agenttesla | 52826106b0604a8fbe4da3ad9ebac57130933d40b1d3902888c5925b6386172c

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13/03/2024, 02:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

52826106b0604a8fbe4da3ad9ebac57130933d40b1d3902888c5925b6386172c.exe
Size

1.1MB
MD5

9ff1e54eaae2ffff004ac886a02e049b
SHA1

28756ecde5bf9ff9bb7bf78d76e490667190e390
SHA256

52826106b0604a8fbe4da3ad9ebac57130933d40b1d3902888c5925b6386172c
SHA512

924411198f22f21db97019a9de96eda7e6b699895adfb278d60335921ebe2761c9d698585af501a8614fefedd741fccb025f429ded66b78c2b3e959fc7a08969
SSDEEP

24576:CAHnh+eWsN3skA4RV1Hom2KXMmHaBPaaSZsnaeb5:Fh+ZkldoPK8YaBPaR1C

Score

10^/10

agenttesla zgrat keylogger rat spyware stealer trojan

Malware Config

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Detect ZGRat V1 33 IoCs

resource	yara_rule
behavioral1/memory/3004-16-0x0000000001DE0000-0x0000000001E34000-memory.dmp	family_zgrat_v1
behavioral1/memory/3004-20-0x00000000020B0000-0x0000000002102000-memory.dmp	family_zgrat_v1
behavioral1/memory/3004-21-0x00000000020B0000-0x00000000020FD000-memory.dmp	family_zgrat_v1
behavioral1/memory/3004-22-0x00000000020B0000-0x00000000020FD000-memory.dmp	family_zgrat_v1
behavioral1/memory/3004-24-0x00000000020B0000-0x00000000020FD000-memory.dmp	family_zgrat_v1
behavioral1/memory/3004-26-0x00000000020B0000-0x00000000020FD000-memory.dmp	family_zgrat_v1
behavioral1/memory/3004-28-0x00000000020B0000-0x00000000020FD000-memory.dmp	family_zgrat_v1
behavioral1/memory/3004-30-0x00000000020B0000-0x00000000020FD000-memory.dmp	family_zgrat_v1
behavioral1/memory/3004-32-0x00000000020B0000-0x00000000020FD000-memory.dmp	family_zgrat_v1
behavioral1/memory/3004-34-0x00000000020B0000-0x00000000020FD000-memory.dmp	family_zgrat_v1
behavioral1/memory/3004-36-0x00000000020B0000-0x00000000020FD000-memory.dmp	family_zgrat_v1
behavioral1/memory/3004-38-0x00000000020B0000-0x00000000020FD000-memory.dmp	family_zgrat_v1
behavioral1/memory/3004-40-0x00000000020B0000-0x00000000020FD000-memory.dmp	family_zgrat_v1
behavioral1/memory/3004-42-0x00000000020B0000-0x00000000020FD000-memory.dmp	family_zgrat_v1
behavioral1/memory/3004-44-0x00000000020B0000-0x00000000020FD000-memory.dmp	family_zgrat_v1
behavioral1/memory/3004-46-0x00000000020B0000-0x00000000020FD000-memory.dmp	family_zgrat_v1
behavioral1/memory/3004-52-0x00000000020B0000-0x00000000020FD000-memory.dmp	family_zgrat_v1
behavioral1/memory/3004-58-0x00000000020B0000-0x00000000020FD000-memory.dmp	family_zgrat_v1
behavioral1/memory/3004-56-0x00000000020B0000-0x00000000020FD000-memory.dmp	family_zgrat_v1
behavioral1/memory/3004-60-0x00000000020B0000-0x00000000020FD000-memory.dmp	family_zgrat_v1
behavioral1/memory/3004-54-0x00000000020B0000-0x00000000020FD000-memory.dmp	family_zgrat_v1
behavioral1/memory/3004-50-0x00000000020B0000-0x00000000020FD000-memory.dmp	family_zgrat_v1
behavioral1/memory/3004-48-0x00000000020B0000-0x00000000020FD000-memory.dmp	family_zgrat_v1
behavioral1/memory/3004-62-0x00000000020B0000-0x00000000020FD000-memory.dmp	family_zgrat_v1
behavioral1/memory/3004-64-0x00000000020B0000-0x00000000020FD000-memory.dmp	family_zgrat_v1
behavioral1/memory/3004-66-0x00000000020B0000-0x00000000020FD000-memory.dmp	family_zgrat_v1
behavioral1/memory/3004-76-0x00000000020B0000-0x00000000020FD000-memory.dmp	family_zgrat_v1
behavioral1/memory/3004-74-0x00000000020B0000-0x00000000020FD000-memory.dmp	family_zgrat_v1
behavioral1/memory/3004-72-0x00000000020B0000-0x00000000020FD000-memory.dmp	family_zgrat_v1
behavioral1/memory/3004-70-0x00000000020B0000-0x00000000020FD000-memory.dmp	family_zgrat_v1
behavioral1/memory/3004-68-0x00000000020B0000-0x00000000020FD000-memory.dmp	family_zgrat_v1
behavioral1/memory/3004-78-0x00000000020B0000-0x00000000020FD000-memory.dmp	family_zgrat_v1
behavioral1/memory/3004-80-0x00000000020B0000-0x00000000020FD000-memory.dmp	family_zgrat_v1

