Analysis
-
max time kernel
108s -
max time network
118s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
22-07-2021 12:42
Static task
static1
Behavioral task
behavioral1
Sample
RFQ.pif.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
RFQ.pif.exe
Resource
win10v20210408
General
-
Target
RFQ.pif.exe
-
Size
793KB
-
MD5
8faf3df57f1bf78beea427593b0910c4
-
SHA1
34f825ae4105d49603ca58ce36eed47ccce94f62
-
SHA256
7b1d2f2e48d2f1c83a5524ae8febc8594f67d1bfdd76955b9a98e91bd6494279
-
SHA512
d6113bbdd60af4f667ad5e6cf47edc5fe4b445a6696458bc18a4ab4bea114689f32b3a474c230a9152e175f4bec2c8289f0d2c13c9d699211d4ef3051b7807d9
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.yandex.com - Port:
587 - Username:
[email protected] - Password:
myrecords1248
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/2872-203-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla behavioral2/memory/2872-204-0x00000000004375DE-mapping.dmp family_agenttesla behavioral2/memory/2872-210-0x00000000051B0000-0x00000000056AE000-memory.dmp family_agenttesla -
Suspicious use of SetThreadContext 1 IoCs
Processes:
RFQ.pif.exedescription pid process target process PID 740 set thread context of 2872 740 RFQ.pif.exe RFQ.pif.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs ping.exe 1 TTPs 4 IoCs
Processes:
PING.EXEPING.EXEPING.EXEPING.EXEpid process 4012 PING.EXE 2264 PING.EXE 3424 PING.EXE 1000 PING.EXE -
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exeRFQ.pif.exeRFQ.pif.exepid process 2272 powershell.exe 2272 powershell.exe 2272 powershell.exe 2192 powershell.exe 2192 powershell.exe 2192 powershell.exe 3404 powershell.exe 3404 powershell.exe 3404 powershell.exe 2904 powershell.exe 2904 powershell.exe 2904 powershell.exe 740 RFQ.pif.exe 740 RFQ.pif.exe 740 RFQ.pif.exe 740 RFQ.pif.exe 740 RFQ.pif.exe 740 RFQ.pif.exe 2872 RFQ.pif.exe 2872 RFQ.pif.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exeRFQ.pif.exeRFQ.pif.exedescription pid process Token: SeDebugPrivilege 2272 powershell.exe Token: SeDebugPrivilege 2192 powershell.exe Token: SeDebugPrivilege 3404 powershell.exe Token: SeDebugPrivilege 2904 powershell.exe Token: SeDebugPrivilege 740 RFQ.pif.exe Token: SeDebugPrivilege 2872 RFQ.pif.exe -
Suspicious use of WriteProcessMemory 35 IoCs
Processes:
RFQ.pif.exepowershell.exepowershell.exepowershell.exepowershell.exedescription pid process target process PID 740 wrote to memory of 2272 740 RFQ.pif.exe powershell.exe PID 740 wrote to memory of 2272 740 RFQ.pif.exe powershell.exe PID 740 wrote to memory of 2272 740 RFQ.pif.exe powershell.exe PID 2272 wrote to memory of 1000 2272 powershell.exe PING.EXE PID 2272 wrote to memory of 1000 2272 powershell.exe PING.EXE PID 2272 wrote to memory of 1000 2272 powershell.exe PING.EXE PID 740 wrote to memory of 2192 740 RFQ.pif.exe powershell.exe PID 740 wrote to memory of 2192 740 RFQ.pif.exe powershell.exe PID 740 wrote to memory of 2192 740 RFQ.pif.exe powershell.exe PID 2192 wrote to memory of 4012 2192 powershell.exe PING.EXE PID 2192 wrote to memory of 4012 2192 powershell.exe PING.EXE PID 2192 wrote to memory of 4012 2192 powershell.exe PING.EXE PID 740 wrote to memory of 3404 740 RFQ.pif.exe powershell.exe PID 740 wrote to memory of 3404 740 RFQ.pif.exe powershell.exe PID 740 wrote to memory of 3404 740 RFQ.pif.exe powershell.exe PID 3404 wrote to memory of 2264 3404 powershell.exe PING.EXE PID 3404 wrote to memory of 2264 3404 powershell.exe PING.EXE PID 3404 wrote to memory of 2264 3404 powershell.exe PING.EXE PID 740 wrote to memory of 2904 740 