agenttesla | 2aee8baffb17cee74351abf00ad2858483fd0e12a8fa9f2bbd127e122a5ae14b

General

Target

2aee8baffb17cee74351abf00ad2858483fd0e12a8fa9f2bbd127e122a5ae14b.exe
Size

1.2MB
MD5

13ec5e21374731ff841ec06417425a7e
SHA1

ff55f14570b31b700e25cfebac90e7efe850f15b
SHA256

2aee8baffb17cee74351abf00ad2858483fd0e12a8fa9f2bbd127e122a5ae14b
SHA512

9e0e04c800a96101a63b3b2f8c01cb9039606c4d46d87679a6ecd4bcfaa673da6f24151b60e53bb3f82cbf25bb3257d4b6c54be0afcdb51728c932fa9e92f2ef
SSDEEP

24576:bAHnh+eWsN3skA4RV1Hom2KXMmHaB6i+ITlQBWYjgBg5:2h+ZkldoPK8YaBlHl0zjr

Score

10^/10

agenttesla zgrat keylogger rat spyware stealer trojan

Malware Config

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Detect ZGRat V1 33 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4840-19-0x0000000005070000-0x00000000050C8000-memory.dmp	family_zgrat_v1
behavioral2/memory/4840-22-0x00000000051A0000-0x00000000051F6000-memory.dmp	family_zgrat_v1
behavioral2/memory/4840-23-0x00000000051A0000-0x00000000051F0000-memory.dmp	family_zgrat_v1
behavioral2/memory/4840-24-0x00000000051A0000-0x00000000051F0000-memory.dmp	family_zgrat_v1
behavioral2/memory/4840-26-0x00000000051A0000-0x00000000051F0000-memory.dmp	family_zgrat_v1
behavioral2/memory/4840-28-0x00000000051A0000-0x00000000051F0000-memory.dmp	family_zgrat_v1
behavioral2/memory/4840-30-0x00000000051A0000-0x00000000051F0000-memory.dmp	family_zgrat_v1
behavioral2/memory/4840-32-0x00000000051A0000-0x00000000051F0000-memory.dmp	family_zgrat_v1
behavioral2/memory/4840-34-0x00000000051A0000-0x00000000051F0000-memory.dmp	family_zgrat_v1
behavioral2/memory/4840-36-0x00000000051A0000-0x00000000051F0000-memory.dmp	family_zgrat_v1
behavioral2/memory/4840-38-0x00000000051A0000-0x00000000051F0000-memory.dmp	family_zgrat_v1
behavioral2/memory/4840-40-0x00000000051A0000-0x00000000051F0000-memory.dmp	family_zgrat_v1
behavioral2/memory/4840-42-0x00000000051A0000-0x00000000051F0000-memory.dmp	family_zgrat_v1
behavioral2/memory/4840-44-0x00000000051A0000-0x00000000051F0000-memory.dmp	family_zgrat_v1
behavioral2/memory/4840-46-0x00000000051A0000-0x00000000051F0000-memory.dmp	family_zgrat_v1
behavioral2/memory/4840-48-0x00000000051A0000-0x00000000051F0000-memory.dmp	family_zgrat_v1
behavioral2/memory/4840-50-0x00000000051A0000-0x00000000051F0000-memory.dmp	family_zgrat_v1
behavioral2/memory/4840-52-0x00000000051A0000-0x00000000051F0000-memory.dmp	family_zgrat_v1
behavioral2/memory/4840-54-0x00000000051A0000-0x00000000051F0000-memory.dmp	family_zgrat_v1
behavioral2/memory/4840-56-0x00000000051A0000-0x00000000051F0000-memory.dmp	family_zgrat_v1
behavioral2/memory/4840-58-0x00000000051A0000-0x00000000051F0000-memory.dmp	family_zgrat_v1
behavioral2/memory/4840-60-0x00000000051A0000-0x00000000051F0000-memory.dmp	family_zgrat_v1
behavioral2/memory/4840-62-0x00000000051A0000-0x00000000051F0000-memory.dmp	family_zgrat_v1
behavioral2/memory/4840-64-0x00000000051A0000-0x00000000051F0000-memory.dmp	family_zgrat_v1
behavioral2/memory/4840-66-0x00000000051A0000-0x00000000051F0000-memory.dmp	family_zgrat_v1
behavioral2/memory/4840-68-0x00000000051A0000-0x00000000051F0000-memory.dmp	family_zgrat_v1
behavioral2/memory/4840-70-0x00000000051A0000-0x00000000051F0000-memory.dmp	family_zgrat_v1
behavioral2/memory/4840-72-0x00000000051A0000-0x00000000051F0000-memory.dmp	family_zgrat_v1
behavioral2/memory/4840-74-0x00000000051A0000-0x00000000051F0000-memory.dmp	family_zgrat_v1
behavioral2/memory/4840-76-0x00000000051A0000-0x00000000051F0000-memory.dmp	family_zgrat_v1
behavioral2/memory/4840-78-0x00000000051A0000-0x00000000051F0000-memory.dmp	family_zgrat_v1
behavioral2/memory/4840-80-0x00000000051A0000-0x00000000051F0000-memory.dmp	family_zgrat_v1
behavioral2/memory/4840-82-0x00000000051A0000-0x00000000051F0000-memory.dmp	family_zgrat_v1