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	api.ipify.org
3	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2320 set thread context of 3004	2320	52826106b0604a8fbe4da3ad9ebac57130933d40b1d3902888c5925b6386172c.exe	28

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3004	RegSvcs.exe
3004	RegSvcs.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2320	52826106b0604a8fbe4da3ad9ebac57130933d40b1d3902888c5925b6386172c.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3004	RegSvcs.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2320	52826106b0604a8fbe4da3ad9ebac57130933d40b1d3902888c5925b6386172c.exe
2320	52826106b0604a8fbe4da3ad9ebac57130933d40b1d3902888c5925b6386172c.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
2320	52826106b0604a8fbe4da3ad9ebac57130933d40b1d3902888c5925b6386172c.exe
2320	52826106b0604a8fbe4da3ad9ebac57130933d40b1d3902888c5925b6386172c.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 3004	2320	52826106b0604a8fbe4da3ad9ebac57130933d40b1d3902888c5925b6386172c.exe	28
PID 2320 wrote to memory of 3004	2320	52826106b0604a8fbe4da3ad9ebac57130933d40b1d3902888c5925b6386172c.exe	28
PID 2320 wrote to memory of 3004	2320	52826106b0604a8fbe4da3ad9ebac57130933d40b1d3902888c5925b6386172c.exe	28
PID 2320 wrote to memory of 3004	2320	52826106b0604a8fbe4da3ad9ebac57130933d40b1d3902888c5925b6386172c.exe	28
PID 2320 wrote to memory of 3004	2320	52826106b0604a8fbe4da3ad9ebac57130933d40b1d3902888c5925b6386172c.exe	28
PID 2320 wrote to memory of 3004	2320	52826106b0604a8fbe4da3ad9ebac57130933d40b1d3902888c5925b6386172c.exe	28
PID 2320 wrote to memory of 3004	2320	52826106b0604a8fbe4da3ad9ebac57130933d40b1d3902888c5925b6386172c.exe	28
PID 2320 wrote to memory of 3004	2320	52826106b0604a8fbe4da3ad9ebac57130933d40b1d3902888c5925b6386172c.exe	28

C:\Users\Admin\AppData\Local\Temp\52826106b0604a8fbe4da3ad9ebac57130933d40b1d3902888c5925b6386172c.exe
"C:\Users\Admin\AppData\Local\Temp\52826106b0604a8fbe4da3ad9ebac57130933d40b1d3902888c5925b6386172c.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Users\Admin\AppData\Local\Temp\52826106b0604a8fbe4da3ad9ebac57130933d40b1d3902888c5925b6386172c.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3004

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\peaks

Filesize
261KB

MD5
094fa97f3660165f45c3b4c505fb6577

SHA1
35cc8925d920faceb2b9b7ec684aed8188fa8cd8

SHA256
892c433fc34ac35ac6895037fa1bf5efe0edb5c870d0975d6faee71e92ce16d1

SHA512
9405d30b93a0c84718b6ce72041b960925ad2c1853feb6deddb9a31422a7f1cce2ed3cd49b49b76ed4171fcd408857a941034afc722c4a9380531954590294be

Download Submit
memory/2320-11-0x0000000000220000-0x0000000000224000-memory.dmp

Filesize
16KB

Download
memory/3004-12-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/3004-14-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/3004-15-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/3004-16-0x0000000001DE0000-0x0000000001E34000-memory.dmp

