agenttesla | b3e0a37ca6360fd82823105dc934c80c3b2d5e405af9d3fd0bb27b2a96f6c9de

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13/03/2024, 03:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

d202f0b84b0e2a15c1c90284d0286b8b497e245e6b083e7b98294e1227d52925.exe
Size

1.2MB
MD5

d5f853358e53cae39dba60601507842c
SHA1

c76532dba79ec69659b4cdb8adddbc8417662d76
SHA256

d202f0b84b0e2a15c1c90284d0286b8b497e245e6b083e7b98294e1227d52925
SHA512

04d13c04ee6a88b10ca0fe7d08fe8e0114b2c20aa792cd238830d1971ef3488df0a51821d077cc491b1b99a86f9f726512c1c449c07aacb96c9bb4e03e129f1e
SSDEEP

24576:UAHnh+eWsN3skA4RV1Hom2KXMmHaedfN2ffZ/socXiFi5:jh+ZkldoPK8Yaed1mZ/socSK

Score

10^/10

agenttesla zgrat keylogger rat spyware stealer trojan

Malware Config

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Detect ZGRat V1 33 IoCs

resource	yara_rule
behavioral1/memory/2812-15-0x0000000000CE0000-0x0000000000D34000-memory.dmp	family_zgrat_v1
behavioral1/memory/2812-19-0x0000000000D70000-0x0000000000DC2000-memory.dmp	family_zgrat_v1
behavioral1/memory/2812-20-0x0000000000D70000-0x0000000000DBC000-memory.dmp	family_zgrat_v1
behavioral1/memory/2812-21-0x0000000000D70000-0x0000000000DBC000-memory.dmp	family_zgrat_v1
behavioral1/memory/2812-23-0x0000000000D70000-0x0000000000DBC000-memory.dmp	family_zgrat_v1
behavioral1/memory/2812-25-0x0000000000D70000-0x0000000000DBC000-memory.dmp	family_zgrat_v1
behavioral1/memory/2812-27-0x0000000000D70000-0x0000000000DBC000-memory.dmp	family_zgrat_v1
behavioral1/memory/2812-29-0x0000000000D70000-0x0000000000DBC000-memory.dmp	family_zgrat_v1
behavioral1/memory/2812-31-0x0000000000D70000-0x0000000000DBC000-memory.dmp	family_zgrat_v1
behavioral1/memory/2812-33-0x0000000000D70000-0x0000000000DBC000-memory.dmp	family_zgrat_v1
behavioral1/memory/2812-35-0x0000000000D70000-0x0000000000DBC000-memory.dmp	family_zgrat_v1
behavioral1/memory/2812-37-0x0000000000D70000-0x0000000000DBC000-memory.dmp	family_zgrat_v1
behavioral1/memory/2812-39-0x0000000000D70000-0x0000000000DBC000-memory.dmp	family_zgrat_v1
behavioral1/memory/2812-41-0x0000000000D70000-0x0000000000DBC000-memory.dmp	family_zgrat_v1
behavioral1/memory/2812-43-0x0000000000D70000-0x0000000000DBC000-memory.dmp	family_zgrat_v1
behavioral1/memory/2812-45-0x0000000000D70000-0x0000000000DBC000-memory.dmp	family_zgrat_v1
behavioral1/memory/2812-49-0x0000000000D70000-0x0000000000DBC000-memory.dmp	family_zgrat_v1
behavioral1/memory/2812-47-0x0000000000D70000-0x0000000000DBC000-memory.dmp	family_zgrat_v1
behavioral1/memory/2812-51-0x0000000000D70000-0x0000000000DBC000-memory.dmp	family_zgrat_v1
behavioral1/memory/2812-53-0x0000000000D70000-0x0000000000DBC000-memory.dmp	family_zgrat_v1
behavioral1/memory/2812-55-0x0000000000D70000-0x0000000000DBC000-memory.dmp	family_zgrat_v1
behavioral1/memory/2812-57-0x0000000000D70000-0x0000000000DBC000-memory.dmp	family_zgrat_v1
behavioral1/memory/2812-59-0x0000000000D70000-0x0000000000DBC000-memory.dmp	family_zgrat_v1
behavioral1/memory/2812-61-0x0000000000D70000-0x0000000000DBC000-memory.dmp	family_zgrat_v1
behavioral1/memory/2812-63-0x0000000000D70000-0x0000000000DBC000-memory.dmp	family_zgrat_v1
behavioral1/memory/2812-65-0x0000000000D70000-0x0000000000DBC000-memory.dmp	family_zgrat_v1
behavioral1/memory/2812-67-0x0000000000D70000-0x0000000000DBC000-memory.dmp	family_zgrat_v1
behavioral1/memory/2812-69-0x0000000000D70000-0x0000000000DBC000-memory.dmp	family_zgrat_v1
behavioral1/memory/2812-71-0x0000000000D70000-0x0000000000DBC000-memory.dmp	family_zgrat_v1
behavioral1/memory/2812-73-0x0000000000D70000-0x0000000000DBC000-memory.dmp	family_zgrat_v1
behavioral1/memory/2812-75-0x0000000000D70000-0x0000000000DBC000-memory.dmp	family_zgrat_v1
behavioral1/memory/2812-77-0x0000000000D70000-0x0000000000DBC000-memory.dmp	family_zgrat_v1
behavioral1/memory/2812-79-0x0000000000D70000-0x0000000000DBC000-memory.dmp	family_zgrat_v1

