KB
-
memory/1636-69-0x0000000004812000-0x0000000004813000-memory.dmpFilesize
4KB
-
memory/1636-68-0x0000000004810000-0x0000000004811000-memory.dmpFilesize
4KB
-
memory/1636-70-0x0000000002540000-0x0000000002541000-memory.dmpFilesize
4KB
-
memory/1636-64-0x0000000000000000-mapping.dmp
-
memory/1636-65-0x0000000075801000-0x0000000075803000-memory.dmpFilesize
8KB
-
memory/1636-67-0x0000000004850000-0x0000000004851000-memory.dmpFilesize
4KB
-
memory/1644-114-0x0000000004B90000-0x0000000004B91000-memory.dmpFilesize
4KB
-
memory/1644-112-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1644-111-0x00000000004375DE-mapping.dmp
-
memory/1644-110-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/2032-96-0x0000000000C90000-0x0000000000C91000-memory.dmpFilesize
4KB
-
memory/2032-100-0x00000000048D0000-0x00000000048D1000-memory.dmpFilesize
4KB
-
memory/2032-101-0x00000000048D2000-0x00000000048D3000-memory.dmpFilesize
4KB
-
memory/2032-99-0x0000000005300000-0x0000000005301000-memory.dmpFilesize
4KB
-
memory/2032-98-0x0000000002790000-0x0000000002791000-memory.dmpFilesize
4KB
-
memory/2032-97-0x0000000004910000-0x0000000004911000-memory.dmpFilesize
4KB
-
memory/2032-93-0x0000000000000000-mapping.dmp