Resubmissions
14/01/2025, 09:11
250114-k5qwmatndx29/02/2024, 21:21
240229-z7ptnsch3w23/02/2024, 03:45
240223-ea6qpsaf9t1023/02/2024, 02:03
240223-cg4htahg5x10Analysis
- max time kernel
118s - max time network
143s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
- submitted
23/02/2024, 03:45
General
- Target e5b92c64269cc60d8db665c2a71cf0b7c917bb0585d833324f6e8c3a1d22025a.exe
- Size 1.3MB
- Sample240223-ea6qpsaf9t
- SHA256 e5b92c64269cc60d8db665c2a71cf0b7c917bb0585d833324f6e8c3a1d22025a
Malware Config
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Detect ZGRat V1 33 IoCs
- ZGRat
ZGRat is remote access trojan written in C#.
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e5b92c64269cc60d8db665c2a71cf0b7c917bb0585d833324f6e8c3a1d22025a.exe"C:\Users\Admin\AppData\Local\Temp\e5b92c64269cc60d8db665c2a71cf0b7c917bb0585d833324f6e8c3a1d22025a.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\e5b92c64269cc60d8db665c2a71cf0b7c917bb0585d833324f6e8c3a1d22025a.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2264-10-0x00000000001D0000-0x00000000001D4000-memory.dmp
memory/2972-11-0x0000000000400000-0x0000000000446000-memory.dmp
memory/2972-13-0x0000000000400000-0x0000000000446000-memory.dmp
memory/2972-14-0x0000000000400000-0x0000000000446000-memory.dmp
memory/2972-15-0x0000000074A90000-0x000000007517E000-memory.dmp
memory/2972-16-0x0000000004A60000-0x0000000004AA0000-memory.dmp
memory/2972-17-0x0000000000370000-0x00000000003C6000-memory.dmp
memory/2972-18-0x0000000004A60000-0x0000000004AA0000-memory.dmp
memory/2972-19-0x0000000004A60000-0x0000000004AA0000-memory.dmp
memory/2972-20-0x0000000000450000-0x00000000004A4000-memory.dmp
memory/2972-21-0x0000000000450000-0x000000000049E000-memory.dmp
memory/2972-22-0x0000000000450000-0x000000000049E000-memory.dmp
memory/2972-24-0x0000000000450000-0x000000000049E000-memory.dmp
memory/2972-26-0x0000000000450000-0x000000000049E000-memory.dmp
memory/2972-28-0x0000000000450000-0x000000000049E000-memory.dmp
memory/2972-30-0x0000000000450000-0x000000000049E000-memory.dmp
memory/2972-32-0x0000000000450000-0x000000000049E000-memory.dmp
memory/2972-34-0x0000000000450000-0x000000000049E000-memory.dmp
memory/2972-36-0x0000000000450000-0x000000000049E000-memory.dmp
memory/2972-38-0x0000000000450000-0x000000000049E000-memory.dmp
memory/2972-40-0x0000000000450000-0x000000000049E000-memory.dmp
memory/2972-42-0x0000000000450000-0x000000000049E000-memory.dmp
memory/2972-44-0x0000000000450000-0x000000000049E000-memory.dmp
memory/2972-46-0x0000000000450000-0x000000000049E000-memory.dmp
memory/2972-48-0x0000000000450000-0x000000000049E000-memory.dmp
memory/2972-50-0x0000000000450000-0x000000000049E000-memory.dmp
memory/2972-52-0x0000000000450000-0x000000000049E000-memory.dmp
memory/2972-54-0x0000000000450000-0x000000000049E000-memory.dmp
memory/2972-56-0x0000000000450000-0x000000000049E000-memory.dmp
memory/2972-58-0x0000000000450000-0x000000000049E000-memory.dmp
memory/2972-60-0x0000000000450000-0x000000000049E000-memory.dmp
memory/2972-62-0x0000000000450000-0x000000000049E000-memory.dmp
memory/2972-64-0x0000000000450000-0x000000000049E000-memory.dmp
memory/2972-66-0x0000000000450000-0x000000000049E000-memory.dmp
memory/2972-68-0x0000000000450000-0x000000000049E000-memory.dmp
memory/2972-70-0x0000000000450000-0x000000000049E000-memory.dmp
memory/2972-72-0x0000000000450000-0x000000000049E000-memory.dmp
memory/2972-74-0x0000000000450000-0x000000000049E000-memory.dmp
memory/2972-76-0x0000000000450000-0x000000000049E000-memory.dmp
memory/2972-78-0x0000000000450000-0x000000000049E000-memory.dmp
memory/2972-80-0x0000000000450000-0x000000000049E000-memory.dmp
memory/2972-1065-0x0000000004A60000-0x0000000004AA0000-memory.dmp
memory/2972-1066-0x0000000000400000-0x0000000000446000-memory.dmp
memory/2972-1067-0x0000000074A90000-0x000000007517E000-memory.dmp
memory/2972-1068-0x0000000004A60000-0x0000000004AA0000-memory.dmp
memory/2972-1069-0x0000000004A60000-0x0000000004AA0000-memory.dmp
memory/2972-1070-0x0000000004A60000-0x0000000004AA0000-memory.dmp
memory/2972-1071-0x0000000004A60000-0x0000000004AA0000-memory.dmp