agenttesla | d3fefa3e2caa419c12cf2a1600e4c41c465bf932b0ae7c337bfa2fcf5007ae5b

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/01/2024, 01:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d3fefa3e2caa419c12cf2a1600e4c41c465bf932b0ae7c337bfa2fcf5007ae5b.exe
Size

1.2MB
MD5

bc64cfefe717bfc87f7c9f45600bfbb1
SHA1

ffecc2a2b387d25e178013eb66f22457ad58f83a
SHA256

d3fefa3e2caa419c12cf2a1600e4c41c465bf932b0ae7c337bfa2fcf5007ae5b
SHA512

b5645dcc166053b3b9b05fdbe2a96cd795d2df829efe67e98cb0d01826dd37f2575c50afa193bae31db88880994135a68321219576a841c2bdc43c6b3416d6de
SSDEEP

24576:/qDEvCTbMWu7rQYlBQcBiT6rprG8aipcUz1nDsFRbryq9EZTYI:/TvC/MTQYxsWR7aipRz4bu

Score

10^/10

agenttesla zgrat keylogger rat spyware stealer trojan

Malware Config

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Detect ZGRat V1 33 IoCs

resource	yara_rule
behavioral1/memory/2704-30-0x0000000001F70000-0x0000000001FC6000-memory.dmp	family_zgrat_v1
behavioral1/memory/2704-33-0x0000000001FC0000-0x0000000002014000-memory.dmp	family_zgrat_v1
behavioral1/memory/2704-34-0x0000000001FC0000-0x000000000200E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2704-35-0x0000000001FC0000-0x000000000200E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2704-37-0x0000000001FC0000-0x000000000200E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2704-39-0x0000000001FC0000-0x000000000200E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2704-41-0x0000000001FC0000-0x000000000200E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2704-45-0x0000000001FC0000-0x000000000200E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2704-43-0x0000000001FC0000-0x000000000200E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2704-47-0x0000000001FC0000-0x000000000200E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2704-49-0x0000000001FC0000-0x000000000200E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2704-51-0x0000000001FC0000-0x000000000200E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2704-53-0x0000000001FC0000-0x000000000200E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2704-55-0x0000000001FC0000-0x000000000200E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2704-57-0x0000000001FC0000-0x000000000200E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2704-59-0x0000000001FC0000-0x000000000200E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2704-61-0x0000000001FC0000-0x000000000200E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2704-63-0x0000000001FC0000-0x000000000200E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2704-65-0x0000000001FC0000-0x000000000200E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2704-67-0x0000000001FC0000-0x000000000200E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2704-69-0x0000000001FC0000-0x000000000200E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2704-71-0x0000000001FC0000-0x000000000200E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2704-73-0x0000000001FC0000-0x000000000200E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2704-75-0x0000000001FC0000-0x000000000200E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2704-89-0x0000000001FC0000-0x000000000200E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2704-87-0x0000000001FC0000-0x000000000200E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2704-93-0x0000000001FC0000-0x000000000200E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2704-91-0x0000000001FC0000-0x000000000200E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2704-85-0x0000000001FC0000-0x000000000200E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2704-83-0x0000000001FC0000-0x000000000200E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2704-81-0x0000000001FC0000-0x000000000200E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2704-79-0x0000000001FC0000-0x000000000200E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2704-77-0x0000000001FC0000-0x000000000200E000-memory.dmp	family_zgrat_v1

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	ip-api.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2052 set thread context of 2704	2052	d3fefa3e2caa419c12cf2a1600e4c41c465bf932b0ae7c337bfa2fcf5007ae5b.exe	30

