agenttesla | 83c0f4886beef85f2c2c9d97a4491330e6c3f9ed7a5b088965fe5eb367cbf8b2

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08-03-2024 01:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

83c0f4886beef85f2c2c9d97a4491330e6c3f9ed7a5b088965fe5eb367cbf8b2.exe
Size

1011KB
MD5

cf1cccbdf2580bc20a5d6c7a8e2f047d
SHA1

2e5cce88fe062e33993daa5cd23856aae93ba7bf
SHA256

83c0f4886beef85f2c2c9d97a4491330e6c3f9ed7a5b088965fe5eb367cbf8b2
SHA512

e2ce8fd1f1747faa596b18923e41740d32ca96e91e759822bd4050c3222b8f872836120843ade96192ee3efb9f5d18bef7f9a4f7e89800815da22ccf01fe98f3
SSDEEP

24576:mB+ghm5v+KjVvuniHXR4ufQ/rEPNKLmaYEPrZaMR8bR:o+r5unE4tTE1ZaYXM

Score

10^/10

agenttesla zgrat keylogger rat spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
gator3220.hostgator.com
Port:
587
Username:
[email protected]
Password:
VvMMgD#w!TZmaka!@
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Detect ZGRat V1 34 IoCs

resource	yara_rule
behavioral1/memory/2756-4-0x0000000004740000-0x00000000047FA000-memory.dmp	family_zgrat_v1
behavioral1/memory/2756-5-0x0000000004740000-0x00000000047F4000-memory.dmp	family_zgrat_v1
behavioral1/memory/2756-6-0x0000000004740000-0x00000000047F4000-memory.dmp	family_zgrat_v1
behavioral1/memory/2756-8-0x0000000004740000-0x00000000047F4000-memory.dmp	family_zgrat_v1
behavioral1/memory/2756-10-0x0000000004740000-0x00000000047F4000-memory.dmp	family_zgrat_v1
behavioral1/memory/2756-12-0x0000000004740000-0x00000000047F4000-memory.dmp	family_zgrat_v1
behavioral1/memory/2756-14-0x0000000004740000-0x00000000047F4000-memory.dmp	family_zgrat_v1
behavioral1/memory/2756-16-0x0000000004740000-0x00000000047F4000-memory.dmp	family_zgrat_v1
behavioral1/memory/2756-18-0x0000000004740000-0x00000000047F4000-memory.dmp	family_zgrat_v1
behavioral1/memory/2756-22-0x0000000004740000-0x00000000047F4000-memory.dmp	family_zgrat_v1
behavioral1/memory/2756-20-0x0000000004740000-0x00000000047F4000-memory.dmp	family_zgrat_v1
behavioral1/memory/2756-24-0x0000000004740000-0x00000000047F4000-memory.dmp	family_zgrat_v1
behavioral1/memory/2756-26-0x0000000004740000-0x00000000047F4000-memory.dmp	family_zgrat_v1
behavioral1/memory/2756-28-0x0000000004740000-0x00000000047F4000-memory.dmp	family_zgrat_v1
behavioral1/memory/2756-30-0x0000000004740000-0x00000000047F4000-memory.dmp	family_zgrat_v1
behavioral1/memory/2756-32-0x0000000004740000-0x00000000047F4000-memory.dmp	family_zgrat_v1
behavioral1/memory/2756-34-0x0000000004740000-0x00000000047F4000-memory.dmp	family_zgrat_v1
behavioral1/memory/2756-36-0x0000000004740000-0x00000000047F4000-memory.dmp	family_zgrat_v1
behavioral1/memory/2756-38-0x0000000004740000-0x00000000047F4000-memory.dmp	family_zgrat_v1
behavioral1/memory/2756-40-0x0000000004740000-0x00000000047F4000-memory.dmp	family_zgrat_v1
behavioral1/memory/2756-44-0x0000000004740000-0x00000000047F4000-memory.dmp	family_zgrat_v1
behavioral1/memory/2756-42-0x0000000004740000-0x00000000047F4000-memory.dmp	family_zgrat_v1
behavioral1/memory/2756-46-0x0000000004740000-0x00000000047F4000-memory.dmp	family_zgrat_v1
behavioral1/memory/2756-48-0x0000000004740000-0x00000000047F4000-memory.dmp	family_zgrat_v1
behavioral1/memory/2756-50-0x0000000004740000-0x00000000047F4000-memory.dmp	family_zgrat_v1
behavioral1/memory/2756-54-0x0000000004740000-0x00000000047F4000-memory.dmp	family_zgrat_v1
behavioral1/memory/2756-52-0x0000000004740000-0x00000000047F4000-memory.dmp	family_zgrat_v1
behavioral1/memory/2756-56-0x0000000004740000-0x00000000047F4000-memory.dmp	family_zgrat_v1
behavioral1/memory/2756-58-0x0000000004740000-0x00000000047F4000-memory.dmp	family_zgrat_v1
behavioral1/memory/2756-60-0x0000000004740000-0x00000000047F4000-memory.dmp	family_zgrat_v1
behavioral1/memory/2756-62-0x0000000004740000-0x00000000047F4000-memory.dmp	family_zgrat_v1
behavioral1/memory/2756-66-0x0000000004740000-0x00000000047F4000-memory.dmp	family_zgrat_v1
behavioral1/memory/2756-68-0x0000000004740000-0x00000000047F4000-memory.dmp	family_zgrat_v1
behavioral1/memory/2756-64-0x0000000004740000-0x00000000047F4000-memory.dmp	family_zgrat_v1