RFQ.pif.exe powershell.exe PID 740 wrote to memory of 2904 740 RFQ.pif.exe powershell.exe PID 740 wrote to memory of 2904 740 RFQ.pif.exe powershell.exe PID 2904 wrote to memory of 3424 2904 powershell.exe PING.EXE PID 2904 wrote to memory of 3424 2904 powershell.exe PING.EXE PID 2904 wrote to memory of 3424 2904 powershell.exe PING.EXE PID 740 wrote to memory of 3772 740 RFQ.pif.exe RFQ.pif.exe PID 740 wrote to memory of 3772 740 RFQ.pif.exe RFQ.pif.exe PID 740 wrote to memory of 3772 740 RFQ.pif.exe RFQ.pif.exe PID 740 wrote to memory of 2872 740 RFQ.pif.exe RFQ.pif.exe PID 740 wrote to memory of 2872 740 RFQ.pif.exe RFQ.pif.exe PID 740 wrote to memory of 2872 740 RFQ.pif.exe RFQ.pif.exe PID 740 wrote to memory of 2872 740 RFQ.pif.exe RFQ.pif.exe PID 740 wrote to memory of 2872 740 RFQ.pif.exe RFQ.pif.exe PID 740 wrote to memory of 2872 740 RFQ.pif.exe RFQ.pif.exe PID 740 wrote to memory of 2872 740 RFQ.pif.exe RFQ.pif.exe PID 740 wrote to memory of 2872 740 RFQ.pif.exe RFQ.pif.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\RFQ.pif.exe"C:\Users\Admin\AppData\Local\Temp\RFQ.pif.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ping gooogle.com2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXE"C:\Windows\system32\PING.EXE" gooogle.com3⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ping gooogle.com2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXE"C:\Windows\system32\PING.EXE" gooogle.com3⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ping gooogle.com2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXE"C:\Windows\system32\PING.EXE" gooogle.com3⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ping gooogle.com2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXE"C:\Windows\system32\PING.EXE" gooogle.com3⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Local\Temp\RFQ.pif.exeC:\Users\Admin\AppData\Local\Temp\RFQ.pif.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\RFQ.pif.exeC:\Users\Admin\AppData\Local\Temp\RFQ.pif.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RFQ.pif.exe.logMD5
9e7845217df4a635ec4341c3d52ed685
SHA1d65cb39d37392975b038ce503a585adadb805da5
SHA256d60e596ed3d5c13dc9f1660e6d870d99487e1383891437645c4562a9ecaa8c9b
SHA512307c3b4d4f2655bdeb177e7b9c981ca27513618903f02c120caa755c9da5a8dd03ebab660b56108a680720a97c1e9596692490aede18cc4bd77b9fc3d8e68aa1
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logMD5
0f5cbdca905beb13bebdcf43fb0716bd
SHA19e136131389fde83297267faf6c651d420671b3f
SHA256a99135d86804f5cf8aaeb5943c1929bd1458652a3318ab8c01aee22bb4991060
SHA512a41d2939473cffcb6beb8b58b499441d16da8bcc22972d53b8b699b82a7dc7be0db39bcd2486edd136294eb3f1c97ddd27b2a9ff45b831579cba6896d1f776b0
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveMD5
d4c56dec4203e73949bc8da709350789
SHA1d8ea857fc5242ab7f2d27e38a021941d1f062fa4
SHA256a467fd9652758c4930987ef99be0567bdec81c09494499e91e7519d924e5e674
SHA512cc5ad974db3d721dc6839812a86955bd2f968ab53db6a01b0515e31ed9d345a3e5c28773acdfa6aa139168272cdcdc63e7b0026810668e1dd7168c5016a6f05a
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveMD5
d4c56dec4203e73949bc8da709350789
SHA1d8ea857fc5242ab7f2d27e38a021941d1f062fa4
SHA256a467fd9652758c4930987ef99be0567bdec81c09494499e91e7519d924e5e674
SHA512cc5ad974db3d721dc6839812a86955bd2f968ab53db6a01b0515e31ed9d345a3e5c28773acdfa6aa139168272cdcdc63e7b0026810668e1dd7168c5016a6f05a
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveMD5
2c681808806acf1e1273942a877ffa77
SHA1b7d684fc241dcf3091830ed87927247c42bcac58
SHA256ed5021ba5ad031fb63844b83beb0b7b52e9c7072e0ac91d15b8c8b372c6648de
SHA5128256778799b1eeec86c79f06ca5e6337a6fb5dbdf511b1f5c0eab5ed94d85e0e0de0e2a7ffc052411f6706bae3363bb0b70b231aacc867b2bb037d94715eba17
-
memory/740-120-0x0000000005160000-0x00000000051F2000-memory.dmpFilesize
584KB
-
memory/740-116-0x00000000057B0000-0x00000000057B1000-memory.dmpFilesize
4KB
-
memory/740-199-0x0000000009250000-0x00000000092B2000-memory.dmpFilesize
392KB
-
memory/740-194-0x0000000006D20000-0x0000000006D70000-memory.dmpFilesize
320KB
-
memory/740-119-0x00000000051E0000-0x00000000051E1000-memory.dmpFilesize
4KB
-
memory/740-114-0x00000000008E0000-0x00000000008E1000-memory.dmpFilesize
4KB
-
memory/740-117-0x0000000005200000-0x0000000005201000-memory.dmpFilesize
4KB
-
memory/740-118-0x0000000005160000-0x00000000051F2000-memory.dmpFilesize
584KB
-
memory/1000-135-0x0000000000000000-mapping.dmp
-
memory/2192-168-0x0000000004E34000-0x0000000004E36000-memory.dmpFilesize
8KB
-
memory/2192-167-0x0000000004E33000-0x0000000004E34000-memory.dmpFilesize
4KB
-
memory/2192-143-0x0000000004E30000-0x0000000004E31000-memory.dmpFilesize
4KB
-
memory/2192-145-0x0000000004E32000-0x0000000004E33000-memory.dmpFilesize
4KB
-
memory/2192-136-0x0000000000000000-mapping.dmp
-
memory/2264-174-0x0000000000000000-mapping.dmp
-
memory/2272-152-0x00000000041A4000-0x00000000041A6000-memory.dmpFilesize
8KB
-
memory/2272-126-0x00000000041A0000-0x00000000041A1000-memory.dmpFilesize
4KB
-
memory/2272-151-0x00000000041A3000-0x00000000041A4000-memory.dmpFilesize
4KB
-
memory/2272-133-0x00000000079B0000-0x00000000079B1000-memory.dmpFilesize
4KB
-
memory/2272-121-0x0000000000000000-mapping.dmp
-
memory/2272-132-0x0000000007360000-0x0000000007361000-memory.dmpFilesize
4KB
-
memory/2272-131-0x0000000007590000-0x0000000007591000-memory.dmpFilesize
4KB
-
memory/2272-124-0x0000000004140000-0x0000000004141000-memory.dmpFilesize
4KB
-
memory/2272-130-0x0000000007420000-0x0000000007421000-memory.dmpFilesize
4KB
-
memory/2272-129-0x00000000072D0000-0x00000000072D1000-memory.dmpFilesize
4KB
-
memory/2272-125-0x0000000006C30000-0x0000000006C31000-memory.dmpFilesize
4KB
-
memory/2272-134-0x0000000007C90000-0x0000000007C91000-memory.dmpFilesize
4KB
-
memory/2272-128-0x0000000006BB0000-0x0000000006BB1000-memory.dmpFilesize
4KB
-
memory/2272-127-0x00000000041A2000-0x00000000041A3000-memory.dmpFilesize
4KB
-
memory/2872-211-0x00000000053D0000-0x00000000053D1000-memory.dmpFilesize
4KB
-
memory/2872-210-0x00000000051B0000-0x00000000056AE000-memory.dmpFilesize
5.0MB
-
memory/2872-209-0x00000000053F0000-0x00000000053F1000-memory.dmpFilesize
4KB
-
memory/2872-204-0x00000000004375DE-mapping.dmp
-
memory/2872-203-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/2904-201-0x0000000004513000-0x0000000004514000-memory.dmpFilesize
4KB
-
memory/2904-189-0x0000000004510000-0x0000000004511000-memory.dmpFilesize
4KB
-
memory/2904-176-0x0000000000000000-mapping.dmp
-
memory/2904-191-0x0000000004512000-0x0000000004513000-memory.dmpFilesize
4KB
-
memory/2904-202-0x0000000004514000-0x0000000004516000-memory.dmpFilesize
8KB
-
memory/3404-188-0x0000000006FC4000-0x0000000006FC6000-memory.dmpFilesize
8KB
-
memory/3404-157-0x0000000000000000-mapping.dmp
-
memory/3404-169-0x0000000006FC0000-0x0000000006FC1000-memory.dmpFilesize
4KB
-
memory/3404-187-0x0000000006FC3000-0x0000000006FC4000-memory.dmpFilesize
4KB
-
memory/3404-170-0x0000000006FC2000-0x0000000006FC3000-memory.dmpFilesize
4KB
-
memory/3424-193-0x0000000000000000-mapping.dmp
-
memory/4012-153-0x0000000000000000-mapping.dmp