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

20 api.ipify.org
21 api.ipify.org

flow	ioc
20	api.ipify.org
21	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

Processes:

2aee8baffb17cee74351abf00ad2858483fd0e12a8fa9f2bbd127e122a5ae14b.exe

description	pid	process	target process
PID 4408 set thread context of 4840	4408	2aee8baffb17cee74351abf00ad2858483fd0e12a8fa9f2bbd127e122a5ae14b.exe	RegSvcs.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

RegSvcs.exe

pid process

4840 RegSvcs.exe
4840 RegSvcs.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

2aee8baffb17cee74351abf00ad2858483fd0e12a8fa9f2bbd127e122a5ae14b.exe

pid process

4408 2aee8baffb17cee74351abf00ad2858483fd0e12a8fa9f2bbd127e122a5ae14b.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RegSvcs.exe

description pid process

Token: SeDebugPrivilege 4840 RegSvcs.exe

pid	process
4840	RegSvcs.exe
4840	RegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	4840	RegSvcs.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

2aee8baffb17cee74351abf00ad2858483fd0e12a8fa9f2bbd127e122a5ae14b.exe

pid	process
4408	2aee8baffb17cee74351abf00ad2858483fd0e12a8fa9f2bbd127e122a5ae14b.exe
4408	2aee8baffb17cee74351abf00ad2858483fd0e12a8fa9f2bbd127e122a5ae14b.exe

Suspicious use of SendNotifyMessage 2 IoCs

Processes:

2aee8baffb17cee74351abf00ad2858483fd0e12a8fa9f2bbd127e122a5ae14b.exe

pid	process
4408	2aee8baffb17cee74351abf00ad2858483fd0e12a8fa9f2bbd127e122a5ae14b.exe
4408	2aee8baffb17cee74351abf00ad2858483fd0e12a8fa9f2bbd127e122a5ae14b.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

RegSvcs.exe

pid process

4840 RegSvcs.exe

pid	process
4840	RegSvcs.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2aee8baffb17cee74351abf00ad2858483fd0e12a8fa9f2bbd127e122a5ae14b.exe

description	pid	process	target process
PID 4408 wrote to memory of 4840	4408	2aee8baffb17cee74351abf00ad2858483fd0e12a8fa9f2bbd127e122a5ae14b.exe	RegSvcs.exe
PID 4408 wrote to memory of 4840	4408	2aee8baffb17cee74351abf00ad2858483fd0e12a8fa9f2bbd127e122a5ae14b.exe	RegSvcs.exe
PID 4408 wrote to memory of 4840	4408	2aee8baffb17cee74351abf00ad2858483fd0e12a8fa9f2bbd127e122a5ae14b.exe	RegSvcs.exe
PID 4408 wrote to memory of 4840	4408	2aee8baffb17cee74351abf00ad2858483fd0e12a8fa9f2bbd127e122a5ae14b.exe	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\2aee8baffb17cee74351abf00ad2858483fd0e12a8fa9f2bbd127e122a5ae14b.exe
"C:\Users\Admin\AppData\Local\Temp\2aee8baffb17cee74351abf00ad2858483fd0e12a8fa9f2bbd127e122a5ae14b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4408

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Users\Admin\AppData\Local\Temp\2aee8baffb17cee74351abf00ad2858483fd0e12a8fa9f2bbd127e122a5ae14b.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4840

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\aut4BFD.tmp
Filesize
266KB

MD5
b9eef091e09ca46b02d5fbc52bf3f745

SHA1
34d508a16c864052f56ff48c8e21998611e1caa6

SHA256
33c2a94b1e7b222460955a2011e57cc0aa7a757ebe15416feed58b19125b4c7c

SHA512
85a43bd4b743175d2263a8f0bff0be841e542b8e0660820baefb734e5f2ece6744b672955eab1538fe0ee5e48f9b7c280e42baa46735d91aec4e2aa43ce79bee

Download Submit
memory/4408-12-0x0000000003990000-0x0000000003994000-memory.dmp

Filesize
16KB

Download
memory/4840-13-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/4840-14-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/4840-15-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/4840-16-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/4840-17-0x0000000074170000-0x0000000074920000-memory.dmp

