Analysis
-
max time kernel
135s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
20-05-2022 23:18
Static task
static1
Behavioral task
behavioral1
Sample
RFQ86437C.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
RFQ86437C.exe
Resource
win10v2004-20220414-en
General
-
Target
RFQ86437C.exe
-
Size
806KB
-
MD5
bb177815728b49fd39053b643826b5cf
-
SHA1
ca54b0b08a6f994e4594573ca4729cce88be33c9
-
SHA256
5fac93ed0fd840cedfc559b7f2285ad384004e78fd53178b09bef6b13db08b84
-
SHA512
ee2f8da0d4d9e00085ca368c38be1d9fa024fa541b094d26d44077202ffb8f6c9475fad02a5f8c293b93dc6b1838325017bf611e40da25ec44e4f47f546f5d82
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.yandex.com - Port:
587 - Username:
[email protected] - Password:
benneth1975@@@@@
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 12 IoCs
Processes:
resource yara_rule behavioral1/memory/2024-54-0x00000000009C0000-0x0000000000A8C000-memory.dmp family_agenttesla \Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\intel.exe family_agenttesla C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\intel.exe family_agenttesla C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\intel.exe family_agenttesla behavioral1/memory/1768-64-0x00000000009E0000-0x0000000000AAC000-memory.dmp family_agenttesla behavioral1/memory/364-69-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla behavioral1/memory/364-70-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla behavioral1/memory/364-71-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla behavioral1/memory/364-72-0x0000000000446C5E-mapping.dmp family_agenttesla C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\intel.exe family_agenttesla behavioral1/memory/364-75-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla behavioral1/memory/364-77-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla -
Executes dropped EXE 2 IoCs
Processes:
intel.exeintel.exepid process 1768 intel.exe 364 intel.exe -
Loads dropped DLL 1 IoCs
Processes:
RFQ86437C.exepid process 2024 RFQ86437C.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Run\intel = "C:\\Windows\\system32\\pcalua.exe -a C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\intel.exe" reg.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
intel.exedescription pid process target process PID 1768 set thread context of 364 1768 intel.exe intel.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
RFQ86437C.exeintel.exeintel.exepid process 2024 RFQ86437C.exe 2024 RFQ86437C.exe 1768 intel.exe 1768 intel.exe 1768 intel.exe 364 intel.exe 364 intel.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
RFQ86437C.exeintel.exeintel.exedescription pid process Token: SeDebugPrivilege 2024 RFQ86437C.exe Token: SeDebugPrivilege 1768 intel.exe Token: SeDebugPrivilege 364 intel.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
RFQ86437C.execmd.exeintel.exedescription pid process target process PID 2024 wrote to memory of 1116 2024 RFQ86437C.exe cmd.exe PID 2024 wrote to memory of 1116 2024 RFQ86437C.exe cmd.exe PID 2024 wrote to memory of 1116 2024 RFQ86437C.exe cmd.exe PID 2024 wrote to memory of 1116 2024 RFQ86437C.exe cmd.exe PID 1116 wrote to memory of 948 1116 cmd.exe reg.exe PID 1116 wrote to memory of 948 1116 cmd.exe reg.exe PID 1116 wrote to memory of 948 1116 cmd.exe reg.exe PID 1116 wrote to memory of 948 1116 cmd.exe reg.exe PID 2024 wrote to memory of 1768 2024 RFQ86437C.exe intel.exe PID 2024 wrote to memory of 1768 2024 RFQ86437C.exe intel.exe PID 2024 wrote to memory of 1768 2024 RFQ86437C.exe intel.exe PID 2024 wrote to memory of 1768 2024 RFQ86437C.exe intel.exe PID 1768 wrote to memory of 364 1768 intel.exe intel.exe PID 1768 wrote to memory of 364 1768 intel.exe intel.exe PID 1768 wrote to memory of 364 1768 intel.exe intel.exe PID 1768 wrote to memory of 364 1768 intel.exe intel.exe PID 1768 wrote to memory of 364 1768 intel.exe intel.exe PID 1768 wrote to memory of 364 1768 intel.exe intel.exe PID 1768 wrote to memory of 364 1768 intel.exe intel.exe PID 1768 wrote to memory of 364 1768 intel.exe intel.exe PID 1768 wrote to memory of 364 1768 intel.exe intel.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\RFQ86437C.exe"C:\Users\Admin\AppData\Local\Temp\RFQ86437C.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v intel /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\intel.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v intel /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\intel.exe"3⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\intel.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\intel.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\intel.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\intel.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\intel.exeFilesize
806KB
MD5bb177815728b49fd39053b643826b5cf
SHA1ca54b0b08a6f994e4594573ca4729cce88be33c9
SHA2565fac93ed0fd840cedfc559b7f2285ad384004e78fd53178b09bef6b13db08b84
SHA512ee2f8da0d4d9e00085ca368c38be1d9fa024fa541b094d26d44077202ffb8f6c9475fad02a5f8c293b93dc6b1838325017bf611e40da25ec44e4f47f546f5d82
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\intel.exeFilesize
806KB
MD5bb177815728b49fd39053b643826b5cf
SHA1ca54b0b08a6f994e4594573ca4729cce88be33c9
SHA2565fac93ed0fd840cedfc559b7f2285ad384004e78fd53178b09bef6b13db08b84
SHA512ee2f8da0d4d9e00085ca368c38be1d9fa024fa541b094d26d44077202ffb8f6c9475fad02a5f8c293b93dc6b1838325017bf611e40da25ec44e4f47f546f5d82
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\intel.exeFilesize
806KB
MD5bb177815728b49fd39053b643826b5cf
SHA1ca54b0b08a6f994e4594573ca4729cce88be33c9
SHA2565fac93ed0fd840cedfc559b7f2285ad384004e78fd53178b09bef6b13db08b84
SHA512ee2f8da0d4d9e00085ca368c38be1d9fa024fa541b094d26d44077202ffb8f6c9475fad02a5f8c293b93dc6b1838325017bf611e40da25ec44e4f47f546f5d82
-
\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\intel.exeFilesize
806KB
MD5bb177815728b49fd39053b643826b5cf
SHA1ca54b0b08a6f994e4594573ca4729cce88be33c9
SHA2565fac93ed0fd840cedfc559b7f2285ad384004e78fd53178b09bef6b13db08b84
SHA512ee2f8da0d4d9e00085ca368c38be1d9fa024fa541b094d26d44077202ffb8f6c9475fad02a5f8c293b93dc6b1838325017bf611e40da25ec44e4f47f546f5d82
-
memory/364-67-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/364-77-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/364-75-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/364-72-0x0000000000446C5E-mapping.dmp
-
memory/364-71-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/364-70-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/364-69-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/364-66-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/948-59-0x0000000000000000-mapping.dmp
-
memory/1116-58-0x0000000000000000-mapping.dmp
-
memory/1768-64-0x00000000009E0000-0x0000000000AAC000-memory.dmpFilesize
816KB
-
memory/1768-61-0x0000000000000000-mapping.dmp
-
memory/2024-54-0x00000000009C0000-0x0000000000A8C000-memory.dmpFilesize
816KB
-
memory/2024-57-0x0000000000510000-0x000000000051A000-memory.dmpFilesize
40KB
-
memory/2024-56-0x00000000003D0000-0x00000000003EC000-memory.dmpFilesize
112KB
-
memory/2024-55-0x0000000076011000-0x0000000076013000-memory.dmpFilesize
8KB