agenttesla | 0a70aedbd217674d071bee01ea538085dfac406626a1c686e7c2e3fdf8fbe06f

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
11-12-2023 07:30

Target

RFQ PCF01284 Revised_PDF.exe
Size

614KB
MD5

aea1bfb57a639d6c1019ebc722662d86
SHA1

66674c41a064140ffd143fc88d6737e4e2a712ba
SHA256

083488944d0efc342bbb4bdb7881822e14781b3888ea58d1f7121dea52933373
SHA512

632328e08705b382797231950a3bcb9ac840d7f940d66239fc924e0c4806157d0f0333fb329d7ab9803b64f4ed561178280584a669dae19a53484e9c4ef95c6c
SSDEEP

12288:03IU8S6eUdzt3K43AkWh5wYAjhjrk2XHpFNlcVlV1bFKxs8mgTY/qFpcEIJKJ:SItSAdzt3KEvYNAjhjrxXJzlIwxhmSp

Score

10^/10

Family

agenttesla

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Detect ZGRat V1 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2732-3-0x00000000002C0000-0x00000000002D8000-memory.dmp	family_zgrat_v1

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
Suspicious use of SetThreadContext 1 IoCs

Processes:

RFQ PCF01284 Revised_PDF.exe

description pid process target process

PID 2732 set thread context of 2548 2732 RFQ PCF01284 Revised_PDF.exe RFQ PCF01284 Revised_PDF.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

RFQ PCF01284 Revised_PDF.exe

pid process

2732 RFQ PCF01284 Revised_PDF.exe
2732 RFQ PCF01284 Revised_PDF.exe
2732 RFQ PCF01284 Revised_PDF.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RFQ PCF01284 Revised_PDF.exe

description pid process

Token: SeDebugPrivilege 2732 RFQ PCF01284 Revised_PDF.exe

description	pid	process	target process
PID 2732 set thread context of 2548	2732	RFQ PCF01284 Revised_PDF.exe	RFQ PCF01284 Revised_PDF.exe

description	pid	process
Token: SeDebugPrivilege	2732	RFQ PCF01284 Revised_PDF.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

RFQ PCF01284 Revised_PDF.exe

description	pid	process	target process
PID 2732 wrote to memory of 2488	2732	RFQ PCF01284 Revised_PDF.exe	RFQ PCF01284 Revised_PDF.exe
PID 2732 wrote to memory of 2488	2732	RFQ PCF01284 Revised_PDF.exe	RFQ PCF01284 Revised_PDF.exe
PID 2732 wrote to memory of 2488	2732	RFQ PCF01284 Revised_PDF.exe	RFQ PCF01284 Revised_PDF.exe
PID 2732 wrote to memory of 2488	2732	RFQ PCF01284 Revised_PDF.exe	RFQ PCF01284 Revised_PDF.exe
PID 2732 wrote to memory of 2548	2732	RFQ PCF01284 Revised_PDF.exe	RFQ PCF01284 Revised_PDF.exe
PID 2732 wrote to memory of 2548	2732	RFQ PCF01284 Revised_PDF.exe	RFQ PCF01284 Revised_PDF.exe
PID 2732 wrote to memory of 2548	2732	RFQ PCF01284 Revised_PDF.exe	RFQ PCF01284 Revised_PDF.exe
PID 2732 wrote to memory of 2548	2732	RFQ PCF01284 Revised_PDF.exe	RFQ PCF01284 Revised_PDF.exe
PID 2732 wrote to memory of 2548	2732	RFQ PCF01284 Revised_PDF.exe	RFQ PCF01284 Revised_PDF.exe
PID 2732 wrote to memory of 2548	2732	RFQ PCF01284 Revised_PDF.exe	RFQ PCF01284 Revised_PDF.exe
PID 2732 wrote to memory of 2548	2732	RFQ PCF01284 Revised_PDF.exe	RFQ PCF01284 Revised_PDF.exe
PID 2732 wrote to memory of 2548	2732	RFQ PCF01284 Revised_PDF.exe	RFQ PCF01284 Revised_PDF.exe
PID 2732 wrote to memory of 2548	2732	RFQ PCF01284 Revised_PDF.exe	RFQ PCF01284 Revised_PDF.exe

C:\Users\Admin\AppData\Local\Temp\RFQ PCF01284 Revised_PDF.exe
"C:\Users\Admin\AppData\Local\Temp\RFQ PCF01284 Revised_PDF.exe"
2⤵
PID:2488

C:\Users\Admin\AppData\Local\Temp\RFQ PCF01284 Revised_PDF.exe
"C:\Users\Admin\AppData\Local\Temp\RFQ PCF01284 Revised_PDF.exe"
2⤵
PID:2548

memory/2548-7-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2548-15-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2548-13-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2548-8-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2548-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2548-9-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2548-10-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2732-3-0x00000000002C0000-0x00000000002D8000-memory.dmp

Filesize
96KB

Download
memory/2732-6-0x0000000004DE0000-0x0000000004E5A000-memory.dmp

Filesize
488KB

Download
memory/2732-5-0x0000000000270000-0x000000000027A000-memory.dmp

Filesize
40KB

Download
memory/2732-4-0x0000000000250000-0x0000000000258000-memory.dmp

Filesize
32KB

Download
memory/2732-0-0x0000000000880000-0x0000000000920000-memory.dmp

Filesize
640KB

Download
memory/2732-2-0x0000000004E90000-0x0000000004ED0000-memory.dmp

Filesize
256KB

Download
memory/2732-1-0x0000000074C10000-0x00000000752FE000-memory.dmp

Filesize
6.9MB

Download
memory/2732-17-0x0000000074C10000-0x00000000752FE000-memory.dmp

Filesize
6.9MB

Download