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2704	RegSvcs.exe
2704	RegSvcs.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
3016	d3fefa3e2caa419c12cf2a1600e4c41c465bf932b0ae7c337bfa2fcf5007ae5b.exe
2052	d3fefa3e2caa419c12cf2a1600e4c41c465bf932b0ae7c337bfa2fcf5007ae5b.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2704	RegSvcs.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 3016 wrote to memory of 3056	3016	d3fefa3e2caa419c12cf2a1600e4c41c465bf932b0ae7c337bfa2fcf5007ae5b.exe	28
PID 3016 wrote to memory of 3056	3016	d3fefa3e2caa419c12cf2a1600e4c41c465bf932b0ae7c337bfa2fcf5007ae5b.exe	28
PID 3016 wrote to memory of 3056	3016	d3fefa3e2caa419c12cf2a1600e4c41c465bf932b0ae7c337bfa2fcf5007ae5b.exe	28
PID 3016 wrote to memory of 3056	3016	d3fefa3e2caa419c12cf2a1600e4c41c465bf932b0ae7c337bfa2fcf5007ae5b.exe	28
PID 3016 wrote to memory of 3056	3016	d3fefa3e2caa419c12cf2a1600e4c41c465bf932b0ae7c337bfa2fcf5007ae5b.exe	28
PID 3016 wrote to memory of 3056	3016	d3fefa3e2caa419c12cf2a1600e4c41c465bf932b0ae7c337bfa2fcf5007ae5b.exe	28
PID 3016 wrote to memory of 3056	3016	d3fefa3e2caa419c12cf2a1600e4c41c465bf932b0ae7c337bfa2fcf5007ae5b.exe	28
PID 3016 wrote to memory of 2052	3016	d3fefa3e2caa419c12cf2a1600e4c41c465bf932b0ae7c337bfa2fcf5007ae5b.exe	29
PID 3016 wrote to memory of 2052	3016	d3fefa3e2caa419c12cf2a1600e4c41c465bf932b0ae7c337bfa2fcf5007ae5b.exe	29
PID 3016 wrote to memory of 2052	3016	d3fefa3e2caa419c12cf2a1600e4c41c465bf932b0ae7c337bfa2fcf5007ae5b.exe	29
PID 3016 wrote to memory of 2052	3016	d3fefa3e2caa419c12cf2a1600e4c41c465bf932b0ae7c337bfa2fcf5007ae5b.exe	29
PID 2052 wrote to memory of 2704	2052	d3fefa3e2caa419c12cf2a1600e4c41c465bf932b0ae7c337bfa2fcf5007ae5b.exe	30
PID 2052 wrote to memory of 2704	2052	d3fefa3e2caa419c12cf2a1600e4c41c465bf932b0ae7c337bfa2fcf5007ae5b.exe	30
PID 2052 wrote to memory of 2704	2052	d3fefa3e2caa419c12cf2a1600e4c41c465bf932b0ae7c337bfa2fcf5007ae5b.exe	30
PID 2052 wrote to memory of 2704	2052	d3fefa3e2caa419c12cf2a1600e4c41c465bf932b0ae7c337bfa2fcf5007ae5b.exe	30
PID 2052 wrote to memory of 2704	2052	d3fefa3e2caa419c12cf2a1600e4c41c465bf932b0ae7c337bfa2fcf5007ae5b.exe	30
PID 2052 wrote to memory of 2704	2052	d3fefa3e2caa419c12cf2a1600e4c41c465bf932b0ae7c337bfa2fcf5007ae5b.exe	30
PID 2052 wrote to memory of 2704	2052	d3fefa3e2caa419c12cf2a1600e4c41c465bf932b0ae7c337bfa2fcf5007ae5b.exe	30
PID 2052 wrote to memory of 2704	2052	d3fefa3e2caa419c12cf2a1600e4c41c465bf932b0ae7c337bfa2fcf5007ae5b.exe	30

C:\Users\Admin\AppData\Local\Temp\d3fefa3e2caa419c12cf2a1600e4c41c465bf932b0ae7c337bfa2fcf5007ae5b.exe
"C:\Users\Admin\AppData\Local\Temp\d3fefa3e2caa419c12cf2a1600e4c41c465bf932b0ae7c337bfa2fcf5007ae5b.exe"
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3016
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Users\Admin\AppData\Local\Temp\d3fefa3e2caa419c12cf2a1600e4c41c465bf932b0ae7c337bfa2fcf5007ae5b.exe"
  2⤵
  PID:3056
- C:\Users\Admin\AppData\Local\Temp\d3fefa3e2caa419c12cf2a1600e4c41c465bf932b0ae7c337bfa2fcf5007ae5b.exe
  "C:\Users\Admin\AppData\Local\Temp\d3fefa3e2caa419c12cf2a1600e4c41c465bf932b0ae7c337bfa2fcf5007ae5b.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2052
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "C:\Users\Admin\AppData\Local\Temp\d3fefa3e2caa419c12cf2a1600e4c41c465bf932b0ae7c337bfa2fcf5007ae5b.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2704

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\cacostomia

Filesize
263KB

MD5
c39bde6ca027fb3552fd87de562ad3e6

SHA1
6eea4d3a636a862251821b32dcd1f97f788bbb4d

SHA256
44b4b5ed0050b137092c55f6dc5d81a9dfabe3126bb29d699a70d1fc80ce9baa

SHA512
013b5faea4dbd3467af931b00494ae6c9a065493b1e4ddb47b44cd29f11caef45627e90ac4d8dc300dc4bb133388e28913505b9c912bd11161687bfa0fd4d639

Download Submit
memory/2704-59-0x0000000001FC0000-0x000000000200E000-memory.dmp

Filesize
312KB

Download
memory/2704-43-0x0000000001FC0000-0x000000000200E000-memory.dmp

Filesize
312KB

Download
memory/2704-27-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2704-28-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2704-30-0x0000000001F70000-0x0000000001FC6000-memory.dmp

