Analysis
-
max time kernel
144s -
max time network
167s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
20-05-2022 22:58
Static task
static1
Behavioral task
behavioral1
Sample
RFQ.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
RFQ.exe
Resource
win10v2004-20220414-en
General
-
Target
RFQ.exe
-
Size
409KB
-
MD5
d29fd374ffb5bd95937ed1084caefa8c
-
SHA1
4320812a3197c17ad10d6c36608c740e9b89f2bd
-
SHA256
f6c8c308519b9019ae0cce0d21759aea395e35f746b0a3853218ab321e8c8349
-
SHA512
d5fb85fe82e71272a98b1ef88eac93480f4716e51fa173e3c3c8f858c1616edd53878b5582e80d67ef111cce3f50e25d39489c783c52370f38d169f345fd35b2
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.yandex.ru - Port:
587 - Username:
[email protected] - Password:
@jaffinmarknma@344
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/3940-134-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
RFQ.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation RFQ.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
RFQ.exedescription pid process target process PID 2980 set thread context of 3940 2980 RFQ.exe RFQ.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
RFQ.exepid process 3940 RFQ.exe 3940 RFQ.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RFQ.exedescription pid process Token: SeDebugPrivilege 3940 RFQ.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
RFQ.exedescription pid process target process PID 2980 wrote to memory of 4340 2980 RFQ.exe schtasks.exe PID 2980 wrote to memory of 4340 2980 RFQ.exe schtasks.exe PID 2980 wrote to memory of 4340 2980 RFQ.exe schtasks.exe PID 2980 wrote to memory of 3940 2980 RFQ.exe RFQ.exe PID 2980 wrote to memory of 3940 2980 RFQ.exe RFQ.exe PID 2980 wrote to memory of 3940 2980 RFQ.exe RFQ.exe PID 2980 wrote to memory of 3940 2980 RFQ.exe RFQ.exe PID 2980 wrote to memory of 3940 2980 RFQ.exe RFQ.exe PID 2980 wrote to memory of 3940 2980 RFQ.exe RFQ.exe PID 2980 wrote to memory of 3940 2980 RFQ.exe RFQ.exe PID 2980 wrote to memory of 3940 2980 RFQ.exe RFQ.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\RFQ.exe"C:\Users\Admin\AppData\Local\Temp\RFQ.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\raVCZiroBTNk" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2AB5.tmp"2⤵
- Creates scheduled task(s)
PID:4340 -
C:\Users\Admin\AppData\Local\Temp\RFQ.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3940
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
408B
MD58adbb2cb7759fdcbc51cfbf0bfd7c867
SHA1f7549e6ea430e7d64b3afb3fc27c77ed5122f85b
SHA256c67092561e4b1472672374c3439004e2bc0191d9a901cde2b8b69a2d34dc6297
SHA512f465311e884dd82e3152959b6a59ac8d6be0a056a1cfddabbcc6714079a2269cd5c09b2b8fbc87a9ec3323c531383526ae19ef24fed100dec80730fae0d79991
-
Filesize
1KB
MD51777b2cf3141808c6d321eee004e4373
SHA1c08cbb95ee94a8d33b12db06005de7c40368045a
SHA256ab02ce745abd720665c4c09146ea1943d91dd47d03016302d0c053ede05626d8
SHA512bf76c25ee37e854dabc433d92da538425f363479d8723c402c60c498dceabf7f2ac419a5760f1bc3cfba3cc917903f9f0786680e6a23fbaddf0ea35f253fcf5f