agenttesla | 27d672cb71c052ba0379590d9fa4ad1253f9b2c12692586bf5829ed0b8d94431

Analysis

max time kernel
151s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231127-en
resource tags

arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system
submitted
12-12-2023 20:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

payment copy.exe
Size

668KB
MD5

e50f7c3cc61113fa9007f36f6562c654
SHA1

b43b2434f4aad4970143dab912e4f047faa4e4a9
SHA256

27d672cb71c052ba0379590d9fa4ad1253f9b2c12692586bf5829ed0b8d94431
SHA512

f1776fc6935971b57a5cd5f20bd2728d0bd78102327541924f958da7654916b6457893fd32228fa1214ec3e536ac4e4cf55fc04e797e1fe1c34fb1eb65dc3c02
SSDEEP

12288:immc+4WpAETy8agvmAWu+Ttcv47vMiPn3eQA2MqJe4SZ2sFYtbYu6Ff8+:GpAEJagv0u+OwT3C8e4ZpY

Score

10^/10

agenttesla zgrat keylogger rat spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.helikhodro.com
Port:
587
Username:
[email protected]
Password:
@Ii9121070423
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Detect ZGRat V1 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1488-6-0x0000000004CD0000-0x0000000004CE8000-memory.dmp	family_zgrat_v1

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

70 api.ipify.org
71 api.ipify.org
72 ip-api.com
Suspicious use of SetThreadContext 1 IoCs

Processes:

payment copy.exe

description pid process target process

PID 1488 set thread context of 4236 1488 payment copy.exe RegSvcs.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

320 4236 WerFault.exe RegSvcs.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

payment copy.exeRegSvcs.exe

pid process

1488 payment copy.exe
1488 payment copy.exe
1488 payment copy.exe
4236 RegSvcs.exe
4236 RegSvcs.exe
4236 RegSvcs.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

payment copy.exeRegSvcs.exe

description pid process

Token: SeDebugPrivilege 1488 payment copy.exe
Token: SeDebugPrivilege 4236 RegSvcs.exe

flow	ioc
70	api.ipify.org
71	api.ipify.org
72	ip-api.com

description	pid	process	target process
PID 1488 set thread context of 4236	1488	payment copy.exe	RegSvcs.exe

pid	pid_target	process	target process
320	4236	WerFault.exe	RegSvcs.exe

pid	process
1488	payment copy.exe
1488	payment copy.exe
1488	payment copy.exe
4236	RegSvcs.exe
4236	RegSvcs.exe
4236	RegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	1488	payment copy.exe
Token: SeDebugPrivilege	4236	RegSvcs.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

payment copy.exe

description	pid	process	target process
PID 1488 wrote to memory of 4236	1488	payment copy.exe	RegSvcs.exe
PID 1488 wrote to memory of 4236	1488	payment copy.exe	RegSvcs.exe
PID 1488 wrote to memory of 4236	1488	payment copy.exe	RegSvcs.exe
PID 1488 wrote to memory of 4236	1488	payment copy.exe	RegSvcs.exe
PID 1488 wrote to memory of 4236	1488	payment copy.exe	RegSvcs.exe
PID 1488 wrote to memory of 4236	1488	payment copy.exe	RegSvcs.exe
PID 1488 wrote to memory of 4236	1488	payment copy.exe	RegSvcs.exe
PID 1488 wrote to memory of 4236	1488	payment copy.exe	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\payment copy.exe
"C:\Users\Admin\AppData\Local\Temp\payment copy.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1488

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4236 -s 2088
3⤵
- Program crash
PID:320

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4236 -ip 4236
1⤵
PID:4876

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1488-8-0x0000000004F70000-0x0000000004F7A000-memory.dmp

Filesize
40KB

Download
memory/1488-4-0x0000000004940000-0x0000000004950000-memory.dmp

Filesize
64KB

Download
memory/1488-0-0x0000000000060000-0x000000000010C000-memory.dmp

Filesize
688KB

Download
memory/1488-3-0x0000000004A00000-0x0000000004A92000-memory.dmp

Filesize
584KB

Download
memory/1488-9-0x0000000008870000-0x00000000088EC000-memory.dmp

Filesize
496KB

Download
memory/1488-5-0x00000000049C0000-0x00000000049CA000-memory.dmp

Filesize
40KB

Download
memory/1488-6-0x0000000004CD0000-0x0000000004CE8000-memory.dmp

Filesize
96KB

Download
memory/1488-10-0x00000000073D0000-0x000000000746C000-memory.dmp

Filesize
624KB

Download
memory/1488-2-0x0000000004FB0000-0x0000000005554000-memory.dmp

Filesize
5.6MB

Download
memory/1488-1-0x0000000074AD0000-0x0000000075280000-memory.dmp

Filesize
7.7MB

Download
memory/1488-7-0x0000000004D10000-0x0000000004D18000-memory.dmp

Filesize
32KB

Download
memory/1488-14-0x0000000074AD0000-0x0000000075280000-memory.dmp

Filesize
7.7MB

Download
memory/4236-13-0x0000000074AD0000-0x0000000075280000-memory.dmp

Filesize
7.7MB

Download
memory/4236-11-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4236-15-0x0000000005900000-0x0000000005910000-memory.dmp

Filesize
64KB

Download
memory/4236-16-0x0000000005910000-0x0000000005976000-memory.dmp

Filesize
408KB

Download
memory/4236-17-0x0000000074AD0000-0x0000000075280000-memory.dmp

Filesize
7.7MB

Download