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	ip-api.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2756 set thread context of 2536	2756	83c0f4886beef85f2c2c9d97a4491330e6c3f9ed7a5b088965fe5eb367cbf8b2.exe	30

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2536	AppLaunch.exe
2536	AppLaunch.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2756	83c0f4886beef85f2c2c9d97a4491330e6c3f9ed7a5b088965fe5eb367cbf8b2.exe
Token: SeDebugPrivilege	2536	AppLaunch.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2536	AppLaunch.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2756 wrote to memory of 2536	2756	83c0f4886beef85f2c2c9d97a4491330e6c3f9ed7a5b088965fe5eb367cbf8b2.exe	30
PID 2756 wrote to memory of 2536	2756	83c0f4886beef85f2c2c9d97a4491330e6c3f9ed7a5b088965fe5eb367cbf8b2.exe	30
PID 2756 wrote to memory of 2536	2756	83c0f4886beef85f2c2c9d97a4491330e6c3f9ed7a5b088965fe5eb367cbf8b2.exe	30
PID 2756 wrote to memory of 2536	2756	83c0f4886beef85f2c2c9d97a4491330e6c3f9ed7a5b088965fe5eb367cbf8b2.exe	30
PID 2756 wrote to memory of 2536	2756	83c0f4886beef85f2c2c9d97a4491330e6c3f9ed7a5b088965fe5eb367cbf8b2.exe	30
PID 2756 wrote to memory of 2536	2756	83c0f4886beef85f2c2c9d97a4491330e6c3f9ed7a5b088965fe5eb367cbf8b2.exe	30
PID 2756 wrote to memory of 2536	2756	83c0f4886beef85f2c2c9d97a4491330e6c3f9ed7a5b088965fe5eb367cbf8b2.exe	30
PID 2756 wrote to memory of 2536	2756	83c0f4886beef85f2c2c9d97a4491330e6c3f9ed7a5b088965fe5eb367cbf8b2.exe	30
PID 2756 wrote to memory of 2536	2756	83c0f4886beef85f2c2c9d97a4491330e6c3f9ed7a5b088965fe5eb367cbf8b2.exe	30
PID 2756 wrote to memory of 2536	2756	83c0f4886beef85f2c2c9d97a4491330e6c3f9ed7a5b088965fe5eb367cbf8b2.exe	30
PID 2756 wrote to memory of 2536	2756	83c0f4886beef85f2c2c9d97a4491330e6c3f9ed7a5b088965fe5eb367cbf8b2.exe	30
PID 2756 wrote to memory of 2536	2756	83c0f4886beef85f2c2c9d97a4491330e6c3f9ed7a5b088965fe5eb367cbf8b2.exe	30

C:\Users\Admin\AppData\Local\Temp\83c0f4886beef85f2c2c9d97a4491330e6c3f9ed7a5b088965fe5eb367cbf8b2.exe
"C:\Users\Admin\AppData\Local\Temp\83c0f4886beef85f2c2c9d97a4491330e6c3f9ed7a5b088965fe5eb367cbf8b2.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2756
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2536

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2536-1138-0x00000000749C0000-0x00000000750AE000-memory.dmp

Filesize
6.9MB

Download
memory/2536-1141-0x0000000000E80000-0x0000000000EC0000-memory.dmp

Filesize
256KB

Download
memory/2536-1140-0x00000000749C0000-0x00000000750AE000-memory.dmp

Filesize
6.9MB

Download
memory/2536-1139-0x0000000000E80000-0x0000000000EC0000-memory.dmp

Filesize
256KB

Download
memory/2536-1137-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2756-44-0x0000000004740000-0x00000000047F4000-memory.dmp

Filesize
720KB

Download
memory/2756-10-0x0000000004740000-0x00000000047F4000-memory.dmp

Filesize
720KB

Download
memory/2756-8-0x0000000004740000-0x00000000047F4000-memory.dmp

Filesize
720KB

Download
memory/2756-46-0x0000000004740000-0x00000000047F4000-memory.dmp

Filesize
720KB

Download
memory/2756-12-0x0000000004740000-0x00000000047F4000-memory.dmp

Filesize
720KB

Download
memory/2756-14-0x0000000004740000-0x00000000047F4000-memory.dmp

Filesize
720KB

Download
memory/2756-16-0x0000000004740000-0x00000000047F4000-memory.dmp

Filesize
720KB

Download
memory/2756-18-0x0000000004740000-0x00000000047F4000-memory.dmp

Filesize
720KB

Download
memory/2756-22-0x0000000004740000-0x00000000047F4000-memory.dmp

Filesize
720KB

Download
memory/2756-20-0x0000000004740000-0x00000000047F4000-memory.dmp

Filesize
720KB

Download
memory/2756-42-0x0000000004740000-0x00000000047F4000-memory.dmp

Filesize
720KB

Download
memory/2756-26-0x0000000004740000-0x00000000047F4000-memory.dmp

Filesize
720KB

Download
memory/2756-48-0x0000000004740000-0x00000000047F4000-memory.dmp

Filesize
720KB

Download
memory/2756-30-0x0000000004740000-0x00000000047F4000-memory.dmp

Filesize
720KB

Download
memory/2756-32-0x0000000004740000-0x00000000047F4000-memory.dmp

Filesize
720KB

Download
memory/2756-34-0x0000000004740000-0x00000000047F4000-memory.dmp

Filesize
720KB

Download
memory/2756-36-0x0000000004740000-0x00000000047F4000-memory.dmp

Filesize
720KB

Download
memory/2756-38-0x0000000004740000-0x00000000047F4000-memory.dmp

Filesize
720KB

Download
memory/2756-40-0x0000000004740000-0x00000000047F4000-memory.dmp

Filesize
720KB

Download
memory/2756-0-0x00000000002C0000-0x00000000003C2000-memory.dmp

Filesize
1.0MB

Download
memory/2756-24-0x0000000004740000-0x00000000047F4000-memory.dmp

Filesize
720KB

Download
memory/2756-6-0x0000000004740000-0x00000000047F4000-memory.dmp

Filesize
720KB

Download
memory/2756-28-0x0000000004740000-0x00000000047F4000-memory.dmp

Filesize
720KB

Download
memory/2756-50-0x0000000004740000-0x00000000047F4000-memory.dmp

Filesize
720KB

Download
memory/2756-54-0x0000000004740000-0x00000000047F4000-memory.dmp

Filesize
720KB

Download
memory/2756-52-0x0000000004740000-0x00000000047F4000-memory.dmp

Filesize
720KB

Download
memory/2756-56-0x0000000004740000-0x00000000047F4000-memory.dmp

Filesize
720KB

Download
memory/2756-58-0x0000000004740000-0x00000000047F4000-memory.dmp

Filesize
720KB

Download
memory/2756-60-0x0000000004740000-0x00000000047F4000-memory.dmp

Filesize
720KB

Download
memory/2756-62-0x0000000004740000-0x00000000047F4000-memory.dmp

Filesize
720KB

Download
memory/2756-66-0x0000000004740000-0x00000000047F4000-memory.dmp

Filesize
720KB

Download
memory/2756-68-0x0000000004740000-0x00000000047F4000-memory.dmp

Filesize
720KB

Download
memory/2756-64-0x0000000004740000-0x00000000047F4000-memory.dmp

Filesize
720KB

Download
memory/2756-1119-0x0000000000540000-0x0000000000541000-memory.dmp

Filesize
4KB

Download
memory/2756-1121-0x0000000002040000-0x000000000208C000-memory.dmp

Filesize
304KB

Download
memory/2756-1120-0x0000000001F80000-0x0000000001FC2000-memory.dmp

Filesize
264KB

Download
memory/2756-1122-0x0000000074B10000-0x00000000751FE000-memory.dmp

Filesize
6.9MB

Download
memory/2756-1123-0x0000000001FC0000-0x0000000002000000-memory.dmp

Filesize
256KB

Download
memory/2756-1133-0x0000000074B10000-0x00000000751FE000-memory.dmp

Filesize
6.9MB

Download
memory/2756-5-0x0000000004740000-0x00000000047F4000-memory.dmp

Filesize
720KB

Download
memory/2756-4-0x0000000004740000-0x00000000047FA000-memory.dmp

Filesize
744KB

Download
memory/2756-3-0x0000000004680000-0x000000000473A000-memory.dmp

Filesize
744KB

Download
memory/2756-2-0x0000000001FC0000-0x0000000002000000-memory.dmp

Filesize
256KB

Download
memory/2756-1-0x0000000074B10000-0x00000000751FE000-memory.dmp

Filesize
6.9MB

Download