agenttesla | 206e47751e77f15c70870e3ca493ee455be747be1050ae8ae53c37372a5dff44

Analysis

max time kernel
142s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231127-en
resource tags

arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system
submitted
13-12-2023 01:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NN $$.exe
Size

884KB
MD5

f6953ef972f68aa5ddf83fb22694885d
SHA1

ef1c44e51d2e11c27b09f5b86ad1cc296b3391a0
SHA256

355dd2c151a8acc04968060f9a92ddfe6d35839b63cae0a5e4f275ed7b5af945
SHA512

7f663fee4fa5f8893c7fd857315aaac2d9cc2d63c19db9cfdbfa77aa4ad2411e3cd593d019f05ce4e1ffd27a505e02abb64a2b43de7b2edfddace6794ce16a3e
SSDEEP

12288:VyVt2vuIQIeyxVfgArI7C2uQ1qEyIFPRj74tXg/i9Duk2y377rQwJXP:VIt2vuI1jzgJYmfy0xqXg69S23nkwf

Score

10^/10

agenttesla zgrat keylogger rat spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.helikhodro.com
Port:
587
Username:
[email protected]
Password:
@Ii9121070423
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Detect ZGRat V1 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/384-6-0x0000000006090000-0x00000000060A8000-memory.dmp	family_zgrat_v1

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

51 api.ipify.org
52 api.ipify.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

NN $$.exe

description pid process target process

PID 384 set thread context of 2204 384 NN $$.exe RegSvcs.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

5068 2204 WerFault.exe RegSvcs.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

NN $$.exeRegSvcs.exe

pid process

384 NN $$.exe
384 NN $$.exe
2204 RegSvcs.exe
2204 RegSvcs.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

NN $$.exeRegSvcs.exe

description pid process

Token: SeDebugPrivilege 384 NN $$.exe
Token: SeDebugPrivilege 2204 RegSvcs.exe

flow	ioc
51	api.ipify.org
52	api.ipify.org

description	pid	process	target process
PID 384 set thread context of 2204	384	NN $$.exe	RegSvcs.exe

pid	pid_target	process	target process
5068	2204	WerFault.exe	RegSvcs.exe

pid	process
384	NN $$.exe
384	NN $$.exe
2204	RegSvcs.exe
2204	RegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	384	NN $$.exe
Token: SeDebugPrivilege	2204	RegSvcs.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

NN $$.exe

description	pid	process	target process
PID 384 wrote to memory of 2204	384	NN $$.exe	RegSvcs.exe
PID 384 wrote to memory of 2204	384	NN $$.exe	RegSvcs.exe
PID 384 wrote to memory of 2204	384	NN $$.exe	RegSvcs.exe
PID 384 wrote to memory of 2204	384	NN $$.exe	RegSvcs.exe
PID 384 wrote to memory of 2204	384	NN $$.exe	RegSvcs.exe
PID 384 wrote to memory of 2204	384	NN $$.exe	RegSvcs.exe
PID 384 wrote to memory of 2204	384	NN $$.exe	RegSvcs.exe
PID 384 wrote to memory of 2204	384	NN $$.exe	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\NN $$.exe
"C:\Users\Admin\AppData\Local\Temp\NN $$.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:384

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2204 -s 1984
3⤵
- Program crash
PID:5068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2204 -ip 2204
1⤵
PID:1984

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/384-8-0x00000000063C0000-0x00000000063CA000-memory.dmp

Filesize
40KB

Download
memory/384-4-0x0000000004E40000-0x0000000004E50000-memory.dmp

Filesize
64KB

Download
memory/384-0-0x0000000074D00000-0x00000000754B0000-memory.dmp

Filesize
7.7MB

Download
memory/384-3-0x0000000004F30000-0x0000000004FC2000-memory.dmp

Filesize
584KB

Download
memory/384-9-0x0000000009E20000-0x0000000009E9A000-memory.dmp

Filesize
488KB

Download
memory/384-5-0x0000000004EA0000-0x0000000004EAA000-memory.dmp

Filesize
40KB

Download
memory/384-6-0x0000000006090000-0x00000000060A8000-memory.dmp

Filesize
96KB

Download
memory/384-10-0x000000000BEA0000-0x000000000BF3C000-memory.dmp

Filesize
624KB

Download
memory/384-2-0x00000000054E0000-0x0000000005A84000-memory.dmp

Filesize
5.6MB

Download
memory/384-1-0x00000000003A0000-0x0000000000484000-memory.dmp

Filesize
912KB

Download
memory/384-7-0x00000000063B0000-0x00000000063B8000-memory.dmp

Filesize
32KB

Download
memory/384-16-0x0000000074D00000-0x00000000754B0000-memory.dmp

Filesize
7.7MB

Download
memory/2204-13-0x0000000074D00000-0x00000000754B0000-memory.dmp

Filesize
7.7MB

Download
memory/2204-14-0x00000000054D0000-0x00000000054E0000-memory.dmp

Filesize
64KB

Download
memory/2204-15-0x00000000055E0000-0x0000000005646000-memory.dmp

Filesize
408KB

Download
memory/2204-11-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2204-17-0x0000000074D00000-0x00000000754B0000-memory.dmp

Filesize
7.7MB

Download