agenttesla | 7f382cc5928a8adf09033a4412af83f103fe25384f7fb39343344432fc71f8c1

General

Target

attached final docs.exe
Size

672KB
MD5

05bdbf0f45e344ba71847553e4900da0
SHA1

108de8169c3e3affadabb29a3da9d953efb79c87
SHA256

7f382cc5928a8adf09033a4412af83f103fe25384f7fb39343344432fc71f8c1
SHA512

922c275dd6ae6ed21a0a9789343d1848b739ff0dc5d4f0db4f8722b3b5804e0f9061d4ad1a22a7aef83044ed9fa9adbae33014b2df743fa52f364f9f57bd0198
SSDEEP

12288:2S3IU8S6eUd+qKo5v8XCQNhtFJXuxgOwZ0GPkqxEvYnfgAJ7pArHaBtUzefE:2IItSAd+qKo96vNxZMeA0tHE

Score

10^/10

agenttesla zgrat keylogger persistence rat spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.precise.co.in
Port:
587
Username:
[email protected]
Password:
Singh@2022$
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Detect ZGRat V1 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2964-3-0x0000000000540000-0x0000000000558000-memory.dmp	family_zgrat_v1

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

RegSvcs.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Windows\CurrentVersion\Run\boqXv = "C:\\Users\\Admin\\AppData\\Roaming\\boqXv\\boqXv.exe"	RegSvcs.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

attached final docs.exe

description pid process target process

PID 2964 set thread context of 568 2964 attached final docs.exe RegSvcs.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

2548 schtasks.exe

description	pid	process	target process
PID 2964 set thread context of 568	2964	attached final docs.exe	RegSvcs.exe

pid	process
2548	schtasks.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

Processes:

attached final docs.exepowershell.exepowershell.exeRegSvcs.exe

pid	process
2964	attached final docs.exe
2964	attached final docs.exe
2964	attached final docs.exe
2964	attached final docs.exe
2964	attached final docs.exe
2964	attached final docs.exe
2964	attached final docs.exe
2952	powershell.exe
2652	powershell.exe
568	RegSvcs.exe
568	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

attached final docs.exepowershell.exepowershell.exeRegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	2964	attached final docs.exe
Token: SeDebugPrivilege	2952	powershell.exe
Token: SeDebugPrivilege	2652	powershell.exe
Token: SeDebugPrivilege	568	RegSvcs.exe

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

attached final docs.exe

description	pid	process	target process
PID 2964 wrote to memory of 2652	2964	attached final docs.exe	powershell.exe
PID 2964 wrote to memory of 2652	2964	attached final docs.exe	powershell.exe
PID 2964 wrote to memory of 2652	2964	attached final docs.exe	powershell.exe
PID 2964 wrote to memory of 2652	2964	attached final docs.exe	powershell.exe
PID 2964 wrote to memory of 2952	2964	attached final docs.exe	powershell.exe
PID 2964 wrote to memory of 2952	2964	attached final docs.exe	powershell.exe
PID 2964 wrote to memory of 2952	2964	attached final docs.exe	powershell.exe
PID 2964 wrote to memory of 2952	2964	attached final docs.exe	powershell.exe
PID 2964 wrote to memory of 2548	2964	attached final docs.exe	schtasks.exe
PID 2964 wrote to memory of 2548	2964	attached final docs.exe	schtasks.exe
PID 2964 wrote to memory of 2548	2964	attached final docs.exe	schtasks.exe
PID 2964 wrote to memory of 2548	2964	attached final docs.exe	schtasks.exe
PID 2964 wrote to memory of 568	2964	attached final docs.exe	RegSvcs.exe
PID 2964 wrote to memory of 568	2964	attached final docs.exe	RegSvcs.exe
PID 2964 wrote to memory of 568	2964	attached final docs.exe	RegSvcs.exe
PID 2964 wrote to memory of 568	2964	attached final docs.exe	RegSvcs.exe
PID 2964 wrote to memory of 568	2964	attached final docs.exe	RegSvcs.exe
PID 2964 wrote to memory of 568	2964	attached final docs.exe	RegSvcs.exe
PID 2964 wrote to memory of 568	2964	attached final docs.exe	RegSvcs.exe
PID 2964 wrote to memory of 568	2964	attached final docs.exe	RegSvcs.exe
PID 2964 wrote to memory of 568	2964	attached final docs.exe	RegSvcs.exe
PID 2964 wrote to memory of 568	2964	attached final docs.exe	RegSvcs.exe
PID 2964 wrote to memory of 568	2964	attached final docs.exe	RegSvcs.exe
PID 2964 wrote to memory of 568	2964	attached final docs.exe	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\attached final docs.exe
"C:\Users\Admin\AppData\Local\Temp\attached final docs.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2964