Filesize
7.7MB

Download
memory/4840-18-0x0000000005190000-0x00000000051A0000-memory.dmp

Filesize
64KB

Download
memory/4840-19-0x0000000005070000-0x00000000050C8000-memory.dmp

Filesize
352KB

Download
memory/4840-20-0x0000000005190000-0x00000000051A0000-memory.dmp

Filesize
64KB

Download
memory/4840-21-0x0000000005750000-0x0000000005CF4000-memory.dmp

Filesize
5.6MB

Download
memory/4840-22-0x00000000051A0000-0x00000000051F6000-memory.dmp

Filesize
344KB

Download
memory/4840-23-0x00000000051A0000-0x00000000051F0000-memory.dmp

Filesize
320KB

Download
memory/4840-24-0x00000000051A0000-0x00000000051F0000-memory.dmp

Filesize
320KB

Download
memory/4840-26-0x00000000051A0000-0x00000000051F0000-memory.dmp

Filesize
320KB

Download
memory/4840-28-0x00000000051A0000-0x00000000051F0000-memory.dmp

Filesize
320KB

Download
memory/4840-30-0x00000000051A0000-0x00000000051F0000-memory.dmp

Filesize
320KB

Download
memory/4840-32-0x00000000051A0000-0x00000000051F0000-memory.dmp

Filesize
320KB

Download
memory/4840-34-0x00000000051A0000-0x00000000051F0000-memory.dmp

Filesize
320KB

Download
memory/4840-36-0x00000000051A0000-0x00000000051F0000-memory.dmp

Filesize
320KB

Download
memory/4840-38-0x00000000051A0000-0x00000000051F0000-memory.dmp

Filesize
320KB

Download
memory/4840-40-0x00000000051A0000-0x00000000051F0000-memory.dmp

Filesize
320KB

Download
memory/4840-42-0x00000000051A0000-0x00000000051F0000-memory.dmp

Filesize
320KB

Download
memory/4840-44-0x00000000051A0000-0x00000000051F0000-memory.dmp

Filesize
320KB

Download
memory/4840-46-0x00000000051A0000-0x00000000051F0000-memory.dmp

Filesize
320KB

Download
memory/4840-48-0x00000000051A0000-0x00000000051F0000-memory.dmp

Filesize
320KB

Download
memory/4840-50-0x00000000051A0000-0x00000000051F0000-memory.dmp

Filesize
320KB

Download
memory/4840-52-0x00000000051A0000-0x00000000051F0000-memory.dmp

Filesize
320KB

Download
memory/4840-54-0x00000000051A0000-0x00000000051F0000-memory.dmp

Filesize
320KB

Download
memory/4840-56-0x00000000051A0000-0x00000000051F0000-memory.dmp

Filesize
320KB

Download
memory/4840-58-0x00000000051A0000-0x00000000051F0000-memory.dmp

Filesize
320KB

Download
memory/4840-60-0x00000000051A0000-0x00000000051F0000-memory.dmp

Filesize
320KB

Download
memory/4840-62-0x00000000051A0000-0x00000000051F0000-memory.dmp

Filesize
320KB

Download
memory/4840-64-0x00000000051A0000-0x00000000051F0000-memory.dmp

Filesize
320KB

Download
memory/4840-66-0x00000000051A0000-0x00000000051F0000-memory.dmp

Filesize
320KB

Download
memory/4840-68-0x00000000051A0000-0x00000000051F0000-memory.dmp

Filesize
320KB

Download
memory/4840-70-0x00000000051A0000-0x00000000051F0000-memory.dmp

Filesize
320KB

Download
memory/4840-72-0x00000000051A0000-0x00000000051F0000-memory.dmp

Filesize
320KB

Download
memory/4840-74-0x00000000051A0000-0x00000000051F0000-memory.dmp

Filesize
320KB

Download
memory/4840-76-0x00000000051A0000-0x00000000051F0000-memory.dmp

Filesize
320KB

Download
memory/4840-78-0x00000000051A0000-0x00000000051F0000-memory.dmp

Filesize
320KB

Download
memory/4840-80-0x00000000051A0000-0x00000000051F0000-memory.dmp

Filesize
320KB

Download
memory/4840-82-0x00000000051A0000-0x00000000051F0000-memory.dmp

Filesize
320KB

Download
memory/4840-1143-0x0000000005190000-0x00000000051A0000-memory.dmp

Filesize
64KB

Download
memory/4840-1144-0x0000000005360000-0x00000000053C6000-memory.dmp

Filesize
408KB

Download
memory/4840-1145-0x0000000006690000-0x00000000066E0000-memory.dmp

Filesize
320KB

Download
memory/4840-1146-0x0000000006780000-0x000000000681C000-memory.dmp

Filesize
624KB

Download
memory/4840-1147-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/4840-1148-0x0000000074170000-0x0000000074920000-memory.dmp

Filesize
7.7MB

Download
memory/4840-1149-0x0000000005190000-0x00000000051A0000-memory.dmp

Filesize
64KB

Download
memory/4840-1150-0x0000000005190000-0x00000000051A0000-memory.dmp

Filesize
64KB

Download
memory/4840-1151-0x0000000005190000-0x00000000051A0000-memory.dmp

Filesize
64KB

Download
memory/4840-1152-0x00000000068C0000-0x0000000006952000-memory.dmp

Filesize
584KB

Download
memory/4840-1153-0x0000000006840000-0x000000000684A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads