agenttesla | 52826106b0604a8fbe4da3ad9ebac57130933d40b1d3902888c5925b6386172c

Analysis

max time kernel
145s
max time network
168s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
13/03/2024, 02:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

52826106b0604a8fbe4da3ad9ebac57130933d40b1d3902888c5925b6386172c.exe
Size

1.1MB
MD5

9ff1e54eaae2ffff004ac886a02e049b
SHA1

28756ecde5bf9ff9bb7bf78d76e490667190e390
SHA256

52826106b0604a8fbe4da3ad9ebac57130933d40b1d3902888c5925b6386172c
SHA512

924411198f22f21db97019a9de96eda7e6b699895adfb278d60335921ebe2761c9d698585af501a8614fefedd741fccb025f429ded66b78c2b3e959fc7a08969
SSDEEP

24576:CAHnh+eWsN3skA4RV1Hom2KXMmHaBPaaSZsnaeb5:Fh+ZkldoPK8YaBPaR1C

Score

10^/10

agenttesla zgrat keylogger rat spyware stealer trojan

Malware Config

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Detect ZGRat V1 33 IoCs

resource	yara_rule
behavioral2/memory/4996-33-0x0000000002F10000-0x0000000002F64000-memory.dmp	family_zgrat_v1
behavioral2/memory/4996-36-0x00000000054C0000-0x0000000005512000-memory.dmp	family_zgrat_v1
behavioral2/memory/4996-37-0x00000000054C0000-0x000000000550D000-memory.dmp	family_zgrat_v1
behavioral2/memory/4996-38-0x00000000054C0000-0x000000000550D000-memory.dmp	family_zgrat_v1
behavioral2/memory/4996-40-0x00000000054C0000-0x000000000550D000-memory.dmp	family_zgrat_v1
behavioral2/memory/4996-42-0x00000000054C0000-0x000000000550D000-memory.dmp	family_zgrat_v1
behavioral2/memory/4996-44-0x00000000054C0000-0x000000000550D000-memory.dmp	family_zgrat_v1
behavioral2/memory/4996-46-0x00000000054C0000-0x000000000550D000-memory.dmp	family_zgrat_v1
behavioral2/memory/4996-48-0x00000000054C0000-0x000000000550D000-memory.dmp	family_zgrat_v1
behavioral2/memory/4996-50-0x00000000054C0000-0x000000000550D000-memory.dmp	family_zgrat_v1
behavioral2/memory/4996-54-0x00000000054C0000-0x000000000550D000-memory.dmp	family_zgrat_v1
behavioral2/memory/4996-52-0x00000000054C0000-0x000000000550D000-memory.dmp	family_zgrat_v1
behavioral2/memory/4996-56-0x00000000054C0000-0x000000000550D000-memory.dmp	family_zgrat_v1
behavioral2/memory/4996-58-0x00000000054C0000-0x000000000550D000-memory.dmp	family_zgrat_v1
behavioral2/memory/4996-60-0x00000000054C0000-0x000000000550D000-memory.dmp	family_zgrat_v1
behavioral2/memory/4996-62-0x00000000054C0000-0x000000000550D000-memory.dmp	family_zgrat_v1
behavioral2/memory/4996-64-0x00000000054C0000-0x000000000550D000-memory.dmp	family_zgrat_v1
behavioral2/memory/4996-66-0x00000000054C0000-0x000000000550D000-memory.dmp	family_zgrat_v1
behavioral2/memory/4996-68-0x00000000054C0000-0x000000000550D000-memory.dmp	family_zgrat_v1
behavioral2/memory/4996-70-0x00000000054C0000-0x000000000550D000-memory.dmp	family_zgrat_v1
behavioral2/memory/4996-72-0x00000000054C0000-0x000000000550D000-memory.dmp	family_zgrat_v1
behavioral2/memory/4996-74-0x00000000054C0000-0x000000000550D000-memory.dmp	family_zgrat_v1
behavioral2/memory/4996-76-0x00000000054C0000-0x000000000550D000-memory.dmp	family_zgrat_v1
behavioral2/memory/4996-78-0x00000000054C0000-0x000000000550D000-memory.dmp	family_zgrat_v1
behavioral2/memory/4996-80-0x00000000054C0000-0x000000000550D000-memory.dmp	family_zgrat_v1
behavioral2/memory/4996-82-0x00000000054C0000-0x000000000550D000-memory.dmp	family_zgrat_v1
behavioral2/memory/4996-84-0x00000000054C0000-0x000000000550D000-memory.dmp	family_zgrat_v1
behavioral2/memory/4996-86-0x00000000054C0000-0x000000000550D000-memory.dmp	family_zgrat_v1
behavioral2/memory/4996-88-0x00000000054C0000-0x000000000550D000-memory.dmp	family_zgrat_v1
behavioral2/memory/4996-90-0x00000000054C0000-0x000000000550D000-memory.dmp	family_zgrat_v1
behavioral2/memory/4996-92-0x00000000054C0000-0x000000000550D000-memory.dmp	family_zgrat_v1
behavioral2/memory/4996-94-0x00000000054C0000-0x000000000550D000-memory.dmp	family_zgrat_v1
behavioral2/memory/4996-96-0x00000000054C0000-0x000000000550D000-memory.dmp	family_zgrat_v1

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
40	api.ipify.org
41	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3020 set thread context of 4996	3020	52826106b0604a8fbe4da3ad9ebac57130933d40b1d3902888c5925b6386172c.exe	93

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4996	RegSvcs.exe
4996	RegSvcs.exe
4996	RegSvcs.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
4480	52826106b0604a8fbe4da3ad9ebac57130933d40b1d3902888c5925b6386172c.exe
3020	52826106b0604a8fbe4da3ad9ebac57130933d40b1d3902888c5925b6386172c.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4996	RegSvcs.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
4480	52826106b0604a8fbe4da3ad9ebac57130933d40b1d3902888c5925b6386172c.exe
4480	52826106b0604a8fbe4da3ad9ebac57130933d40b1d3902888c5925b6386172c.exe
3020	52826106b0604a8fbe4da3ad9ebac57130933d40b1d3902888c5925b6386172c.exe
3020	52826106b0604a8fbe4da3ad9ebac57130933d40b1d3902888c5925b6386172c.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
4480	52826106b0604a8fbe4da3ad9ebac57130933d40b1d3902888c5925b6386172c.exe
4480	52826106b0604a8fbe4da3ad9ebac57130933d40b1d3902888c5925b6386172c.exe
3020	52826106b0604a8fbe4da3ad9ebac57130933d40b1d3902888c5925b6386172c.exe
3020	52826106b0604a8fbe4da3ad9ebac57130933d40b1d3902888c5925b6386172c.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4480 wrote to memory of 3948	4480	52826106b0604a8fbe4da3ad9ebac57130933d40b1d3902888c5925b6386172c.exe	91
PID 4480 wrote to memory of 3948	4480	52826106b0604a8fbe4da3ad9ebac57130933d40b1d3902888c5925b6386172c.exe	91
PID 4480 wrote to memory of 3948	4480	52826106b0604a8fbe4da3ad9ebac57130933d40b1d3902888c5925b6386172c.exe	91
PID 4480 wrote to memory of 3020	4480	52826106b0604a8fbe4da3ad9ebac57130933d40b1d3902888c5925b6386172c.exe	92
PID 4480 wrote to memory of 3020	4480	52826106b0604a8fbe4da3ad9ebac57130933d40b1d3902888c5925b6386172c.exe	92
PID 4480 wrote to memory of 3020	4480	52826106b0604a8fbe4da3ad9ebac57130933d40b1d3902888c5925b6386172c.exe	92
PID 3020 wrote to memory of 4996	3020	52826106b0604a8fbe4da3ad9ebac57130933d40b1d3902888c5925b6386172c.exe	93
PID 3020 wrote to memory of 4996	3020	52826106b0604a8fbe4da3ad9ebac57130933d40b1d3902888c5925b6386172c.exe	93
PID 3020 wrote to memory of 4996	3020	52826106b0604a8fbe4da3ad9ebac57130933d40b1d3902888c5925b6386172c.exe	93
PID 3020 wrote to memory of 4996	3020	52826106b0604a8fbe4da3ad9ebac57130933d40b1d3902888c5925b6386172c.exe	93