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\attached final docs.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2652

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\TbuoHeok.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2952

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TbuoHeok" /XML "C:\Users\Admin\AppData\Local\Temp\tmpFD91.tmp"
2⤵
- Creates scheduled task(s)
PID:2548

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpFD91.tmp

Filesize
1KB

MD5
a26f7c9dc5ebc75440be223e3f8854fc

SHA1
869c04fb3d40f11bc2b59c7dbb9dca84b24fcfda

SHA256
c3c1ba110538d8f25b0337267614d1da0f91cc13395eecd9eb4e6f8ccf0e2146

SHA512
f94364255f9fe21295014882deb0333572defbe5ab1680b3c09fd5204e501da300a2ea0e585c9fa15fdeb9821623d568e23dedc894e021c485fd96453d1123f9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ZZDKY1LZ5H1X4O11U91L.temp

Filesize
7KB

MD5
9fe44a8f30d645549185c04bf8f83e7f

SHA1
2aae372f39f509eb4422a4f17791ab7bfda1bae1

SHA256
f4b6dab445f82f10d3fb8a95dedb35cce34c8d1d762e9b042ca0e4ee010b03d5

SHA512
05bbcc33f8c97e9b1d178e55934c937ee4baaa78e504fc2f6a189057fc1fe557a838f714ac9fa567837ee5b12830725beb0306a641375daae86fe83347650697

Download Submit
memory/568-44-0x0000000074A90000-0x000000007517E000-memory.dmp

Filesize
6.9MB

Download
memory/568-29-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/568-45-0x0000000000E50000-0x0000000000E90000-memory.dmp

Filesize
256KB

Download
memory/568-33-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/568-38-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/568-31-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/568-27-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/568-49-0x0000000074A90000-0x000000007517E000-memory.dmp

Filesize
6.9MB

Download
memory/568-50-0x0000000000E50000-0x0000000000E90000-memory.dmp

Filesize
256KB

Download
memory/568-21-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/568-23-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/568-25-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2652-40-0x000000006E560000-0x000000006EB0B000-memory.dmp

Filesize
5.7MB

Download
memory/2652-47-0x000000006E560000-0x000000006EB0B000-memory.dmp

Filesize
5.7MB

Download
memory/2652-42-0x0000000002690000-0x00000000026D0000-memory.dmp

Filesize
256KB

Download
memory/2652-39-0x0000000002690000-0x00000000026D0000-memory.dmp

Filesize
256KB

Download
memory/2652-43-0x0000000002690000-0x00000000026D0000-memory.dmp

Filesize
256KB

Download
memory/2652-37-0x000000006E560000-0x000000006EB0B000-memory.dmp

Filesize
5.7MB

Download
memory/2952-41-0x000000006E560000-0x000000006EB0B000-memory.dmp

Filesize
5.7MB

Download
memory/2952-35-0x000000006E560000-0x000000006EB0B000-memory.dmp

Filesize
5.7MB

Download
memory/2952-46-0x000000006E560000-0x000000006EB0B000-memory.dmp

Filesize
5.7MB

Download
memory/2964-36-0x0000000074A90000-0x000000007517E000-memory.dmp

Filesize
6.9MB

Download
memory/2964-8-0x00000000048B0000-0x00000000048F0000-memory.dmp

Filesize
256KB

Download
memory/2964-0-0x0000000001040000-0x00000000010EE000-memory.dmp

Filesize
696KB

Download
memory/2964-7-0x0000000074A90000-0x000000007517E000-memory.dmp

Filesize
6.9MB

Download
memory/2964-6-0x0000000004F20000-0x0000000004F9C000-memory.dmp

Filesize
496KB

Download
memory/2964-5-0x0000000000560000-0x000000000056A000-memory.dmp

Filesize
40KB

Download
memory/2964-4-0x0000000000510000-0x0000000000518000-memory.dmp

Filesize
32KB

Download
memory/2964-3-0x0000000000540000-0x0000000000558000-memory.dmp

Filesize
96KB

Download
memory/2964-2-0x00000000048B0000-0x00000000048F0000-memory.dmp

Filesize
256KB

Download
memory/2964-1-0x0000000074A90000-0x000000007517E000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads