Analysis
-
max time kernel
139s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20231127-en -
resource tags
arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system -
submitted
12-12-2023 08:56
Static task
static1
Behavioral task
behavioral1
Sample
PO OAU_DECQTRFA00541·PDF.scr
Resource
win7-20231023-en
General
-
Target
PO OAU_DECQTRFA00541·PDF.scr
-
Size
878KB
-
MD5
89160b80b6c468aa1df713449fecb85a
-
SHA1
8636828e03b268d1ca379e5ec2f0e202934c1d11
-
SHA256
4f552d66d0f774acbf75f57ff0a41db9eaa3dfa338795f385865e4c6696713c9
-
SHA512
51ade18ae3de559a539e957d8c42c65cbe95aba9c3447b9d1c27d315bba9773f46419266b2b5a4b5898d191fa8ecf4c783b4411af26b9afca3382481f2925528
-
SSDEEP
24576:k+1GNss+LA5WGu4Ljs0OyC4dcwFgOy6v2cmzw6murezzzIeIII0IEzlKyskJ66UN:USsjdnseC4nmD6Ocmzw6murezzzIeIIW
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
gator3220.hostgator.com - Port:
587 - Username:
[email protected] - Password:
MCgD#w!TZmaka!@@ - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Detect ZGRat V1 34 IoCs
Processes:
resource yara_rule behavioral2/memory/5108-2-0x0000000005040000-0x00000000050EA000-memory.dmp family_zgrat_v1 behavioral2/memory/5108-4-0x0000000005040000-0x00000000050E3000-memory.dmp family_zgrat_v1 behavioral2/memory/5108-5-0x0000000005040000-0x00000000050E3000-memory.dmp family_zgrat_v1 behavioral2/memory/5108-7-0x0000000005040000-0x00000000050E3000-memory.dmp family_zgrat_v1 behavioral2/memory/5108-9-0x0000000005040000-0x00000000050E3000-memory.dmp family_zgrat_v1 behavioral2/memory/5108-11-0x0000000005040000-0x00000000050E3000-memory.dmp family_zgrat_v1 behavioral2/memory/5108-13-0x0000000005040000-0x00000000050E3000-memory.dmp family_zgrat_v1 behavioral2/memory/5108-15-0x0000000005040000-0x00000000050E3000-memory.dmp family_zgrat_v1 behavioral2/memory/5108-17-0x0000000005040000-0x00000000050E3000-memory.dmp family_zgrat_v1 behavioral2/memory/5108-19-0x0000000005040000-0x00000000050E3000-memory.dmp family_zgrat_v1 behavioral2/memory/5108-23-0x0000000005040000-0x00000000050E3000-memory.dmp family_zgrat_v1 behavioral2/memory/5108-25-0x0000000005040000-0x00000000050E3000-memory.dmp family_zgrat_v1 behavioral2/memory/5108-21-0x0000000005040000-0x00000000050E3000-memory.dmp family_zgrat_v1 behavioral2/memory/5108-27-0x0000000005040000-0x00000000050E3000-memory.dmp family_zgrat_v1 behavioral2/memory/5108-29-0x0000000005040000-0x00000000050E3000-memory.dmp family_zgrat_v1 behavioral2/memory/5108-31-0x0000000005040000-0x00000000050E3000-memory.dmp family_zgrat_v1 behavioral2/memory/5108-33-0x0000000005040000-0x00000000050E3000-memory.dmp family_zgrat_v1 behavioral2/memory/5108-35-0x0000000005040000-0x00000000050E3000-memory.dmp family_zgrat_v1 behavioral2/memory/5108-37-0x0000000005040000-0x00000000050E3000-memory.dmp family_zgrat_v1 behavioral2/memory/5108-39-0x0000000005040000-0x00000000050E3000-memory.dmp family_zgrat_v1 behavioral2/memory/5108-41-0x0000000005040000-0x00000000050E3000-memory.dmp family_zgrat_v1 behavioral2/memory/5108-43-0x0000000005040000-0x00000000050E3000-memory.dmp family_zgrat_v1 behavioral2/memory/5108-45-0x0000000005040000-0x00000000050E3000-memory.dmp family_zgrat_v1 behavioral2/memory/5108-49-0x0000000005040000-0x00000000050E3000-memory.dmp family_zgrat_v1 behavioral2/memory/5108-47-0x0000000005040000-0x00000000050E3000-memory.dmp family_zgrat_v1 behavioral2/memory/5108-51-0x0000000005040000-0x00000000050E3000-memory.dmp family_zgrat_v1 behavioral2/memory/5108-53-0x0000000005040000-0x00000000050E3000-memory.dmp family_zgrat_v1 behavioral2/memory/5108-55-0x0000000005040000-0x00000000050E3000-memory.dmp family_zgrat_v1 behavioral2/memory/5108-57-0x0000000005040000-0x00000000050E3000-memory.dmp family_zgrat_v1 behavioral2/memory/5108-59-0x0000000005040000-0x00000000050E3000-memory.dmp family_zgrat_v1 behavioral2/memory/5108-61-0x0000000005040000-0x00000000050E3000-memory.dmp family_zgrat_v1 behavioral2/memory/5108-63-0x0000000005040000-0x00000000050E3000-memory.dmp family_zgrat_v1 behavioral2/memory/5108-65-0x0000000005040000-0x00000000050E3000-memory.dmp family_zgrat_v1 behavioral2/memory/5108-67-0x0000000005040000-0x00000000050E3000-memory.dmp family_zgrat_v1 -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 64 api.ipify.org 65 api.ipify.org 66 ip-api.com -
Suspicious use of SetThreadContext 1 IoCs
Processes:
PO OAU_DECQTRFA00541·PDF.scrdescription pid process target process PID 5108 set thread context of 60 5108 PO OAU_DECQTRFA00541·PDF.scr aspnet_compiler.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3012 60 WerFault.exe aspnet_compiler.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
aspnet_compiler.exepid process 60 aspnet_compiler.exe 60 aspnet_compiler.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
PO OAU_DECQTRFA00541·PDF.scraspnet_compiler.exedescription pid process Token: SeDebugPrivilege 5108 PO OAU_DECQTRFA00541·PDF.scr Token: SeDebugPrivilege 60 aspnet_compiler.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
PO OAU_DECQTRFA00541·PDF.scrdescription pid process target process PID 5108 wrote to memory of 60 5108 PO OAU_DECQTRFA00541·PDF.scr aspnet_compiler.exe PID 5108 wrote to memory of 60 5108 PO OAU_DECQTRFA00541·PDF.scr aspnet_compiler.exe PID 5108 wrote to memory of 60 5108 PO OAU_DECQTRFA00541·PDF.scr aspnet_compiler.exe PID 5108 wrote to memory of 60 5108 PO OAU_DECQTRFA00541·PDF.scr aspnet_compiler.exe PID 5108 wrote to memory of 60 5108 PO OAU_DECQTRFA00541·PDF.scr aspnet_compiler.exe PID 5108 wrote to memory of 60 5108 PO OAU_DECQTRFA00541·PDF.scr aspnet_compiler.exe PID 5108 wrote to memory of 60 5108 PO OAU_DECQTRFA00541·PDF.scr aspnet_compiler.exe PID 5108 wrote to memory of 60 5108 PO OAU_DECQTRFA00541·PDF.scr aspnet_compiler.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PO OAU_DECQTRFA00541·PDF.scr"C:\Users\Admin\AppData\Local\Temp\PO OAU_DECQTRFA00541·PDF.scr" /S1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5108 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:60 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 60 -s 20963⤵
- Program crash
PID:3012
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 60 -ip 601⤵PID:3556