agenttesla | 685ea46f448792ad490d22318acc975eb821482c073efe014fbad080368af92a

General

Target

685ea46f448792ad490d22318acc975eb821482c073efe014fbad080368af92a.exe
Size

1.1MB
MD5

6e9eb572dbfcdf82d929c22f13e08ec5
SHA1

915277ab9420dc23b43023f746e114de34cf4f5d
SHA256

685ea46f448792ad490d22318acc975eb821482c073efe014fbad080368af92a
SHA512

ffcf1f01c2a939737125945e548e9888c12c463d8bdb4e2c03ab4183f4f4ea9b1f82ac30e8b249b8edad1e11312ca3176b8a826ea28a71041564316c9301401c
SSDEEP

24576:Gtb20pkaCqT5TBWgNQ7alanaxambqQdSs16A:zVg5tQ7alnxa8dH5

Score

10^/10

agenttesla zgrat keylogger rat spyware stealer trojan

Malware Config

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Detect ZGRat V1 6 IoCs

resource	yara_rule
behavioral1/memory/2532-16-0x0000000000450000-0x00000000004A4000-memory.dmp	family_zgrat_v1
behavioral1/memory/2532-20-0x0000000002050000-0x00000000020A2000-memory.dmp	family_zgrat_v1
behavioral1/memory/2532-21-0x0000000002050000-0x000000000209D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2532-22-0x0000000002050000-0x000000000209D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2532-24-0x0000000002050000-0x000000000209D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2532-26-0x0000000002050000-0x000000000209D000-memory.dmp	family_zgrat_v1

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1740 set thread context of 2532	1740	685ea46f448792ad490d22318acc975eb821482c073efe014fbad080368af92a.exe	28

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1740	685ea46f448792ad490d22318acc975eb821482c073efe014fbad080368af92a.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2532	RegSvcs.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1740	685ea46f448792ad490d22318acc975eb821482c073efe014fbad080368af92a.exe
1740	685ea46f448792ad490d22318acc975eb821482c073efe014fbad080368af92a.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1740	685ea46f448792ad490d22318acc975eb821482c073efe014fbad080368af92a.exe
1740	685ea46f448792ad490d22318acc975eb821482c073efe014fbad080368af92a.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1740 wrote to memory of 2532	1740	685ea46f448792ad490d22318acc975eb821482c073efe014fbad080368af92a.exe	28
PID 1740 wrote to memory of 2532	1740	685ea46f448792ad490d22318acc975eb821482c073efe014fbad080368af92a.exe	28
PID 1740 wrote to memory of 2532	1740	685ea46f448792ad490d22318acc975eb821482c073efe014fbad080368af92a.exe	28
PID 1740 wrote to memory of 2532	1740	685ea46f448792ad490d22318acc975eb821482c073efe014fbad080368af92a.exe	28
PID 1740 wrote to memory of 2532	1740	685ea46f448792ad490d22318acc975eb821482c073efe014fbad080368af92a.exe	28
PID 1740 wrote to memory of 2532	1740	685ea46f448792ad490d22318acc975eb821482c073efe014fbad080368af92a.exe	28
PID 1740 wrote to memory of 2532	1740	685ea46f448792ad490d22318acc975eb821482c073efe014fbad080368af92a.exe	28
PID 1740 wrote to memory of 2532	1740	685ea46f448792ad490d22318acc975eb821482c073efe014fbad080368af92a.exe	28

C:\Users\Admin\AppData\Local\Temp\685ea46f448792ad490d22318acc975eb821482c073efe014fbad080368af92a.exe
"C:\Users\Admin\AppData\Local\Temp\685ea46f448792ad490d22318acc975eb821482c073efe014fbad080368af92a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1740
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Users\Admin\AppData\Local\Temp\685ea46f448792ad490d22318acc975eb821482c073efe014fbad080368af92a.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2532

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\caulds

Filesize
261KB

MD5
d23ff1be3fc4ad3b9c4c6d8a56baa259

SHA1
c50d308db36ca4e9d114471f91af64712c9e7536

SHA256
6f5126a9b905da6c0ede6c21a3765807f148c9b05da2076126a18e88cc743ccc

SHA512
7c0931fccd2249f6349edacddde73e671d3b50fccd0e90560462e657e0bb9781931e2a71bb3f7b860d6ae4af1f6915c28a679c9de7226b139e48a4817f002016

Download Submit
memory/1740-11-0x0000000000100000-0x0000000000104000-memory.dmp

Filesize
16KB

Download
memory/2532-12-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2532-14-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2532-15-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2532-17-0x0000000074A90000-0x000000007517E000-memory.dmp

Filesize
6.9MB

Download
memory/2532-16-0x0000000000450000-0x00000000004A4000-memory.dmp

Filesize
336KB

Download
memory/2532-18-0x0000000004AA0000-0x0000000004AE0000-memory.dmp

Filesize
256KB

Download
memory/2532-19-0x0000000004AA0000-0x0000000004AE0000-memory.dmp

Filesize
256KB

Download
memory/2532-20-0x0000000002050000-0x00000000020A2000-memory.dmp

Filesize
328KB

Download
memory/2532-21-0x0000000002050000-0x000000000209D000-memory.dmp

Filesize
308KB

Download
memory/2532-22-0x0000000002050000-0x000000000209D000-memory.dmp

Filesize
308KB

Download
memory/2532-24-0x0000000002050000-0x000000000209D000-memory.dmp

Filesize
308KB

Download
memory/2532-26-0x0000000002050000-0x000000000209D000-memory.dmp

Filesize
308KB

Download
memory/2532-28-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2532-29-0x0000000074A90000-0x000000007517E000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing