Analysis

  • max time kernel
    129s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-en-20210920
  • submitted
    21-10-2021 04:17

General

  • Target

    RFQ.exe

  • Size

    585KB

  • MD5

    e3fc0a2977f6ace1e8dcc4d170613b6e

  • SHA1

    0fd7d3e125ae5971855a1ba0e204ec5ae0f4829d

  • SHA256

    24e27b79291475c64e5f2a71833ac988a888e66c86d32ad5d5b20be3b7717604

  • SHA512

    1b19a53b46d5a7c2d2ac7c5c3595f775f78da42e5f8ca3babf1e71406c5d990447238aea61be66c28eff0bc620fc7a5858181e4e97b2f38e694cb7b27708bef2

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    smtp.conreivestments.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    ~zi@3dw1_IqN

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • AgentTesla Payload 4 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\RFQ.exe
    "C:\Users\Admin\AppData\Local\Temp\RFQ.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1192
    • C:\Users\Admin\AppData\Local\Temp\RFQ.exe
      "{path}"
      2⤵
        PID:596
      • C:\Users\Admin\AppData\Local\Temp\RFQ.exe
        "{path}"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:680
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
          dw20.exe -x -s 396
          3⤵
          • Suspicious behavior: GetForegroundWindowSpam
          PID:1464

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/680-55-0x0000000000400000-0x000000000043C000-memory.dmp
      Filesize

      240KB

    • memory/680-57-0x0000000000400000-0x000000000043C000-memory.dmp
      Filesize

      240KB

    • memory/680-58-0x0000000000400000-0x000000000043C000-memory.dmp
      Filesize

      240KB

    • memory/680-56-0x0000000000400000-0x000000000043C000-memory.dmp
      Filesize

      240KB

    • memory/680-59-0x0000000000400000-0x000000000043C000-memory.dmp
      Filesize

      240KB

    • memory/680-60-0x00000000004375AE-mapping.dmp
    • memory/680-64-0x0000000000810000-0x0000000000811000-memory.dmp
      Filesize

      4KB

    • memory/1192-53-0x0000000075871000-0x0000000075873000-memory.dmp
      Filesize

      8KB

    • memory/1192-54-0x0000000000780000-0x0000000000781000-memory.dmp
      Filesize

      4KB

    • memory/1192-63-0x0000000000781000-0x0000000000782000-memory.dmp
      Filesize

      4KB

    • memory/1464-62-0x0000000000000000-mapping.dmp
    • memory/1464-66-0x0000000002800000-0x0000000002801000-memory.dmp
      Filesize

      4KB