Filesize
344KB

Download
memory/2704-29-0x0000000074A10000-0x00000000750FE000-memory.dmp

Filesize
6.9MB

Download
memory/2704-31-0x00000000047D0000-0x0000000004810000-memory.dmp

Filesize
256KB

Download
memory/2704-32-0x00000000047D0000-0x0000000004810000-memory.dmp

Filesize
256KB

Download
memory/2704-33-0x0000000001FC0000-0x0000000002014000-memory.dmp

Filesize
336KB

Download
memory/2704-34-0x0000000001FC0000-0x000000000200E000-memory.dmp

Filesize
312KB

Download
memory/2704-35-0x0000000001FC0000-0x000000000200E000-memory.dmp

Filesize
312KB

Download
memory/2704-37-0x0000000001FC0000-0x000000000200E000-memory.dmp

Filesize
312KB

Download
memory/2704-39-0x0000000001FC0000-0x000000000200E000-memory.dmp

Filesize
312KB

Download
memory/2704-41-0x0000000001FC0000-0x000000000200E000-memory.dmp

Filesize
312KB

Download
memory/2704-45-0x0000000001FC0000-0x000000000200E000-memory.dmp

Filesize
312KB

Download
memory/2704-61-0x0000000001FC0000-0x000000000200E000-memory.dmp

Filesize
312KB

Download
memory/2704-47-0x0000000001FC0000-0x000000000200E000-memory.dmp

Filesize
312KB

Download
memory/2704-49-0x0000000001FC0000-0x000000000200E000-memory.dmp

Filesize
312KB

Download
memory/2704-51-0x0000000001FC0000-0x000000000200E000-memory.dmp

Filesize
312KB

Download
memory/2704-53-0x0000000001FC0000-0x000000000200E000-memory.dmp

Filesize
312KB

Download
memory/2704-55-0x0000000001FC0000-0x000000000200E000-memory.dmp

Filesize
312KB

Download
memory/2704-57-0x0000000001FC0000-0x000000000200E000-memory.dmp

Filesize
312KB

Download
memory/2704-25-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2704-1083-0x00000000047D0000-0x0000000004810000-memory.dmp

Filesize
256KB

Download
memory/2704-79-0x0000000001FC0000-0x000000000200E000-memory.dmp

Filesize
312KB

Download
memory/2704-65-0x0000000001FC0000-0x000000000200E000-memory.dmp

Filesize
312KB

Download
memory/2704-67-0x0000000001FC0000-0x000000000200E000-memory.dmp

Filesize
312KB

Download
memory/2704-69-0x0000000001FC0000-0x000000000200E000-memory.dmp

Filesize
312KB

Download
memory/2704-71-0x0000000001FC0000-0x000000000200E000-memory.dmp

Filesize
312KB

Download
memory/2704-73-0x0000000001FC0000-0x000000000200E000-memory.dmp

Filesize
312KB

Download
memory/2704-75-0x0000000001FC0000-0x000000000200E000-memory.dmp

Filesize
312KB

Download
memory/2704-89-0x0000000001FC0000-0x000000000200E000-memory.dmp

Filesize
312KB

Download
memory/2704-87-0x0000000001FC0000-0x000000000200E000-memory.dmp

Filesize
312KB

Download
memory/2704-93-0x0000000001FC0000-0x000000000200E000-memory.dmp

Filesize
312KB

Download
memory/2704-91-0x0000000001FC0000-0x000000000200E000-memory.dmp

Filesize
312KB

Download
memory/2704-85-0x0000000001FC0000-0x000000000200E000-memory.dmp

Filesize
312KB

Download
memory/2704-83-0x0000000001FC0000-0x000000000200E000-memory.dmp

Filesize
312KB

Download
memory/2704-81-0x0000000001FC0000-0x000000000200E000-memory.dmp

Filesize
312KB

Download
memory/2704-63-0x0000000001FC0000-0x000000000200E000-memory.dmp

Filesize
312KB

Download
memory/2704-77-0x0000000001FC0000-0x000000000200E000-memory.dmp

Filesize
312KB

Download
memory/2704-1078-0x00000000047D0000-0x0000000004810000-memory.dmp

Filesize
256KB

Download
memory/2704-1079-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2704-1080-0x0000000074A10000-0x00000000750FE000-memory.dmp

Filesize
6.9MB

Download
memory/2704-1081-0x00000000047D0000-0x0000000004810000-memory.dmp

Filesize
256KB

Download
memory/2704-1082-0x00000000047D0000-0x0000000004810000-memory.dmp

Filesize
256KB

Download
memory/3016-11-0x0000000000120000-0x0000000000124000-memory.dmp

Filesize
16KB

Download