agenttesla | 7f382cc5928a8adf09033a4412af83f103fe25384f7fb39343344432fc71f8c1

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20231130-en
resource tags

arch:x64arch:x86image:win7-20231130-enlocale:en-usos:windows7-x64system
submitted
12/12/2023, 14:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

attached final docs.exe
Size

672KB
MD5

05bdbf0f45e344ba71847553e4900da0
SHA1

108de8169c3e3affadabb29a3da9d953efb79c87
SHA256

7f382cc5928a8adf09033a4412af83f103fe25384f7fb39343344432fc71f8c1
SHA512

922c275dd6ae6ed21a0a9789343d1848b739ff0dc5d4f0db4f8722b3b5804e0f9061d4ad1a22a7aef83044ed9fa9adbae33014b2df743fa52f364f9f57bd0198
SSDEEP

12288:2S3IU8S6eUd+qKo5v8XCQNhtFJXuxgOwZ0GPkqxEvYnfgAJ7pArHaBtUzefE:2IItSAd+qKo96vNxZMeA0tHE

Score

10^/10

agenttesla zgrat keylogger persistence rat spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.precise.co.in
Port:
587
Username:
[email protected]
Password:
Singh@2022$
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Detect ZGRat V1 1 IoCs

resource	yara_rule
behavioral1/memory/2100-3-0x00000000004C0000-0x00000000004D8000-memory.dmp	family_zgrat_v1

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2058106572-1146578376-825901627-1000\Software\Microsoft\Windows\CurrentVersion\Run\boqXv = "C:\\Users\\Admin\\AppData\\Roaming\\boqXv\\boqXv.exe"	RegSvcs.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2100 set thread context of 2536	2100	attached final docs.exe	32

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2588	schtasks.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2100	attached final docs.exe
2100	attached final docs.exe
2100	attached final docs.exe
2100	attached final docs.exe
2100	attached final docs.exe
2100	attached final docs.exe
2100	attached final docs.exe
2100	attached final docs.exe
2720	powershell.exe
2624	powershell.exe
2100	attached final docs.exe
2536	RegSvcs.exe
2536	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2100	attached final docs.exe
Token: SeDebugPrivilege	2720	powershell.exe
Token: SeDebugPrivilege	2624	powershell.exe
Token: SeDebugPrivilege	2536	RegSvcs.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 2100 wrote to memory of 2624	2100	attached final docs.exe	36
PID 2100 wrote to memory of 2624	2100	attached final docs.exe	36
PID 2100 wrote to memory of 2624	2100	attached final docs.exe	36
PID 2100 wrote to memory of 2624	2100	attached final docs.exe	36
PID 2100 wrote to memory of 2720	2100	attached final docs.exe	34
PID 2100 wrote to memory of 2720	2100	attached final docs.exe	34
PID 2100 wrote to memory of 2720	2100	attached final docs.exe	34
PID 2100 wrote to memory of 2720	2100	attached final docs.exe	34
PID 2100 wrote to memory of 2588	2100	attached final docs.exe	33
PID 2100 wrote to memory of 2588	2100	attached final docs.exe	33
PID 2100 wrote to memory of 2588	2100	attached final docs.exe	33
PID 2100 wrote to memory of 2588	2100	attached final docs.exe	33
PID 2100 wrote to memory of 2648	2100	attached final docs.exe	30
PID 2100 wrote to memory of 2648	2100	attached final docs.exe	30
PID 2100 wrote to memory of 2648	2100	attached final docs.exe	30
PID 2100 wrote to memory of 2648	2100	attached final docs.exe	30
PID 2100 wrote to memory of 2648	2100	attached final docs.exe	30
PID 2100 wrote to memory of 2648	2100	attached final docs.exe	30
PID 2100 wrote to memory of 2648	2100	attached final docs.exe	30
PID 2100 wrote to memory of 2536	2100	attached final docs.exe	32
PID 2100 wrote to memory of 2536	2100	attached final docs.exe	32
PID 2100 wrote to memory of 2536	2100	attached final docs.exe	32
PID 2100 wrote to memory of 2536	2100	attached final docs.exe	32
PID 2100 wrote to memory of 2536	2100	attached final docs.exe	32
PID 2100 wrote to memory of 2536	2100	attached final docs.exe	32
PID 2100 wrote to memory of 2536	2100	attached final docs.exe	32
PID 2100 wrote to memory of 2536	2100	attached final docs.exe	32
PID 2100 wrote to memory of 2536	2100	attached final docs.exe	32
PID 2100 wrote to memory of 2536	2100	attached final docs.exe	32
PID 2100 wrote to memory of 2536	2100	attached final docs.exe	32
PID 2100 wrote to memory of 2536	2100	attached final docs.exe	32

C:\Users\Admin\AppData\Local\Temp\attached final docs.exe
"C:\Users\Admin\AppData\Local\Temp\attached final docs.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  PID:2648
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2536
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TbuoHeok" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6690.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:2588
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\TbuoHeok.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2720
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\attached final docs.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp6690.tmp

Filesize
1KB

MD5
a5c199672f186d570d4bf6b8f63e23f9

SHA1
1b9084e5acfa6a43e46026b804958a81a2295cf6

SHA256
39a68430189b8f455fd8b9f2822b93d48248216cee22a4a1bf86b8d4e77b6c02

SHA512
9def786bc2424008e4f917474d2322bcf056e8b52877a23d34b6a2f06aa885178f86057824be6aa7f6f31b3b4eae5b0f14841ee88ee3b944e28d5c740149c515

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\AMB69OFPCQLYQREJREJU.temp

Filesize
7KB

MD5
ea702c8ccf0146adee83a192a82ad4f0

SHA1
20d04efaff3dd9b67043907720e60bcd743ad9d1

SHA256
63c9ec68834a300e90f2b288eaeb442ae9144082c36034be50b2943ca60ce9dc

SHA512
7c7d0790ece5dd371909e3ffccbe3c69c1575795b48414274cda63971f3d81eb115ff56da8a7997ebd746e067227eeb8fe3f6769829e7c4c3b4364e1da024f24

Download Submit
memory/2100-0-0x0000000000250000-0x00000000002FE000-memory.dmp

Filesize
696KB

Download
memory/2100-1-0x0000000074BD0000-0x00000000752BE000-memory.dmp

Filesize
6.9MB

Download
memory/2100-2-0x0000000004D00000-0x0000000004D40000-memory.dmp

Filesize
256KB

Download
memory/2100-4-0x0000000000460000-0x0000000000468000-memory.dmp

Filesize
32KB

Download
memory/2100-3-0x00000000004C0000-0x00000000004D8000-memory.dmp

Filesize
96KB

Download
memory/2100-5-0x00000000004E0000-0x00000000004EA000-memory.dmp

Filesize
40KB

Download
memory/2100-6-0x0000000001E90000-0x0000000001F0C000-memory.dmp

Filesize
496KB

Download
memory/2100-7-0x0000000074BD0000-0x00000000752BE000-memory.dmp

Filesize
6.9MB

Download
memory/2100-8-0x0000000004D00000-0x0000000004D40000-memory.dmp

Filesize
256KB

Download
memory/2100-37-0x0000000074BD0000-0x00000000752BE000-memory.dmp

Filesize
6.9MB

Download
memory/2536-31-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2536-23-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2536-29-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2536-26-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2536-38-0x0000000074BD0000-0x00000000752BE000-memory.dmp

Filesize
6.9MB

Download
memory/2536-39-0x00000000022C0000-0x0000000002300000-memory.dmp

Filesize
256KB

Download
memory/2536-44-0x00000000022C0000-0x0000000002300000-memory.dmp

Filesize
256KB

Download
memory/2536-36-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2536-43-0x0000000074BD0000-0x00000000752BE000-memory.dmp

Filesize
6.9MB

Download
memory/2536-21-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2536-34-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2536-24-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2624-22-0x000000006E6A0000-0x000000006EC4B000-memory.dmp

Filesize
5.7MB

Download
memory/2624-40-0x000000006E6A0000-0x000000006EC4B000-memory.dmp

Filesize
5.7MB

Download
memory/2624-28-0x000000006E6A0000-0x000000006EC4B000-memory.dmp

Filesize
5.7MB

Download
memory/2720-27-0x0000000002FD0000-0x0000000003010000-memory.dmp

Filesize
256KB

Download
memory/2720-32-0x000000006E6A0000-0x000000006EC4B000-memory.dmp

Filesize
5.7MB

Download
memory/2720-25-0x000000006E6A0000-0x000000006EC4B000-memory.dmp

Filesize
5.7MB

Download
memory/2720-41-0x000000006E6A0000-0x000000006EC4B000-memory.dmp

Filesize
5.7MB

Download