Analysis
-
max time kernel
139s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
07/03/2024, 01:54
General
-
Target
685ea46f448792ad490d22318acc975eb821482c073efe014fbad080368af92a.exe
-
Size
1.1MB
-
MD5
6e9eb572dbfcdf82d929c22f13e08ec5
-
SHA1
915277ab9420dc23b43023f746e114de34cf4f5d
-
SHA256
685ea46f448792ad490d22318acc975eb821482c073efe014fbad080368af92a
-
SHA512
ffcf1f01c2a939737125945e548e9888c12c463d8bdb4e2c03ab4183f4f4ea9b1f82ac30e8b249b8edad1e11312ca3176b8a826ea28a71041564316c9301401c
-
SSDEEP
24576:Gtb20pkaCqT5TBWgNQ7alanaxambqQdSs16A:zVg5tQ7alnxa8dH5
Malware Config
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Detect ZGRat V1 33 IoCs
-
ZGRat
ZGRat is remote access trojan written in C#.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\685ea46f448792ad490d22318acc975eb821482c073efe014fbad080368af92a.exe"C:\Users\Admin\AppData\Local\Temp\685ea46f448792ad490d22318acc975eb821482c073efe014fbad080368af92a.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\685ea46f448792ad490d22318acc975eb821482c073efe014fbad080368af92a.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
261KB
MD5d23ff1be3fc4ad3b9c4c6d8a56baa259
SHA1c50d308db36ca4e9d114471f91af64712c9e7536
SHA2566f5126a9b905da6c0ede6c21a3765807f148c9b05da2076126a18e88cc743ccc
SHA5127c0931fccd2249f6349edacddde73e671d3b50fccd0e90560462e657e0bb9781931e2a71bb3f7b860d6ae4af1f6915c28a679c9de7226b139e48a4817f002016
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
336KB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
5.6MB
-
Filesize
328KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
64KB
-
Filesize
408KB
-
Filesize
320KB
-
Filesize
584KB
-
Filesize
40KB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
16KB