agenttesla | b8f57ab21e46de7db9ee6c9366251b88b1ba62013154c12bc92c3acbd44058d0

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23/02/2024, 16:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

PO OAU_FEBQTRFA00541·PDF.scr.exe
Size

1022KB
MD5

6b934d2c72027f89729ac4f6fea69b4a
SHA1

9cd343ee1496300792ccab60879fdf528291302c
SHA256

b8f57ab21e46de7db9ee6c9366251b88b1ba62013154c12bc92c3acbd44058d0
SHA512

2a647f55e4ca0d479ede2b2819d3dd5826a94e427831d5c385cc49f4c5823f21bc5528167f393fe831ef334e5a0ba0000cd68e19695a576ad933de8f7a0725c1
SSDEEP

12288:P5Bx4XQ7GpyCv5gIuxM7QCA/QiBf2jlBqd+vZyA5GcXrHvcxFv2wj9L1xN:RBx0IGpyGWzxM41RqLu+wcL0xosL1

Score

10^/10

agenttesla zgrat keylogger rat spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
gator3220.hostgator.com
Port:
587
Username:
[email protected]
Password:
Rich6#3Y$hT!3V
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Detect ZGRat V1 34 IoCs

resource	yara_rule
behavioral1/memory/3056-4-0x0000000005C20000-0x0000000005CD8000-memory.dmp	family_zgrat_v1
behavioral1/memory/3056-5-0x0000000005C20000-0x0000000005CD3000-memory.dmp	family_zgrat_v1
behavioral1/memory/3056-6-0x0000000005C20000-0x0000000005CD3000-memory.dmp	family_zgrat_v1
behavioral1/memory/3056-8-0x0000000005C20000-0x0000000005CD3000-memory.dmp	family_zgrat_v1
behavioral1/memory/3056-10-0x0000000005C20000-0x0000000005CD3000-memory.dmp	family_zgrat_v1
behavioral1/memory/3056-12-0x0000000005C20000-0x0000000005CD3000-memory.dmp	family_zgrat_v1
behavioral1/memory/3056-14-0x0000000005C20000-0x0000000005CD3000-memory.dmp	family_zgrat_v1
behavioral1/memory/3056-16-0x0000000005C20000-0x0000000005CD3000-memory.dmp	family_zgrat_v1
behavioral1/memory/3056-18-0x0000000005C20000-0x0000000005CD3000-memory.dmp	family_zgrat_v1
behavioral1/memory/3056-22-0x0000000005C20000-0x0000000005CD3000-memory.dmp	family_zgrat_v1
behavioral1/memory/3056-20-0x0000000005C20000-0x0000000005CD3000-memory.dmp	family_zgrat_v1
behavioral1/memory/3056-24-0x0000000005C20000-0x0000000005CD3000-memory.dmp	family_zgrat_v1
behavioral1/memory/3056-26-0x0000000005C20000-0x0000000005CD3000-memory.dmp	family_zgrat_v1
behavioral1/memory/3056-32-0x0000000005C20000-0x0000000005CD3000-memory.dmp	family_zgrat_v1
behavioral1/memory/3056-30-0x0000000005C20000-0x0000000005CD3000-memory.dmp	family_zgrat_v1
behavioral1/memory/3056-34-0x0000000005C20000-0x0000000005CD3000-memory.dmp	family_zgrat_v1
behavioral1/memory/3056-28-0x0000000005C20000-0x0000000005CD3000-memory.dmp	family_zgrat_v1
behavioral1/memory/3056-40-0x0000000005C20000-0x0000000005CD3000-memory.dmp	family_zgrat_v1
behavioral1/memory/3056-42-0x0000000005C20000-0x0000000005CD3000-memory.dmp	family_zgrat_v1
behavioral1/memory/3056-38-0x0000000005C20000-0x0000000005CD3000-memory.dmp	family_zgrat_v1
behavioral1/memory/3056-44-0x0000000005C20000-0x0000000005CD3000-memory.dmp	family_zgrat_v1
behavioral1/memory/3056-48-0x0000000005C20000-0x0000000005CD3000-memory.dmp	family_zgrat_v1
behavioral1/memory/3056-46-0x0000000005C20000-0x0000000005CD3000-memory.dmp	family_zgrat_v1
behavioral1/memory/3056-36-0x0000000005C20000-0x0000000005CD3000-memory.dmp	family_zgrat_v1
behavioral1/memory/3056-50-0x0000000005C20000-0x0000000005CD3000-memory.dmp	family_zgrat_v1
behavioral1/memory/3056-68-0x0000000005C20000-0x0000000005CD3000-memory.dmp	family_zgrat_v1
behavioral1/memory/3056-66-0x0000000005C20000-0x0000000005CD3000-memory.dmp	family_zgrat_v1
behavioral1/memory/3056-64-0x0000000005C20000-0x0000000005CD3000-memory.dmp	family_zgrat_v1
behavioral1/memory/3056-62-0x0000000005C20000-0x0000000005CD3000-memory.dmp	family_zgrat_v1
behavioral1/memory/3056-60-0x0000000005C20000-0x0000000005CD3000-memory.dmp	family_zgrat_v1
behavioral1/memory/3056-58-0x0000000005C20000-0x0000000005CD3000-memory.dmp	family_zgrat_v1
behavioral1/memory/3056-56-0x0000000005C20000-0x0000000005CD3000-memory.dmp	family_zgrat_v1
behavioral1/memory/3056-54-0x0000000005C20000-0x0000000005CD3000-memory.dmp	family_zgrat_v1
behavioral1/memory/3056-52-0x0000000005C20000-0x0000000005CD3000-memory.dmp	family_zgrat_v1

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3056 set thread context of 2004	3056	PO OAU_FEBQTRFA00541·PDF.scr.exe	30

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2004	aspnet_compiler.exe
2004	aspnet_compiler.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3056	PO OAU_FEBQTRFA00541·PDF.scr.exe
Token: SeDebugPrivilege	2004	aspnet_compiler.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2004	aspnet_compiler.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3056 wrote to memory of 2004	3056	PO OAU_FEBQTRFA00541·PDF.scr.exe	30
PID 3056 wrote to memory of 2004	3056	PO OAU_FEBQTRFA00541·PDF.scr.exe	30
PID 3056 wrote to memory of 2004	3056	PO OAU_FEBQTRFA00541·PDF.scr.exe	30
PID 3056 wrote to memory of 2004	3056	PO OAU_FEBQTRFA00541·PDF.scr.exe	30
PID 3056 wrote to memory of 2004	3056	PO OAU_FEBQTRFA00541·PDF.scr.exe	30
PID 3056 wrote to memory of 2004	3056	PO OAU_FEBQTRFA00541·PDF.scr.exe	30
PID 3056 wrote to memory of 2004	3056	PO OAU_FEBQTRFA00541·PDF.scr.exe	30
PID 3056 wrote to memory of 2004	3056	PO OAU_FEBQTRFA00541·PDF.scr.exe	30
PID 3056 wrote to memory of 2004	3056	PO OAU_FEBQTRFA00541·PDF.scr.exe	30

C:\Users\Admin\AppData\Local\Temp\PO OAU_FEBQTRFA00541·PDF.scr.exe
"C:\Users\Admin\AppData\Local\Temp\PO OAU_FEBQTRFA00541·PDF.scr.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3056
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2004

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2004-1139-0x00000000744B0000-0x0000000074B9E000-memory.dmp

Filesize
6.9MB

Download
memory/2004-1141-0x0000000004AA0000-0x0000000004AE0000-memory.dmp

Filesize
256KB

Download
memory/2004-1140-0x00000000744B0000-0x0000000074B9E000-memory.dmp

Filesize
6.9MB

Download
memory/2004-1138-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3056-44-0x0000000005C20000-0x0000000005CD3000-memory.dmp

Filesize
716KB

Download
memory/3056-5-0x0000000005C20000-0x0000000005CD3000-memory.dmp

Filesize
716KB

Download
memory/3056-6-0x0000000005C20000-0x0000000005CD3000-memory.dmp

Filesize
716KB

Download
memory/3056-8-0x0000000005C20000-0x0000000005CD3000-memory.dmp

Filesize
716KB

Download
memory/3056-10-0x0000000005C20000-0x0000000005CD3000-memory.dmp

Filesize
716KB

Download
memory/3056-12-0x0000000005C20000-0x0000000005CD3000-memory.dmp

Filesize
716KB

Download
memory/3056-14-0x0000000005C20000-0x0000000005CD3000-memory.dmp

Filesize
716KB

Download
memory/3056-16-0x0000000005C20000-0x0000000005CD3000-memory.dmp

Filesize
716KB

Download
memory/3056-18-0x0000000005C20000-0x0000000005CD3000-memory.dmp

Filesize
716KB

Download
memory/3056-22-0x0000000005C20000-0x0000000005CD3000-memory.dmp

Filesize
716KB

Download
memory/3056-20-0x0000000005C20000-0x0000000005CD3000-memory.dmp

Filesize
716KB

Download
memory/3056-24-0x0000000005C20000-0x0000000005CD3000-memory.dmp

Filesize
716KB

Download
memory/3056-26-0x0000000005C20000-0x0000000005CD3000-memory.dmp

Filesize
716KB

Download
memory/3056-32-0x0000000005C20000-0x0000000005CD3000-memory.dmp

Filesize
716KB

Download
memory/3056-30-0x0000000005C20000-0x0000000005CD3000-memory.dmp

Filesize
716KB

Download
memory/3056-34-0x0000000005C20000-0x0000000005CD3000-memory.dmp

Filesize
716KB

Download
memory/3056-28-0x0000000005C20000-0x0000000005CD3000-memory.dmp

Filesize
716KB

Download
memory/3056-40-0x0000000005C20000-0x0000000005CD3000-memory.dmp

Filesize
716KB

Download
memory/3056-42-0x0000000005C20000-0x0000000005CD3000-memory.dmp

Filesize
716KB

Download
memory/3056-38-0x0000000005C20000-0x0000000005CD3000-memory.dmp

Filesize
716KB

Download
memory/3056-46-0x0000000005C20000-0x0000000005CD3000-memory.dmp

Filesize
716KB

Download
memory/3056-0-0x0000000000EB0000-0x0000000000FB2000-memory.dmp

Filesize
1.0MB

Download
memory/3056-48-0x0000000005C20000-0x0000000005CD3000-memory.dmp

Filesize
716KB

Download
memory/3056-36-0x0000000005C20000-0x0000000005CD3000-memory.dmp

Filesize
716KB

Download
memory/3056-50-0x0000000005C20000-0x0000000005CD3000-memory.dmp

Filesize
716KB

Download
memory/3056-68-0x0000000005C20000-0x0000000005CD3000-memory.dmp

Filesize
716KB

Download
memory/3056-66-0x0000000005C20000-0x0000000005CD3000-memory.dmp

Filesize
716KB

Download
memory/3056-64-0x0000000005C20000-0x0000000005CD3000-memory.dmp

Filesize
716KB

Download
memory/3056-62-0x0000000005C20000-0x0000000005CD3000-memory.dmp

Filesize
716KB

Download
memory/3056-60-0x0000000005C20000-0x0000000005CD3000-memory.dmp

Filesize
716KB

Download
memory/3056-58-0x0000000005C20000-0x0000000005CD3000-memory.dmp

Filesize
716KB

Download
memory/3056-56-0x0000000005C20000-0x0000000005CD3000-memory.dmp

Filesize
716KB

Download
memory/3056-54-0x0000000005C20000-0x0000000005CD3000-memory.dmp

Filesize
716KB

Download
memory/3056-52-0x0000000005C20000-0x0000000005CD3000-memory.dmp

Filesize
716KB

Download
memory/3056-1119-0x0000000000970000-0x0000000000971000-memory.dmp

Filesize
4KB

Download
memory/3056-1120-0x0000000000B30000-0x0000000000B72000-memory.dmp

Filesize
264KB

Download
memory/3056-1121-0x0000000004400000-0x000000000444C000-memory.dmp

Filesize
304KB

Download
memory/3056-1122-0x0000000074BA0000-0x000000007528E000-memory.dmp

Filesize
6.9MB

Download
memory/3056-1123-0x0000000000D70000-0x0000000000DB0000-memory.dmp

Filesize
256KB

Download
memory/3056-1134-0x0000000074BA0000-0x000000007528E000-memory.dmp

Filesize
6.9MB

Download
memory/3056-4-0x0000000005C20000-0x0000000005CD8000-memory.dmp

Filesize
736KB

Download
memory/3056-3-0x0000000005750000-0x0000000005808000-memory.dmp

Filesize
736KB

Download
memory/3056-2-0x0000000000D70000-0x0000000000DB0000-memory.dmp

Filesize
256KB

Download
memory/3056-1-0x0000000074BA0000-0x000000007528E000-memory.dmp

Filesize
6.9MB

Download