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2876 set thread context of 2812	2876	d202f0b84b0e2a15c1c90284d0286b8b497e245e6b083e7b98294e1227d52925.exe	28

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2812	RegSvcs.exe
2812	RegSvcs.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2876	d202f0b84b0e2a15c1c90284d0286b8b497e245e6b083e7b98294e1227d52925.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2812	RegSvcs.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2876	d202f0b84b0e2a15c1c90284d0286b8b497e245e6b083e7b98294e1227d52925.exe
2876	d202f0b84b0e2a15c1c90284d0286b8b497e245e6b083e7b98294e1227d52925.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
2876	d202f0b84b0e2a15c1c90284d0286b8b497e245e6b083e7b98294e1227d52925.exe
2876	d202f0b84b0e2a15c1c90284d0286b8b497e245e6b083e7b98294e1227d52925.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2876 wrote to memory of 2812	2876	d202f0b84b0e2a15c1c90284d0286b8b497e245e6b083e7b98294e1227d52925.exe	28
PID 2876 wrote to memory of 2812	2876	d202f0b84b0e2a15c1c90284d0286b8b497e245e6b083e7b98294e1227d52925.exe	28
PID 2876 wrote to memory of 2812	2876	d202f0b84b0e2a15c1c90284d0286b8b497e245e6b083e7b98294e1227d52925.exe	28
PID 2876 wrote to memory of 2812	2876	d202f0b84b0e2a15c1c90284d0286b8b497e245e6b083e7b98294e1227d52925.exe	28
PID 2876 wrote to memory of 2812	2876	d202f0b84b0e2a15c1c90284d0286b8b497e245e6b083e7b98294e1227d52925.exe	28
PID 2876 wrote to memory of 2812	2876	d202f0b84b0e2a15c1c90284d0286b8b497e245e6b083e7b98294e1227d52925.exe	28
PID 2876 wrote to memory of 2812	2876	d202f0b84b0e2a15c1c90284d0286b8b497e245e6b083e7b98294e1227d52925.exe	28
PID 2876 wrote to memory of 2812	2876	d202f0b84b0e2a15c1c90284d0286b8b497e245e6b083e7b98294e1227d52925.exe	28

C:\Users\Admin\AppData\Local\Temp\d202f0b84b0e2a15c1c90284d0286b8b497e245e6b083e7b98294e1227d52925.exe
"C:\Users\Admin\AppData\Local\Temp\d202f0b84b0e2a15c1c90284d0286b8b497e245e6b083e7b98294e1227d52925.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2876
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Users\Admin\AppData\Local\Temp\d202f0b84b0e2a15c1c90284d0286b8b497e245e6b083e7b98294e1227d52925.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2812

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2812-45-0x0000000000D70000-0x0000000000DBC000-memory.dmp

Filesize
304KB

Download
memory/2812-31-0x0000000000D70000-0x0000000000DBC000-memory.dmp

Filesize
304KB

Download
memory/2812-13-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2812-14-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2812-16-0x00000000742B0000-0x000000007499E000-memory.dmp