C:\Users\Admin\AppData\Local\Temp\52826106b0604a8fbe4da3ad9ebac57130933d40b1d3902888c5925b6386172c.exe
"C:\Users\Admin\AppData\Local\Temp\52826106b0604a8fbe4da3ad9ebac57130933d40b1d3902888c5925b6386172c.exe"
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4480
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Users\Admin\AppData\Local\Temp\52826106b0604a8fbe4da3ad9ebac57130933d40b1d3902888c5925b6386172c.exe"
  2⤵
  PID:3948
- C:\Users\Admin\AppData\Local\Temp\52826106b0604a8fbe4da3ad9ebac57130933d40b1d3902888c5925b6386172c.exe
  "C:\Users\Admin\AppData\Local\Temp\52826106b0604a8fbe4da3ad9ebac57130933d40b1d3902888c5925b6386172c.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3020
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "C:\Users\Admin\AppData\Local\Temp\52826106b0604a8fbe4da3ad9ebac57130933d40b1d3902888c5925b6386172c.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4996

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\autA5C5.tmp

Filesize
93KB

MD5
ff994a5e24fdc726fb67828058bf9d24

SHA1
3e963a202be2b00ec4e2ec80ef36251eaaf118a5

SHA256
c6e8c6734f8f8b7455b525611234e80cf367a252322c9279f1c5569c916f63cd

SHA512
d0b3804825943f27cab746cec327afbf988b98a226c07e1a9bb3853335fb5421edea939418437b818f8beaeef0589ee677d99e029cf16d44f23deebd58f8e939

Download Submit
C:\Users\Admin\AppData\Local\Temp\peaks

Filesize
261KB

MD5
094fa97f3660165f45c3b4c505fb6577

SHA1
35cc8925d920faceb2b9b7ec684aed8188fa8cd8

SHA256
892c433fc34ac35ac6895037fa1bf5efe0edb5c870d0975d6faee71e92ce16d1

SHA512
9405d30b93a0c84718b6ce72041b960925ad2c1853feb6deddb9a31422a7f1cce2ed3cd49b49b76ed4171fcd408857a941034afc722c4a9380531954590294be

Download Submit
C:\Users\Admin\AppData\Local\Temp\schoolma

Filesize
63KB

MD5
60712a6d81ba4428a708caf374598c9d

SHA1
e1bf9437ba827612946ee6462fccb99943f8e595

SHA256
cb2b2a128efea42bc90cbd710fa87b7ae9e76d15c0445ac555c93fdef7d47fd6

SHA512
f3d6b86ba85cb90b1e3520cca48254c6dbd118d7af8e8dbbc259d71ed9c2f6abebdee1e8fc176727222b5de3c0deafb0c8aba0fb5e264938dd26951f4178c1b8

Download Submit
memory/4480-12-0x0000000001340000-0x0000000001344000-memory.dmp

Filesize
16KB

Download
memory/4996-27-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/4996-28-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/4996-29-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/4996-30-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/4996-31-0x00000000744B0000-0x0000000074C60000-memory.dmp

Filesize
7.7MB

Download
memory/4996-32-0x0000000002F70000-0x0000000002F80000-memory.dmp

Filesize
64KB

Download
memory/4996-33-0x0000000002F10000-0x0000000002F64000-memory.dmp

Filesize
336KB

Download
memory/4996-34-0x0000000002F70000-0x0000000002F80000-memory.dmp

Filesize
64KB

Download
memory/4996-35-0x0000000005A20000-0x0000000005FC4000-memory.dmp

Filesize
5.6MB

Download
memory/4996-36-0x00000000054C0000-0x0000000005512000-memory.dmp

Filesize
328KB

Download
memory/4996-37-0x00000000054C0000-0x000000000550D000-memory.dmp

Filesize
308KB

Download
memory/4996-38-0x00000000054C0000-0x000000000550D000-memory.dmp

Filesize
308KB

Download
memory/4996-40-0x00000000054C0000-0x000000000550D000-memory.dmp

Filesize
308KB

Download
memory/4996-42-0x00000000054C0000-0x000000000550D000-memory.dmp

Filesize
308KB

Download
memory/4996-44-0x00000000054C0000-0x000000000550D000-memory.dmp

Filesize
308KB

Download
memory/4996-46-0x00000000054C0000-0x000000000550D000-memory.dmp

Filesize
308KB

Download
memory/4996-48-0x00000000054C0000-0x000000000550D000-memory.dmp

Filesize
308KB

Download
memory/4996-50-0x00000000054C0000-0x000000000550D000-memory.dmp

Filesize
308KB

Download
memory/4996-54-0x00000000054C0000-0x000000000550D000-memory.dmp

Filesize
308KB

Download
memory/4996-52-0x00000000054C0000-0x000000000550D000-memory.dmp

Filesize
308KB

Download
memory/4996-56-0x00000000054C0000-0x000000000550D000-memory.dmp

Filesize
308KB

Download
memory/4996-58-0x00000000054C0000-0x000000000550D000-memory.dmp

Filesize
308KB

Download
memory/4996-60-0x00000000054C0000-0x000000000550D000-memory.dmp

Filesize
308KB

Download
memory/4996-62-0x00000000054C0000-0x000000000550D000-memory.dmp

Filesize
308KB

Download
memory/4996-64-0x00000000054C0000-0x000000000550D000-memory.dmp

Filesize
308KB

Download
memory/4996-66-0x00000000054C0000-0x000000000550D000-memory.dmp

Filesize
308KB

Download
memory/4996-68-0x00000000054C0000-0x000000000550D000-memory.dmp

Filesize
308KB

Download
memory/4996-70-0x00000000054C0000-0x000000000550D000-memory.dmp

Filesize
308KB

Download
memory/4996-72-0x00000000054C0000-0x000000000550D000-memory.dmp

Filesize
308KB

Download
memory/4996-74-0x00000000054C0000-0x000000000550D000-memory.dmp

Filesize
308KB

Download
memory/4996-76-0x00000000054C0000-0x000000000550D000-memory.dmp

Filesize
308KB

Download
memory/4996-78-0x00000000054C0000-0x000000000550D000-memory.dmp

Filesize
308KB

Download
memory/4996-80-0x00000000054C0000-0x000000000550D000-memory.dmp

Filesize
308KB

Download
memory/4996-82-0x00000000054C0000-0x000000000550D000-memory.dmp

Filesize
308KB

Download
memory/4996-84-0x00000000054C0000-0x000000000550D000-memory.dmp

Filesize
308KB

Download
memory/4996-86-0x00000000054C0000-0x000000000550D000-memory.dmp

Filesize
308KB

Download
memory/4996-88-0x00000000054C0000-0x000000000550D000-memory.dmp

Filesize
308KB

Download
memory/4996-90-0x00000000054C0000-0x000000000550D000-memory.dmp

Filesize
308KB

Download
memory/4996-92-0x00000000054C0000-0x000000000550D000-memory.dmp

Filesize
308KB

Download
memory/4996-94-0x00000000054C0000-0x000000000550D000-memory.dmp

Filesize
308KB

Download
memory/4996-96-0x00000000054C0000-0x000000000550D000-memory.dmp

Filesize
308KB

Download
memory/4996-1069-0x0000000002F70000-0x0000000002F80000-memory.dmp

Filesize
64KB

Download
memory/4996-1070-0x00000000056C0000-0x0000000005726000-memory.dmp

Filesize
408KB

Download
memory/4996-1071-0x0000000006B40000-0x0000000006B90000-memory.dmp

Filesize
320KB

Download
memory/4996-1072-0x0000000006C30000-0x0000000006CC2000-memory.dmp

Filesize
584KB

Download
memory/4996-1073-0x0000000006BB0000-0x0000000006BBA000-memory.dmp

Filesize
40KB

Download
memory/4996-1074-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/4996-1075-0x00000000744B0000-0x0000000074C60000-memory.dmp

Filesize
7.7MB

Download
memory/4996-1076-0x0000000002F70000-0x0000000002F80000-memory.dmp

Filesize
64KB

Download
memory/4996-1077-0x0000000002F70000-0x0000000002F80000-memory.dmp

Filesize
64KB

Download
memory/4996-1078-0x0000000002F70000-0x0000000002F80000-memory.dmp

Filesize
64KB

Download
memory/4996-1079-0x0000000002F70000-0x0000000002F80000-memory.dmp

Filesize
64KB

Download