Overview

overview

10

Static

static

10

222370596f...9a.exe

windows7-x64

10

222370596f...9a.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    95s
  • max time network
    127s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29-03-2024 02:07

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    222370596f59183040772e971c9b262d1fa1aba5386b448e423c6cff2d23319a.exe

  • Size

    867KB

  • MD5

    2c520c9db37e16343941bbba36fc22ef

  • SHA1

    b168bb726e9ec94166e60cc3d502843058ede5a4

  • SHA256

    222370596f59183040772e971c9b262d1fa1aba5386b448e423c6cff2d23319a

  • SHA512

    097379427ac91ccde3e7cf09223a8f6a9955c77c786d975e78aa7c5a5e693b92c172322ecc6c32dfc80e4ae2964c805f11ac0268afd95aa82921b296666d758a

  • SSDEEP

    12288:Z6Wq4aaE6KwyF5L0Y2D1PqL/2p7v95HcYuHfWpKbyiJZUHKA4b5:vthEVaPqLOp7v954uMbyiJWHKAK5

Score
10/10
agentteslazgratkeyloggerratspywarestealertrojanupx

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot6811787827:AAEr4cj8xrQKX5i6BnPzE4vzpRaL4EziTo4/

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla
  • Detect ZGRat V1 33 IoCs
  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat
  • Detect packed .NET executables. Mostly AgentTeslaV4. 33 IoCs
  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 33 IoCs
  • Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 33 IoCs
  • Detects executables referencing Windows vault credential objects. Observed in infostealers 33 IoCs
  • Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers 33 IoCs
  • Detects executables referencing many email and collaboration clients. Observed in information stealers 33 IoCs
  • Detects executables referencing many file transfer clients. Observed in information stealers 33 IoCs
  • UPX dump on OEP (original entry point) 2 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\222370596f59183040772e971c9b262d1fa1aba5386b448e423c6cff2d23319a.exe
    "C:\Users\Admin\AppData\Local\Temp\222370596f59183040772e971c9b262d1fa1aba5386b448e423c6cff2d23319a.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1916
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Users\Admin\AppData\Local\Temp\222370596f59183040772e971c9b262d1fa1aba5386b448e423c6cff2d23319a.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5020

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\aut33E1.tmp
    Filesize

    262KB

    MD5

    0640ead3d46b6c0d03329465e335daa8

    SHA1

    077a512a096bc44a644f6effb2f7b9d29e5fb1ce

    SHA256

    c5f4b6c2f000f82540e97ee79b27d36cc1ccc0d5723427a98022908711af76c0

    SHA512

    4eb42091437ccab1cd62fdd2574a87582dc55d6ee40e4f84eafbe493e4a92b09bf6f1318bf2c602c846fb723076a3d9c17f79dd9392c3715560197ee2b0ebc3f

    Download Submit
  • memory/1916-0-0x0000000000400000-0x0000000000540000-memory.dmp
    Filesize

    1.2MB

    Download
  • memory/1916-13-0x00000000034A0000-0x00000000034A4000-memory.dmp
    Filesize

    16KB

    Download
  • memory/1916-16-0x0000000000400000-0x0000000000540000-memory.dmp
    Filesize

    1.2MB

    Download
  • memory/5020-14-0x0000000000400000-0x0000000000446000-memory.dmp
    Filesize

    280KB

    Download
  • memory/5020-15-0x0000000000400000-0x0000000000446000-memory.dmp
    Filesize

    280KB

    Download
  • memory/5020-17-0x0000000000400000-0x0000000000446000-memory.dmp
    Filesize

    280KB

    Download
  • memory/5020-18-0x0000000000400000-0x0000000000446000-memory.dmp
    Filesize

    280KB

    Download
  • memory/5020-19-0x0000000005050000-0x00000000050A4000-memory.dmp
    Filesize

    336KB

    Download
  • memory/5020-20-0x0000000073830000-0x0000000073FE0000-memory.dmp
    Filesize

    7.7MB

    Download
  • memory/5020-21-0x0000000005160000-0x0000000005170000-memory.dmp
    Filesize

    64KB

    Download
  • memory/5020-22-0x0000000005720000-0x0000000005CC4000-memory.dmp
    Filesize

    5.6MB

    Download
  • memory/5020-23-0x00000000050F0000-0x0000000005144000-memory.dmp
    Filesize

    336KB

    Download
  • memory/5020-24-0x00000000050F0000-0x000000000513D000-memory.dmp
    Filesize

    308KB

    Download
  • memory/5020-27-0x00000000050F0000-0x000000000513D000-memory.dmp
    Filesize

    308KB

    Download
  • memory/5020-25-0x00000000050F0000-0x000000000513D000-memory.dmp
    Filesize

    308KB

    Download
  • memory/5020-29-0x00000000050F0000-0x000000000513D000-memory.dmp
    Filesize

    308KB

    Download
  • memory/5020-31-0x00000000050F0000-0x000000000513D000-memory.dmp
    Filesize

    308KB

    Download
  • memory/5020-33-0x00000000050F0000-0x000000000513D000-memory.dmp
    Filesize

    308KB

    Download
  • memory/5020-35-0x00000000050F0000-0x000000000513D000-memory.dmp
    Filesize

    308KB

    Download
  • memory/5020-37-0x00000000050F0000-0x000000000513D000-memory.dmp
    Filesize

    308KB

    Download
  • memory/5020-39-0x00000000050F0000-0x000000000513D000-memory.dmp
    Filesize

    308KB

    Download
  • memory/5020-41-0x00000000050F0000-0x000000000513D000-memory.dmp
    Filesize

    308KB

    Download
  • memory/5020-43-0x00000000050F0000-0x000000000513D000-memory.dmp
    Filesize

    308KB

    Download
  • memory/5020-45-0x00000000050F0000-0x000000000513D000-memory.dmp
    Filesize

    308KB

    Download
  • memory/5020-47-0x00000000050F0000-0x000000000513D000-memory.dmp
    Filesize

    308KB

    Download
  • memory/5020-49-0x00000000050F0000-0x000000000513D000-memory.dmp
    Filesize

    308KB

    Download
  • memory/5020-51-0x00000000050F0000-0x000000000513D000-memory.dmp
    Filesize

    308KB

    Download
  • memory/5020-53-0x00000000050F0000-0x000000000513D000-memory.dmp
    Filesize

    308KB

    Download
  • memory/5020-55-0x00000000050F0000-0x000000000513D000-memory.dmp
    Filesize

    308KB

    Download
  • memory/5020-57-0x00000000050F0000-0x000000000513D000-memory.dmp
    Filesize

    308KB

    Download
  • memory/5020-59-0x00000000050F0000-0x000000000513D000-memory.dmp
    Filesize

    308KB

    Download
  • memory/5020-61-0x00000000050F0000-0x000000000513D000-memory.dmp
    Filesize

    308KB

    Download
  • memory/5020-63-0x00000000050F0000-0x000000000513D000-memory.dmp
    Filesize

    308KB

    Download
  • memory/5020-65-0x00000000050F0000-0x000000000513D000-memory.dmp
    Filesize

    308KB

    Download
  • memory/5020-67-0x00000000050F0000-0x000000000513D000-memory.dmp
    Filesize

    308KB

    Download
  • memory/5020-69-0x00000000050F0000-0x000000000513D000-memory.dmp
    Filesize

    308KB

    Download
  • memory/5020-71-0x00000000050F0000-0x000000000513D000-memory.dmp
    Filesize

    308KB

    Download
  • memory/5020-73-0x00000000050F0000-0x000000000513D000-memory.dmp
    Filesize

    308KB

    Download
  • memory/5020-75-0x00000000050F0000-0x000000000513D000-memory.dmp
    Filesize

    308KB

    Download
  • memory/5020-77-0x00000000050F0000-0x000000000513D000-memory.dmp
    Filesize

    308KB

    Download
  • memory/5020-79-0x00000000050F0000-0x000000000513D000-memory.dmp
    Filesize

    308KB

    Download
  • memory/5020-81-0x00000000050F0000-0x000000000513D000-memory.dmp
    Filesize

    308KB

    Download
  • memory/5020-83-0x00000000050F0000-0x000000000513D000-memory.dmp
    Filesize

    308KB

    Download
  • memory/5020-1070-0x0000000005160000-0x0000000005170000-memory.dmp
    Filesize

    64KB

    Download
  • memory/5020-1071-0x0000000005300000-0x0000000005366000-memory.dmp
    Filesize

    408KB

    Download
  • memory/5020-1072-0x00000000064F0000-0x0000000006582000-memory.dmp
    Filesize

    584KB

    Download
  • memory/5020-1073-0x0000000006590000-0x00000000065E0000-memory.dmp
    Filesize

    320KB

    Download
  • memory/5020-1074-0x0000000006600000-0x000000000660A000-memory.dmp
    Filesize

    40KB

    Download
  • memory/5020-1075-0x0000000000400000-0x0000000000446000-memory.dmp
    Filesize

    280KB

    Download
  • memory/5020-1076-0x0000000073830000-0x0000000073FE0000-memory.dmp
    Filesize

    7.7MB

    Download
  • memory/5020-1077-0x0000000005160000-0x0000000005170000-memory.dmp
    Filesize

    64KB

    Download