Analysis
- max time kernel
147s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20240319-en - resource tags
- submitted
03/04/2024, 12:51
General
- Target 7b857e330ceb46169459dee53b346a6016660aea63bcc3b7c8df033cf01515eb.exe
- Size 1.3MB
- Sample240403-p3gmdsdc7z
- SHA256 7b857e330ceb46169459dee53b346a6016660aea63bcc3b7c8df033cf01515eb
Malware Config
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Detect ZGRat V1 33 IoCs
- ZGRat
ZGRat is remote access trojan written in C#.
- Adds Run key to start application 2 TTPs 1 IoCs
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7b857e330ceb46169459dee53b346a6016660aea63bcc3b7c8df033cf01515eb.exe"C:\Users\Admin\AppData\Local\Temp\7b857e330ceb46169459dee53b346a6016660aea63bcc3b7c8df033cf01515eb.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\7b857e330ceb46169459dee53b346a6016660aea63bcc3b7c8df033cf01515eb.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1416 --field-trial-handle=2000,i,9877262470271371196,11878025205711850266,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/488-10-0x00000000017D0000-0x00000000017D4000-memory.dmp
memory/4908-11-0x0000000000400000-0x0000000000446000-memory.dmp
memory/4908-12-0x0000000000400000-0x0000000000446000-memory.dmp
memory/4908-13-0x0000000000400000-0x0000000000446000-memory.dmp
memory/4908-14-0x0000000000400000-0x0000000000446000-memory.dmp
memory/4908-15-0x0000000002D40000-0x0000000002D94000-memory.dmp
memory/4908-16-0x00000000747B0000-0x0000000074F60000-memory.dmp
memory/4908-17-0x0000000002BE0000-0x0000000002BF0000-memory.dmp
memory/4908-18-0x0000000002BE0000-0x0000000002BF0000-memory.dmp
memory/4908-19-0x0000000005790000-0x0000000005D34000-memory.dmp
memory/4908-20-0x00000000051E0000-0x0000000005232000-memory.dmp
memory/4908-21-0x00000000051E0000-0x000000000522D000-memory.dmp
memory/4908-22-0x00000000051E0000-0x000000000522D000-memory.dmp
memory/4908-24-0x00000000051E0000-0x000000000522D000-memory.dmp
memory/4908-26-0x00000000051E0000-0x000000000522D000-memory.dmp
memory/4908-28-0x00000000051E0000-0x000000000522D000-memory.dmp
memory/4908-30-0x00000000051E0000-0x000000000522D000-memory.dmp
memory/4908-32-0x00000000051E0000-0x000000000522D000-memory.dmp
memory/4908-34-0x00000000051E0000-0x000000000522D000-memory.dmp
memory/4908-36-0x00000000051E0000-0x000000000522D000-memory.dmp
memory/4908-38-0x00000000051E0000-0x000000000522D000-memory.dmp
memory/4908-40-0x00000000051E0000-0x000000000522D000-memory.dmp
memory/4908-44-0x00000000051E0000-0x000000000522D000-memory.dmp
memory/4908-46-0x00000000051E0000-0x000000000522D000-memory.dmp
memory/4908-42-0x00000000051E0000-0x000000000522D000-memory.dmp
memory/4908-48-0x00000000051E0000-0x000000000522D000-memory.dmp
memory/4908-50-0x00000000051E0000-0x000000000522D000-memory.dmp
memory/4908-52-0x00000000051E0000-0x000000000522D000-memory.dmp
memory/4908-54-0x00000000051E0000-0x000000000522D000-memory.dmp
memory/4908-56-0x00000000051E0000-0x000000000522D000-memory.dmp
memory/4908-58-0x00000000051E0000-0x000000000522D000-memory.dmp
memory/4908-60-0x00000000051E0000-0x000000000522D000-memory.dmp
memory/4908-62-0x00000000051E0000-0x000000000522D000-memory.dmp
memory/4908-64-0x00000000051E0000-0x000000000522D000-memory.dmp
memory/4908-66-0x00000000051E0000-0x000000000522D000-memory.dmp
memory/4908-68-0x00000000051E0000-0x000000000522D000-memory.dmp
memory/4908-70-0x00000000051E0000-0x000000000522D000-memory.dmp
memory/4908-72-0x00000000051E0000-0x000000000522D000-memory.dmp
memory/4908-74-0x00000000051E0000-0x000000000522D000-memory.dmp
memory/4908-76-0x00000000051E0000-0x000000000522D000-memory.dmp
memory/4908-78-0x00000000051E0000-0x000000000522D000-memory.dmp
memory/4908-80-0x00000000051E0000-0x000000000522D000-memory.dmp
memory/4908-1055-0x0000000002BE0000-0x0000000002BF0000-memory.dmp
memory/4908-1056-0x00000000053A0000-0x0000000005406000-memory.dmp
memory/4908-1058-0x00000000066B0000-0x0000000006700000-memory.dmp
memory/4908-1059-0x00000000067A0000-0x0000000006832000-memory.dmp
memory/4908-1060-0x0000000006790000-0x000000000679A000-memory.dmp
memory/4908-1061-0x00000000747B0000-0x0000000074F60000-memory.dmp
memory/4908-1062-0x0000000000400000-0x0000000000446000-memory.dmp
memory/4908-1063-0x0000000002BE0000-0x0000000002BF0000-memory.dmp
memory/4908-1064-0x0000000002BE0000-0x0000000002BF0000-memory.dmp
memory/4908-1065-0x0000000002BE0000-0x0000000002BF0000-memory.dmp