agenttesla | 805c1ba1a839e79293bd7e044ec0845b5e90cddf65d458649854c4954a976225

General

Target

RFQ.exe
Size

409KB
MD5

d29fd374ffb5bd95937ed1084caefa8c
SHA1

4320812a3197c17ad10d6c36608c740e9b89f2bd
SHA256

f6c8c308519b9019ae0cce0d21759aea395e35f746b0a3853218ab321e8c8349
SHA512

d5fb85fe82e71272a98b1ef88eac93480f4716e51fa173e3c3c8f858c1616edd53878b5582e80d67ef111cce3f50e25d39489c783c52370f38d169f345fd35b2

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.yandex.ru
Port:
587
Username:
[email protected]
Password:
@jaffinmarknma@344

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/960-62-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla
behavioral1/memory/960-61-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla
behavioral1/memory/960-63-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla
behavioral1/memory/960-64-0x00000000004460AE-mapping.dmp	family_agenttesla
behavioral1/memory/960-66-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla
behavioral1/memory/960-68-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

Processes:

RFQ.exe

description pid process target process

PID 1792 set thread context of 960 1792 RFQ.exe RFQ.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1992 schtasks.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

RFQ.exeRFQ.exe

pid process

1792 RFQ.exe
960 RFQ.exe
960 RFQ.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

RFQ.exeRFQ.exe

description pid process

Token: SeDebugPrivilege 1792 RFQ.exe
Token: SeDebugPrivilege 960 RFQ.exe

description	pid	process	target process
PID 1792 set thread context of 960	1792	RFQ.exe	RFQ.exe

pid	process
1992	schtasks.exe

pid	process
1792	RFQ.exe
960	RFQ.exe
960	RFQ.exe

description	pid	process
Token: SeDebugPrivilege	1792	RFQ.exe
Token: SeDebugPrivilege	960	RFQ.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

RFQ.exe

description	pid	process	target process
PID 1792 wrote to memory of 1992	1792	RFQ.exe	schtasks.exe
PID 1792 wrote to memory of 1992	1792	RFQ.exe	schtasks.exe
PID 1792 wrote to memory of 1992	1792	RFQ.exe	schtasks.exe
PID 1792 wrote to memory of 1992	1792	RFQ.exe	schtasks.exe
PID 1792 wrote to memory of 964	1792	RFQ.exe	RFQ.exe
PID 1792 wrote to memory of 964	1792	RFQ.exe	RFQ.exe
PID 1792 wrote to memory of 964	1792	RFQ.exe	RFQ.exe
PID 1792 wrote to memory of 964	1792	RFQ.exe	RFQ.exe
PID 1792 wrote to memory of 960	1792	RFQ.exe	RFQ.exe
PID 1792 wrote to memory of 960	1792	RFQ.exe	RFQ.exe
PID 1792 wrote to memory of 960	1792	RFQ.exe	RFQ.exe
PID 1792 wrote to memory of 960	1792	RFQ.exe	RFQ.exe
PID 1792 wrote to memory of 960	1792	RFQ.exe	RFQ.exe
PID 1792 wrote to memory of 960	1792	RFQ.exe	RFQ.exe
PID 1792 wrote to memory of 960	1792	RFQ.exe	RFQ.exe
PID 1792 wrote to memory of 960	1792	RFQ.exe	RFQ.exe
PID 1792 wrote to memory of 960	1792	RFQ.exe	RFQ.exe

C:\Users\Admin\AppData\Local\Temp\RFQ.exe
"C:\Users\Admin\AppData\Local\Temp\RFQ.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1792

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\raVCZiroBTNk" /XML "C:\Users\Admin\AppData\Local\Temp\tmp7485.tmp"
2⤵
- Creates scheduled task(s)
PID:1992

C:\Users\Admin\AppData\Local\Temp\RFQ.exe
"{path}"
2⤵
PID:964

C:\Users\Admin\AppData\Local\Temp\RFQ.exe
"{path}"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:960

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp7485.tmp

Filesize
1KB

MD5
6b577f084a5deed4b12d4e3ea922f3a5

SHA1
0e0f253a24dae641820a75c026b48943cccdc34c

SHA256
a4ce747420100d01168931ad4ea27d96ff41f97c95c0621187bbb46cd2007322

SHA512
61d7eb7deb3551240083cd9395f742e51733533d3a12b82f30d0d6c0509f8d0d198547255fe614c0fd798236063c6cde6d4cf5383c5e6d686de27e82230b8e6c

Download Submit
memory/960-62-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/960-58-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/960-59-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/960-61-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/960-63-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/960-64-0x00000000004460AE-mapping.dmp

Download
memory/960-66-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/960-68-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/960-70-0x0000000074EA0000-0x000000007544B000-memory.dmp

Filesize
5.7MB

Download
memory/1792-55-0x0000000074F10000-0x00000000754BB000-memory.dmp

Filesize
5.7MB

Download
memory/1792-54-0x0000000075C51000-0x0000000075C53000-memory.dmp

Filesize
8KB

Download
memory/1992-56-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads