agenttesla | f47bce72ab3bf00ed2e03ee969d14d489152d51a9423af396fcfebf3f1a48a0e

Analysis

max time kernel
141s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06/03/2024, 02:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f47bce72ab3bf00ed2e03ee969d14d489152d51a9423af396fcfebf3f1a48a0e.exe
Size

1.1MB
MD5

5e063ea45ed2c6114831f8ce6ceaf6f8
SHA1

84fdf1c9194a091d74b12e4ec1e5f1b3e95b40d3
SHA256

f47bce72ab3bf00ed2e03ee969d14d489152d51a9423af396fcfebf3f1a48a0e
SHA512

be2aedf5d0c29498606b08fc271a400fed3929e7f0752dacf55e1d0e1fac940b4a5930ea2186a1046c758c48434d292eeb31078870faee8201ef8902a593db1b
SSDEEP

24576:6tb20pkaCqT5TBWgNQ7aeZaCphr4g0b5QP6A:nVg5tQ7aeZDLMg15

Score

10^/10

agenttesla zgrat keylogger rat spyware stealer trojan

Malware Config

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Detect ZGRat V1 33 IoCs

resource	yara_rule
behavioral2/memory/2240-15-0x0000000003180000-0x00000000031D4000-memory.dmp	family_zgrat_v1
behavioral2/memory/2240-21-0x00000000056B0000-0x0000000005702000-memory.dmp	family_zgrat_v1
behavioral2/memory/2240-22-0x00000000056B0000-0x00000000056FD000-memory.dmp	family_zgrat_v1
behavioral2/memory/2240-23-0x00000000056B0000-0x00000000056FD000-memory.dmp	family_zgrat_v1
behavioral2/memory/2240-25-0x00000000056B0000-0x00000000056FD000-memory.dmp	family_zgrat_v1
behavioral2/memory/2240-27-0x00000000056B0000-0x00000000056FD000-memory.dmp	family_zgrat_v1
behavioral2/memory/2240-29-0x00000000056B0000-0x00000000056FD000-memory.dmp	family_zgrat_v1
behavioral2/memory/2240-31-0x00000000056B0000-0x00000000056FD000-memory.dmp	family_zgrat_v1
behavioral2/memory/2240-33-0x00000000056B0000-0x00000000056FD000-memory.dmp	family_zgrat_v1
behavioral2/memory/2240-35-0x00000000056B0000-0x00000000056FD000-memory.dmp	family_zgrat_v1
behavioral2/memory/2240-37-0x00000000056B0000-0x00000000056FD000-memory.dmp	family_zgrat_v1
behavioral2/memory/2240-39-0x00000000056B0000-0x00000000056FD000-memory.dmp	family_zgrat_v1
behavioral2/memory/2240-41-0x00000000056B0000-0x00000000056FD000-memory.dmp	family_zgrat_v1
behavioral2/memory/2240-43-0x00000000056B0000-0x00000000056FD000-memory.dmp	family_zgrat_v1
behavioral2/memory/2240-45-0x00000000056B0000-0x00000000056FD000-memory.dmp	family_zgrat_v1
behavioral2/memory/2240-47-0x00000000056B0000-0x00000000056FD000-memory.dmp	family_zgrat_v1
behavioral2/memory/2240-49-0x00000000056B0000-0x00000000056FD000-memory.dmp	family_zgrat_v1
behavioral2/memory/2240-51-0x00000000056B0000-0x00000000056FD000-memory.dmp	family_zgrat_v1
behavioral2/memory/2240-53-0x00000000056B0000-0x00000000056FD000-memory.dmp	family_zgrat_v1
behavioral2/memory/2240-55-0x00000000056B0000-0x00000000056FD000-memory.dmp	family_zgrat_v1
behavioral2/memory/2240-57-0x00000000056B0000-0x00000000056FD000-memory.dmp	family_zgrat_v1
behavioral2/memory/2240-59-0x00000000056B0000-0x00000000056FD000-memory.dmp	family_zgrat_v1
behavioral2/memory/2240-61-0x00000000056B0000-0x00000000056FD000-memory.dmp	family_zgrat_v1
behavioral2/memory/2240-63-0x00000000056B0000-0x00000000056FD000-memory.dmp	family_zgrat_v1
behavioral2/memory/2240-65-0x00000000056B0000-0x00000000056FD000-memory.dmp	family_zgrat_v1
behavioral2/memory/2240-67-0x00000000056B0000-0x00000000056FD000-memory.dmp	family_zgrat_v1
behavioral2/memory/2240-69-0x00000000056B0000-0x00000000056FD000-memory.dmp	family_zgrat_v1
behavioral2/memory/2240-71-0x00000000056B0000-0x00000000056FD000-memory.dmp	family_zgrat_v1
behavioral2/memory/2240-73-0x00000000056B0000-0x00000000056FD000-memory.dmp	family_zgrat_v1
behavioral2/memory/2240-75-0x00000000056B0000-0x00000000056FD000-memory.dmp	family_zgrat_v1
behavioral2/memory/2240-81-0x00000000056B0000-0x00000000056FD000-memory.dmp	family_zgrat_v1
behavioral2/memory/2240-79-0x00000000056B0000-0x00000000056FD000-memory.dmp	family_zgrat_v1
behavioral2/memory/2240-77-0x00000000056B0000-0x00000000056FD000-memory.dmp	family_zgrat_v1

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4360 set thread context of 2240	4360	f47bce72ab3bf00ed2e03ee969d14d489152d51a9423af396fcfebf3f1a48a0e.exe	91

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2240	RegSvcs.exe
2240	RegSvcs.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4360	f47bce72ab3bf00ed2e03ee969d14d489152d51a9423af396fcfebf3f1a48a0e.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2240	RegSvcs.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4360	f47bce72ab3bf00ed2e03ee969d14d489152d51a9423af396fcfebf3f1a48a0e.exe
4360	f47bce72ab3bf00ed2e03ee969d14d489152d51a9423af396fcfebf3f1a48a0e.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
4360	f47bce72ab3bf00ed2e03ee969d14d489152d51a9423af396fcfebf3f1a48a0e.exe
4360	f47bce72ab3bf00ed2e03ee969d14d489152d51a9423af396fcfebf3f1a48a0e.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4360 wrote to memory of 2240	4360	f47bce72ab3bf00ed2e03ee969d14d489152d51a9423af396fcfebf3f1a48a0e.exe	91
PID 4360 wrote to memory of 2240	4360	f47bce72ab3bf00ed2e03ee969d14d489152d51a9423af396fcfebf3f1a48a0e.exe	91
PID 4360 wrote to memory of 2240	4360	f47bce72ab3bf00ed2e03ee969d14d489152d51a9423af396fcfebf3f1a48a0e.exe	91
PID 4360 wrote to memory of 2240	4360	f47bce72ab3bf00ed2e03ee969d14d489152d51a9423af396fcfebf3f1a48a0e.exe	91

C:\Users\Admin\AppData\Local\Temp\f47bce72ab3bf00ed2e03ee969d14d489152d51a9423af396fcfebf3f1a48a0e.exe
"C:\Users\Admin\AppData\Local\Temp\f47bce72ab3bf00ed2e03ee969d14d489152d51a9423af396fcfebf3f1a48a0e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4360
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Users\Admin\AppData\Local\Temp\f47bce72ab3bf00ed2e03ee969d14d489152d51a9423af396fcfebf3f1a48a0e.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2240

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2240-11-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2240-12-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2240-13-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2240-14-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2240-15-0x0000000003180000-0x00000000031D4000-memory.dmp

Filesize
336KB

Download
memory/2240-16-0x0000000073D70000-0x0000000074520000-memory.dmp

Filesize
7.7MB

Download
memory/2240-17-0x0000000005710000-0x0000000005720000-memory.dmp

Filesize
64KB

Download
memory/2240-18-0x0000000005710000-0x0000000005720000-memory.dmp

Filesize
64KB

Download
memory/2240-19-0x0000000005710000-0x0000000005720000-memory.dmp

Filesize
64KB

Download
memory/2240-20-0x0000000005CD0000-0x0000000006274000-memory.dmp

Filesize
5.6MB

Download
memory/2240-21-0x00000000056B0000-0x0000000005702000-memory.dmp

Filesize
328KB

Download
memory/2240-22-0x00000000056B0000-0x00000000056FD000-memory.dmp

Filesize
308KB

Download
memory/2240-23-0x00000000056B0000-0x00000000056FD000-memory.dmp

Filesize
308KB

Download
memory/2240-25-0x00000000056B0000-0x00000000056FD000-memory.dmp

Filesize
308KB

Download
memory/2240-27-0x00000000056B0000-0x00000000056FD000-memory.dmp

Filesize
308KB

Download
memory/2240-29-0x00000000056B0000-0x00000000056FD000-memory.dmp

Filesize
308KB

Download
memory/2240-31-0x00000000056B0000-0x00000000056FD000-memory.dmp

Filesize
308KB

Download
memory/2240-33-0x00000000056B0000-0x00000000056FD000-memory.dmp

Filesize
308KB

Download
memory/2240-35-0x00000000056B0000-0x00000000056FD000-memory.dmp

Filesize
308KB

Download
memory/2240-37-0x00000000056B0000-0x00000000056FD000-memory.dmp

Filesize
308KB

Download
memory/2240-39-0x00000000056B0000-0x00000000056FD000-memory.dmp

Filesize
308KB

Download
memory/2240-41-0x00000000056B0000-0x00000000056FD000-memory.dmp

Filesize
308KB

Download
memory/2240-43-0x00000000056B0000-0x00000000056FD000-memory.dmp

Filesize
308KB

Download
memory/2240-45-0x00000000056B0000-0x00000000056FD000-memory.dmp

Filesize
308KB

Download
memory/2240-47-0x00000000056B0000-0x00000000056FD000-memory.dmp

Filesize
308KB

Download
memory/2240-49-0x00000000056B0000-0x00000000056FD000-memory.dmp

Filesize
308KB

Download
memory/2240-51-0x00000000056B0000-0x00000000056FD000-memory.dmp

Filesize
308KB

Download
memory/2240-53-0x00000000056B0000-0x00000000056FD000-memory.dmp

Filesize
308KB

Download
memory/2240-55-0x00000000056B0000-0x00000000056FD000-memory.dmp

Filesize
308KB

Download
memory/2240-57-0x00000000056B0000-0x00000000056FD000-memory.dmp

Filesize
308KB

Download
memory/2240-59-0x00000000056B0000-0x00000000056FD000-memory.dmp

Filesize
308KB

Download
memory/2240-61-0x00000000056B0000-0x00000000056FD000-memory.dmp

Filesize
308KB

Download
memory/2240-63-0x00000000056B0000-0x00000000056FD000-memory.dmp

Filesize
308KB

Download
memory/2240-65-0x00000000056B0000-0x00000000056FD000-memory.dmp

Filesize
308KB

Download
memory/2240-67-0x00000000056B0000-0x00000000056FD000-memory.dmp

Filesize
308KB

Download
memory/2240-69-0x00000000056B0000-0x00000000056FD000-memory.dmp

Filesize
308KB

Download
memory/2240-71-0x00000000056B0000-0x00000000056FD000-memory.dmp

Filesize
308KB

Download
memory/2240-73-0x00000000056B0000-0x00000000056FD000-memory.dmp

Filesize
308KB

Download
memory/2240-75-0x00000000056B0000-0x00000000056FD000-memory.dmp

Filesize
308KB

Download
memory/2240-81-0x00000000056B0000-0x00000000056FD000-memory.dmp

Filesize
308KB

Download
memory/2240-79-0x00000000056B0000-0x00000000056FD000-memory.dmp

Filesize
308KB

Download
memory/2240-77-0x00000000056B0000-0x00000000056FD000-memory.dmp

Filesize
308KB

Download
memory/2240-1052-0x0000000005710000-0x0000000005720000-memory.dmp

Filesize
64KB

Download
memory/2240-1053-0x00000000058B0000-0x0000000005916000-memory.dmp

Filesize
408KB

Download
memory/2240-1054-0x00000000066D0000-0x0000000006720000-memory.dmp

Filesize
320KB

Download
memory/2240-1055-0x00000000067C0000-0x0000000006852000-memory.dmp

Filesize
584KB

Download
memory/2240-1056-0x0000000006720000-0x000000000672A000-memory.dmp

Filesize
40KB

Download
memory/2240-1057-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2240-1058-0x0000000073D70000-0x0000000074520000-memory.dmp

Filesize
7.7MB

Download
memory/2240-1059-0x0000000005710000-0x0000000005720000-memory.dmp

Filesize
64KB

Download
memory/2240-1060-0x0000000005710000-0x0000000005720000-memory.dmp

Filesize
64KB

Download
memory/2240-1061-0x0000000005710000-0x0000000005720000-memory.dmp

Filesize
64KB

Download
memory/4360-10-0x0000000001150000-0x0000000001154000-memory.dmp

Filesize
16KB

Download