agenttesla | 94caec1ea3b33466b23e3a3fe5c169d78f2889eadb2f9fe0205429f160be30a4

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26-01-2024 01:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

roc8899076654hyter.exe
Size

1.3MB
MD5

0e29a8356fc439c51c89f38bf1d87a07
SHA1

462c0714032110552b1fe6b6dff71654d3e8f372
SHA256

a07958f2f727b446e9fece662ba415f8260602dac7be53dd3a63b822290dcfd7
SHA512

db5e0556a8aa978526877a623e7f4beb05acd736ab42bf0a9277b793a1c6073f078e48c8fc5fd5c8163562569a314454756cffafde8b739c81fcb6959dac57fb
SSDEEP

24576:LAHnh+eWsN3skA4RV1Hom2KXMmHa7rT2kIYopUa5:mh+ZkldoPK8Ya7rxjq

Score

10^/10

agenttesla zgrat keylogger rat spyware stealer trojan

Malware Config

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Detect ZGRat V1 33 IoCs

resource	yara_rule
behavioral1/memory/2664-27-0x0000000000840000-0x0000000000894000-memory.dmp	family_zgrat_v1
behavioral1/memory/2664-31-0x0000000000C20000-0x0000000000C74000-memory.dmp	family_zgrat_v1
behavioral1/memory/2664-32-0x0000000000C20000-0x0000000000C6D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2664-33-0x0000000000C20000-0x0000000000C6D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2664-35-0x0000000000C20000-0x0000000000C6D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2664-37-0x0000000000C20000-0x0000000000C6D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2664-39-0x0000000000C20000-0x0000000000C6D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2664-41-0x0000000000C20000-0x0000000000C6D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2664-43-0x0000000000C20000-0x0000000000C6D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2664-45-0x0000000000C20000-0x0000000000C6D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2664-47-0x0000000000C20000-0x0000000000C6D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2664-49-0x0000000000C20000-0x0000000000C6D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2664-51-0x0000000000C20000-0x0000000000C6D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2664-55-0x0000000000C20000-0x0000000000C6D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2664-59-0x0000000000C20000-0x0000000000C6D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2664-65-0x0000000000C20000-0x0000000000C6D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2664-77-0x0000000000C20000-0x0000000000C6D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2664-81-0x0000000000C20000-0x0000000000C6D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2664-79-0x0000000000C20000-0x0000000000C6D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2664-83-0x0000000000C20000-0x0000000000C6D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2664-75-0x0000000000C20000-0x0000000000C6D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2664-85-0x0000000000C20000-0x0000000000C6D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2664-87-0x0000000000C20000-0x0000000000C6D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2664-91-0x0000000000C20000-0x0000000000C6D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2664-89-0x0000000000C20000-0x0000000000C6D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2664-73-0x0000000000C20000-0x0000000000C6D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2664-71-0x0000000000C20000-0x0000000000C6D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2664-69-0x0000000000C20000-0x0000000000C6D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2664-67-0x0000000000C20000-0x0000000000C6D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2664-63-0x0000000000C20000-0x0000000000C6D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2664-61-0x0000000000C20000-0x0000000000C6D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2664-57-0x0000000000C20000-0x0000000000C6D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2664-53-0x0000000000C20000-0x0000000000C6D000-memory.dmp	family_zgrat_v1

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	ip-api.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2264 set thread context of 2664	2264	roc8899076654hyter.exe	30

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2664	RegSvcs.exe
2664	RegSvcs.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
2052	roc8899076654hyter.exe
2264	roc8899076654hyter.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2664	RegSvcs.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 2052 wrote to memory of 2904	2052	roc8899076654hyter.exe	28
PID 2052 wrote to memory of 2904	2052	roc8899076654hyter.exe	28
PID 2052 wrote to memory of 2904	2052	roc8899076654hyter.exe	28
PID 2052 wrote to memory of 2904	2052	roc8899076654hyter.exe	28
PID 2052 wrote to memory of 2904	2052	roc8899076654hyter.exe	28
PID 2052 wrote to memory of 2904	2052	roc8899076654hyter.exe	28
PID 2052 wrote to memory of 2904	2052	roc8899076654hyter.exe	28
PID 2052 wrote to memory of 2264	2052	roc8899076654hyter.exe	29
PID 2052 wrote to memory of 2264	2052	roc8899076654hyter.exe	29
PID 2052 wrote to memory of 2264	2052	roc8899076654hyter.exe	29
PID 2052 wrote to memory of 2264	2052	roc8899076654hyter.exe	29
PID 2264 wrote to memory of 2664	2264	roc8899076654hyter.exe	30
PID 2264 wrote to memory of 2664	2264	roc8899076654hyter.exe	30
PID 2264 wrote to memory of 2664	2264	roc8899076654hyter.exe	30
PID 2264 wrote to memory of 2664	2264	roc8899076654hyter.exe	30
PID 2264 wrote to memory of 2664	2264	roc8899076654hyter.exe	30
PID 2264 wrote to memory of 2664	2264	roc8899076654hyter.exe	30
PID 2264 wrote to memory of 2664	2264	roc8899076654hyter.exe	30
PID 2264 wrote to memory of 2664	2264	roc8899076654hyter.exe	30