Filesize
336KB

Download
memory/3004-17-0x0000000074040000-0x000000007472E000-memory.dmp

Filesize
6.9MB

Download
memory/3004-18-0x0000000000660000-0x00000000006A0000-memory.dmp

Filesize
256KB

Download
memory/3004-19-0x0000000000660000-0x00000000006A0000-memory.dmp

Filesize
256KB

Download
memory/3004-20-0x00000000020B0000-0x0000000002102000-memory.dmp

Filesize
328KB

Download
memory/3004-21-0x00000000020B0000-0x00000000020FD000-memory.dmp

Filesize
308KB

Download
memory/3004-22-0x00000000020B0000-0x00000000020FD000-memory.dmp

Filesize
308KB

Download
memory/3004-24-0x00000000020B0000-0x00000000020FD000-memory.dmp

Filesize
308KB

Download
memory/3004-26-0x00000000020B0000-0x00000000020FD000-memory.dmp

Filesize
308KB

Download
memory/3004-28-0x00000000020B0000-0x00000000020FD000-memory.dmp

Filesize
308KB

Download
memory/3004-30-0x00000000020B0000-0x00000000020FD000-memory.dmp

Filesize
308KB

Download
memory/3004-32-0x00000000020B0000-0x00000000020FD000-memory.dmp

Filesize
308KB

Download
memory/3004-34-0x00000000020B0000-0x00000000020FD000-memory.dmp

Filesize
308KB

Download
memory/3004-36-0x00000000020B0000-0x00000000020FD000-memory.dmp

Filesize
308KB

Download
memory/3004-38-0x00000000020B0000-0x00000000020FD000-memory.dmp

Filesize
308KB

Download
memory/3004-40-0x00000000020B0000-0x00000000020FD000-memory.dmp

Filesize
308KB

Download
memory/3004-42-0x00000000020B0000-0x00000000020FD000-memory.dmp

Filesize
308KB

Download
memory/3004-44-0x00000000020B0000-0x00000000020FD000-memory.dmp

Filesize
308KB

Download
memory/3004-46-0x00000000020B0000-0x00000000020FD000-memory.dmp

Filesize
308KB

Download
memory/3004-52-0x00000000020B0000-0x00000000020FD000-memory.dmp

Filesize
308KB

Download
memory/3004-58-0x00000000020B0000-0x00000000020FD000-memory.dmp

Filesize
308KB

Download
memory/3004-56-0x00000000020B0000-0x00000000020FD000-memory.dmp

Filesize
308KB

Download
memory/3004-60-0x00000000020B0000-0x00000000020FD000-memory.dmp

Filesize
308KB

Download
memory/3004-54-0x00000000020B0000-0x00000000020FD000-memory.dmp

Filesize
308KB

Download
memory/3004-50-0x00000000020B0000-0x00000000020FD000-memory.dmp

Filesize
308KB

Download
memory/3004-48-0x00000000020B0000-0x00000000020FD000-memory.dmp

Filesize
308KB

Download
memory/3004-62-0x00000000020B0000-0x00000000020FD000-memory.dmp

Filesize
308KB

Download
memory/3004-64-0x00000000020B0000-0x00000000020FD000-memory.dmp

Filesize
308KB

Download
memory/3004-66-0x00000000020B0000-0x00000000020FD000-memory.dmp

Filesize
308KB

Download
memory/3004-76-0x00000000020B0000-0x00000000020FD000-memory.dmp

Filesize
308KB

Download
memory/3004-74-0x00000000020B0000-0x00000000020FD000-memory.dmp

Filesize
308KB

Download
memory/3004-72-0x00000000020B0000-0x00000000020FD000-memory.dmp

Filesize
308KB

Download
memory/3004-70-0x00000000020B0000-0x00000000020FD000-memory.dmp

Filesize
308KB

Download
memory/3004-68-0x00000000020B0000-0x00000000020FD000-memory.dmp

Filesize
308KB

Download
memory/3004-78-0x00000000020B0000-0x00000000020FD000-memory.dmp

Filesize
308KB

Download
memory/3004-80-0x00000000020B0000-0x00000000020FD000-memory.dmp

Filesize
308KB

Download
memory/3004-1053-0x0000000000660000-0x00000000006A0000-memory.dmp

Filesize
256KB

Download
memory/3004-1054-0x0000000074040000-0x000000007472E000-memory.dmp

Filesize
6.9MB

Download
memory/3004-1055-0x0000000000660000-0x00000000006A0000-memory.dmp

Filesize
256KB

Download
memory/3004-1056-0x0000000000660000-0x00000000006A0000-memory.dmp

Filesize
256KB

Download