Analysis
-
max time kernel
119s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
23/01/2024, 13:36
Behavioral task
behavioral1
Sample
3040-60-0x00000000402F0000-0x000000004034C000-memory.exe
Resource
win7-20231215-en
6 signatures
150 seconds
General
-
Target
3040-60-0x00000000402F0000-0x000000004034C000-memory.exe
-
Size
368KB
-
MD5
ae975ba1851990015dc9bd347ee179fd
-
SHA1
16cc2f91e385605c3302e4cb719d59c4c281b39f
-
SHA256
5dca6fc45cc2e4c4ff978fa2de059f689d4de9704c0c5d1b5bde8764fa14fe68
-
SHA512
d04a94b1ea70cd67e0dd6a6dae8002777cfce3d86b7827de9866917b0a4fbade0281bce05cd2dded0bf44cd0ce951209a002356a8de380e356e6b2a7430cc9bd
-
SSDEEP
6144:W70RDJaMMUTTXr3DyeCTRu+J5iEvAbE2aw4uay:U0RDJaMMUTTXr3DXClEEvjKz
Malware Config
Extracted
Family
agenttesla
Credentials
Protocol: smtp- Host:
mail.oripam.xyz - Port:
587 - Username:
[email protected] - Password:
231Father@ - Email To:
[email protected]
Extracted
Family
asyncrat
Version
0.5.8
Botnet
Default
C2
139.84.229.159:2017
Mutex
jhT6lZT93vW5
Attributes
-
delay
3
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Detect ZGRat V1 1 IoCs
resource yara_rule behavioral1/memory/2720-0-0x00000000013E0000-0x000000000143C000-memory.dmp family_zgrat_v1 -
Async RAT payload 1 IoCs
resource yara_rule behavioral1/memory/2720-0-0x00000000013E0000-0x000000000143C000-memory.dmp asyncrat -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2720 3040-60-0x00000000402F0000-0x000000004034C000-memory.exe