C:\Users\Admin\AppData\Local\Temp\roc8899076654hyter.exe
"C:\Users\Admin\AppData\Local\Temp\roc8899076654hyter.exe"
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2052
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Users\Admin\AppData\Local\Temp\roc8899076654hyter.exe"
  2⤵
  PID:2904
- C:\Users\Admin\AppData\Local\Temp\roc8899076654hyter.exe
  "C:\Users\Admin\AppData\Local\Temp\roc8899076654hyter.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2264
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "C:\Users\Admin\AppData\Local\Temp\roc8899076654hyter.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2664

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2052-10-0x00000000001A0000-0x00000000001A4000-memory.dmp

Filesize
16KB

Download
memory/2664-59-0x0000000000C20000-0x0000000000C6D000-memory.dmp

Filesize
308KB

Download
memory/2664-28-0x0000000074D60000-0x000000007544E000-memory.dmp

Filesize
6.9MB

Download
memory/2664-26-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2664-65-0x0000000000C20000-0x0000000000C6D000-memory.dmp

Filesize
308KB

Download
memory/2664-27-0x0000000000840000-0x0000000000894000-memory.dmp

Filesize
336KB

Download
memory/2664-29-0x0000000000CF0000-0x0000000000D30000-memory.dmp

Filesize
256KB

Download
memory/2664-30-0x0000000000CF0000-0x0000000000D30000-memory.dmp

Filesize
256KB

Download
memory/2664-31-0x0000000000C20000-0x0000000000C74000-memory.dmp

Filesize
336KB

Download
memory/2664-32-0x0000000000C20000-0x0000000000C6D000-memory.dmp

Filesize
308KB

Download
memory/2664-33-0x0000000000C20000-0x0000000000C6D000-memory.dmp

Filesize
308KB

Download
memory/2664-35-0x0000000000C20000-0x0000000000C6D000-memory.dmp

Filesize
308KB

Download
memory/2664-37-0x0000000000C20000-0x0000000000C6D000-memory.dmp

Filesize
308KB

Download
memory/2664-39-0x0000000000C20000-0x0000000000C6D000-memory.dmp

Filesize
308KB

Download
memory/2664-41-0x0000000000C20000-0x0000000000C6D000-memory.dmp

Filesize
308KB

Download
memory/2664-43-0x0000000000C20000-0x0000000000C6D000-memory.dmp

Filesize
308KB

Download
memory/2664-77-0x0000000000C20000-0x0000000000C6D000-memory.dmp

Filesize
308KB

Download
memory/2664-47-0x0000000000C20000-0x0000000000C6D000-memory.dmp

Filesize
308KB

Download
memory/2664-49-0x0000000000C20000-0x0000000000C6D000-memory.dmp

Filesize
308KB

Download
memory/2664-51-0x0000000000C20000-0x0000000000C6D000-memory.dmp

Filesize
308KB

Download
memory/2664-55-0x0000000000C20000-0x0000000000C6D000-memory.dmp

Filesize
308KB

Download
memory/2664-1078-0x0000000000CF0000-0x0000000000D30000-memory.dmp

Filesize
256KB

Download
memory/2664-25-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2664-45-0x0000000000C20000-0x0000000000C6D000-memory.dmp

Filesize
308KB

Download
memory/2664-81-0x0000000000C20000-0x0000000000C6D000-memory.dmp

Filesize
308KB

Download
memory/2664-79-0x0000000000C20000-0x0000000000C6D000-memory.dmp

Filesize
308KB

Download
memory/2664-83-0x0000000000C20000-0x0000000000C6D000-memory.dmp

Filesize
308KB

Download
memory/2664-75-0x0000000000C20000-0x0000000000C6D000-memory.dmp

Filesize
308KB

Download
memory/2664-85-0x0000000000C20000-0x0000000000C6D000-memory.dmp

Filesize
308KB

Download
memory/2664-87-0x0000000000C20000-0x0000000000C6D000-memory.dmp

Filesize
308KB

Download
memory/2664-91-0x0000000000C20000-0x0000000000C6D000-memory.dmp

Filesize
308KB

Download
memory/2664-89-0x0000000000C20000-0x0000000000C6D000-memory.dmp

Filesize
308KB

Download
memory/2664-73-0x0000000000C20000-0x0000000000C6D000-memory.dmp

Filesize
308KB

Download
memory/2664-71-0x0000000000C20000-0x0000000000C6D000-memory.dmp

Filesize
308KB

Download
memory/2664-69-0x0000000000C20000-0x0000000000C6D000-memory.dmp

Filesize
308KB

Download
memory/2664-67-0x0000000000C20000-0x0000000000C6D000-memory.dmp

Filesize
308KB

Download
memory/2664-63-0x0000000000C20000-0x0000000000C6D000-memory.dmp

Filesize
308KB

Download
memory/2664-61-0x0000000000C20000-0x0000000000C6D000-memory.dmp

Filesize
308KB

Download
memory/2664-57-0x0000000000C20000-0x0000000000C6D000-memory.dmp

Filesize
308KB

Download
memory/2664-53-0x0000000000C20000-0x0000000000C6D000-memory.dmp

Filesize
308KB

Download
memory/2664-1076-0x0000000000CF0000-0x0000000000D30000-memory.dmp

Filesize
256KB

Download
memory/2664-1077-0x0000000074D60000-0x000000007544E000-memory.dmp

Filesize
6.9MB

Download
memory/2664-23-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2664-1079-0x0000000000CF0000-0x0000000000D30000-memory.dmp

Filesize
256KB

Download