Analysis
-
max time kernel
66s -
max time network
12s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
27-07-2021 00:33
Static task
static1
Behavioral task
behavioral1
Sample
RFQ - ORDER NO. 234725.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
RFQ - ORDER NO. 234725.exe
Resource
win10v20210408
General
-
Target
RFQ - ORDER NO. 234725.exe
-
Size
1.3MB
-
MD5
1e143455236b793aee7c590baff03438
-
SHA1
f94d9c2e4334ece08ef7cd3c6f02063298ed8e2a
-
SHA256
697c7f2e94dd5066e52923c79ada6af9fc38f100a2f6d1a4aff2d0769a9c5592
-
SHA512
7470a358759c31b1bf959e71182eca9efff5e381202a4b43db49781420b24e237565406c5521621c2ebfc7e95990fc33d0149dbcbbbaff66158a0e3c42a7dd96
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.126cn.us - Port:
587 - Username:
13910612303@126cn.us - Password:
l*bq*LI7
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/824-65-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla behavioral1/memory/824-66-0x000000000043748E-mapping.dmp family_agenttesla -
Suspicious use of SetThreadContext 1 IoCs
Processes:
RFQ - ORDER NO. 234725.exedescription pid process target process PID 1420 set thread context of 824 1420 RFQ - ORDER NO. 234725.exe RFQ - ORDER NO. 234725.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
RFQ - ORDER NO. 234725.exepid process 824 RFQ - ORDER NO. 234725.exe 824 RFQ - ORDER NO. 234725.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RFQ - ORDER NO. 234725.exedescription pid process Token: SeDebugPrivilege 824 RFQ - ORDER NO. 234725.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
RFQ - ORDER NO. 234725.exeRFQ - ORDER NO. 234725.exedescription pid process target process PID 1420 wrote to memory of 1684 1420 RFQ - ORDER NO. 234725.exe schtasks.exe PID 1420 wrote to memory of 1684 1420 RFQ - ORDER NO. 234725.exe schtasks.exe PID 1420 wrote to memory of 1684 1420 RFQ - ORDER NO. 234725.exe schtasks.exe PID 1420 wrote to memory of 1684 1420 RFQ - ORDER NO. 234725.exe schtasks.exe PID 1420 wrote to memory of 824 1420 RFQ - ORDER NO. 234725.exe RFQ - ORDER NO. 234725.exe PID 1420 wrote to memory of 824 1420 RFQ - ORDER NO. 234725.exe RFQ - ORDER NO. 234725.exe PID 1420 wrote to memory of 824 1420 RFQ - ORDER NO. 234725.exe RFQ - ORDER NO. 234725.exe PID 1420 wrote to memory of 824 1420 RFQ - ORDER NO. 234725.exe RFQ - ORDER NO. 234725.exe PID 1420 wrote to memory of 824 1420 RFQ - ORDER NO. 234725.exe RFQ - ORDER NO. 234725.exe PID 1420 wrote to memory of 824 1420 RFQ - ORDER NO. 234725.exe RFQ - ORDER NO. 234725.exe PID 1420 wrote to memory of 824 1420 RFQ - ORDER NO. 234725.exe RFQ - ORDER NO. 234725.exe PID 1420 wrote to memory of 824 1420 RFQ - ORDER NO. 234725.exe RFQ - ORDER NO. 234725.exe PID 1420 wrote to memory of 824 1420 RFQ - ORDER NO. 234725.exe RFQ - ORDER NO. 234725.exe PID 824 wrote to memory of 984 824 RFQ - ORDER NO. 234725.exe dw20.exe PID 824 wrote to memory of 984 824 RFQ - ORDER NO. 234725.exe dw20.exe PID 824 wrote to memory of 984 824 RFQ - ORDER NO. 234725.exe dw20.exe PID 824 wrote to memory of 984 824 RFQ - ORDER NO. 234725.exe dw20.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\RFQ - ORDER NO. 234725.exe"C:\Users\Admin\AppData\Local\Temp\RFQ - ORDER NO. 234725.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\hlsIHRyBJ" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE1D7.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\RFQ - ORDER NO. 234725.exe"C:\Users\Admin\AppData\Local\Temp\RFQ - ORDER NO. 234725.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 5203⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpE1D7.tmpMD5
b89bc95a5823f157c27d33d82d7b56dd
SHA12b7d9bfea27a9dff13ba7f8e89f10c38b4ad8efd
SHA2567bf85bbaafd360bd91c36fdf2440865b7f6f203ea21c30b5d800f010f3388f4a
SHA512f6eb638853ad2583db46dedf826359b86bc75fa3281f666c019e03fcdc2655236c90d88eac603d6c88c4c3d3f6c9731e94e64e54dcbfb100899fa8e187714773
-
memory/824-65-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/824-66-0x000000000043748E-mapping.dmp
-
memory/824-68-0x0000000000D30000-0x0000000000D31000-memory.dmpFilesize
4KB
-
memory/984-69-0x0000000000000000-mapping.dmp
-
memory/984-71-0x0000000002500000-0x0000000002501000-memory.dmpFilesize
4KB
-
memory/1420-60-0x0000000074FB1000-0x0000000074FB3000-memory.dmpFilesize
8KB
-
memory/1420-61-0x00000000004C0000-0x00000000004C1000-memory.dmpFilesize
4KB
-
memory/1420-62-0x00000000004C1000-0x00000000004C2000-memory.dmpFilesize
4KB
-
memory/1684-63-0x0000000000000000-mapping.dmp