Filesize
6.9MB

Download
memory/2812-17-0x0000000000B60000-0x0000000000BA0000-memory.dmp

Filesize
256KB

Download
memory/2812-15-0x0000000000CE0000-0x0000000000D34000-memory.dmp

Filesize
336KB

Download
memory/2812-18-0x0000000000B60000-0x0000000000BA0000-memory.dmp

Filesize
256KB

Download
memory/2812-19-0x0000000000D70000-0x0000000000DC2000-memory.dmp

Filesize
328KB

Download
memory/2812-20-0x0000000000D70000-0x0000000000DBC000-memory.dmp

Filesize
304KB

Download
memory/2812-21-0x0000000000D70000-0x0000000000DBC000-memory.dmp

Filesize
304KB

Download
memory/2812-23-0x0000000000D70000-0x0000000000DBC000-memory.dmp

Filesize
304KB

Download
memory/2812-25-0x0000000000D70000-0x0000000000DBC000-memory.dmp

Filesize
304KB

Download
memory/2812-47-0x0000000000D70000-0x0000000000DBC000-memory.dmp

Filesize
304KB

Download
memory/2812-29-0x0000000000D70000-0x0000000000DBC000-memory.dmp

Filesize
304KB

Download
memory/2812-49-0x0000000000D70000-0x0000000000DBC000-memory.dmp

Filesize
304KB

Download
memory/2812-33-0x0000000000D70000-0x0000000000DBC000-memory.dmp

Filesize
304KB

Download
memory/2812-35-0x0000000000D70000-0x0000000000DBC000-memory.dmp

Filesize
304KB

Download
memory/2812-37-0x0000000000D70000-0x0000000000DBC000-memory.dmp

Filesize
304KB

Download
memory/2812-39-0x0000000000D70000-0x0000000000DBC000-memory.dmp

Filesize
304KB

Download
memory/2812-41-0x0000000000D70000-0x0000000000DBC000-memory.dmp

Filesize
304KB

Download
memory/2812-43-0x0000000000D70000-0x0000000000DBC000-memory.dmp

Filesize
304KB

Download
memory/2812-11-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2812-1054-0x0000000000B60000-0x0000000000BA0000-memory.dmp

Filesize
256KB

Download
memory/2812-27-0x0000000000D70000-0x0000000000DBC000-memory.dmp

Filesize
304KB

Download
memory/2812-51-0x0000000000D70000-0x0000000000DBC000-memory.dmp

Filesize
304KB

Download
memory/2812-53-0x0000000000D70000-0x0000000000DBC000-memory.dmp

Filesize
304KB

Download
memory/2812-55-0x0000000000D70000-0x0000000000DBC000-memory.dmp

Filesize
304KB

Download
memory/2812-57-0x0000000000D70000-0x0000000000DBC000-memory.dmp

Filesize
304KB

Download
memory/2812-59-0x0000000000D70000-0x0000000000DBC000-memory.dmp

Filesize
304KB

Download
memory/2812-61-0x0000000000D70000-0x0000000000DBC000-memory.dmp

Filesize
304KB

Download
memory/2812-63-0x0000000000D70000-0x0000000000DBC000-memory.dmp

Filesize
304KB

Download
memory/2812-65-0x0000000000D70000-0x0000000000DBC000-memory.dmp

Filesize
304KB

Download
memory/2812-67-0x0000000000D70000-0x0000000000DBC000-memory.dmp

Filesize
304KB

Download
memory/2812-69-0x0000000000D70000-0x0000000000DBC000-memory.dmp

Filesize
304KB

Download
memory/2812-71-0x0000000000D70000-0x0000000000DBC000-memory.dmp

Filesize
304KB

Download
memory/2812-73-0x0000000000D70000-0x0000000000DBC000-memory.dmp

Filesize
304KB

Download
memory/2812-75-0x0000000000D70000-0x0000000000DBC000-memory.dmp

Filesize
304KB

Download
memory/2812-77-0x0000000000D70000-0x0000000000DBC000-memory.dmp

Filesize
304KB

Download
memory/2812-79-0x0000000000D70000-0x0000000000DBC000-memory.dmp

Filesize
304KB

Download
memory/2812-1050-0x0000000000B60000-0x0000000000BA0000-memory.dmp

Filesize
256KB

Download
memory/2812-1051-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2812-1052-0x00000000742B0000-0x000000007499E000-memory.dmp

Filesize
6.9MB

Download
memory/2812-1053-0x0000000000B60000-0x0000000000BA0000-memory.dmp

Filesize
256KB

Download
memory/2876-10-0x0000000000120000-0x0000000000124000-memory.dmp

Filesize
16KB

Download