Analysis
-
max time kernel
93s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
08-04-2024 01:18
Static task
static1
Behavioral task
behavioral1
Sample
401e45565b7f7e6756a5026e71b5408b5e3ab7448ecb73d62c2557e584047141.exe
Resource
win7-20240221-en
General
-
Target
401e45565b7f7e6756a5026e71b5408b5e3ab7448ecb73d62c2557e584047141.exe
-
Size
1.2MB
-
MD5
cf72b283e93d4a046e5d574a428b18f0
-
SHA1
fe793c28b4f4e4cbb4b235dad81acd0ab002bb01
-
SHA256
401e45565b7f7e6756a5026e71b5408b5e3ab7448ecb73d62c2557e584047141
-
SHA512
d464af83f46f7e14e6845879776155e0ef79601e67bc040ef140e6c5a97870c2d60b69d262d5902c2bfa2806c1e00ef9af71e36f112602811c27610c8bd918bf
-
SSDEEP
24576:UAHnh+eWsN3skA4RV1Hom2KXMmHaedfN2ffZ/socXiFi5:jh+ZkldoPK8Yaed1mZ/socSK
Malware Config
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Detect ZGRat V1 33 IoCs
Processes:
resource yara_rule behavioral2/memory/1428-15-0x00000000055B0000-0x0000000005604000-memory.dmp family_zgrat_v1 behavioral2/memory/1428-20-0x0000000005660000-0x00000000056B2000-memory.dmp family_zgrat_v1 behavioral2/memory/1428-26-0x0000000005660000-0x00000000056AC000-memory.dmp family_zgrat_v1 behavioral2/memory/1428-38-0x0000000005660000-0x00000000056AC000-memory.dmp family_zgrat_v1 behavioral2/memory/1428-36-0x0000000005660000-0x00000000056AC000-memory.dmp family_zgrat_v1 behavioral2/memory/1428-34-0x0000000005660000-0x00000000056AC000-memory.dmp family_zgrat_v1 behavioral2/memory/1428-40-0x0000000005660000-0x00000000056AC000-memory.dmp family_zgrat_v1 behavioral2/memory/1428-32-0x0000000005660000-0x00000000056AC000-memory.dmp family_zgrat_v1 behavioral2/memory/1428-42-0x0000000005660000-0x00000000056AC000-memory.dmp family_zgrat_v1 behavioral2/memory/1428-44-0x0000000005660000-0x00000000056AC000-memory.dmp family_zgrat_v1 behavioral2/memory/1428-30-0x0000000005660000-0x00000000056AC000-memory.dmp family_zgrat_v1 behavioral2/memory/1428-28-0x0000000005660000-0x00000000056AC000-memory.dmp family_zgrat_v1 behavioral2/memory/1428-46-0x0000000005660000-0x00000000056AC000-memory.dmp family_zgrat_v1 behavioral2/memory/1428-50-0x0000000005660000-0x00000000056AC000-memory.dmp family_zgrat_v1 behavioral2/memory/1428-52-0x0000000005660000-0x00000000056AC000-memory.dmp family_zgrat_v1 behavioral2/memory/1428-48-0x0000000005660000-0x00000000056AC000-memory.dmp family_zgrat_v1 behavioral2/memory/1428-24-0x0000000005660000-0x00000000056AC000-memory.dmp family_zgrat_v1 behavioral2/memory/1428-62-0x0000000005660000-0x00000000056AC000-memory.dmp family_zgrat_v1 behavioral2/memory/1428-68-0x0000000005660000-0x00000000056AC000-memory.dmp family_zgrat_v1 behavioral2/memory/1428-70-0x0000000005660000-0x00000000056AC000-memory.dmp family_zgrat_v1 behavioral2/memory/1428-72-0x0000000005660000-0x00000000056AC000-memory.dmp family_zgrat_v1 behavioral2/memory/1428-74-0x0000000005660000-0x00000000056AC000-memory.dmp family_zgrat_v1 behavioral2/memory/1428-78-0x0000000005660000-0x00000000056AC000-memory.dmp family_zgrat_v1 behavioral2/memory/1428-80-0x0000000005660000-0x00000000056AC000-memory.dmp family_zgrat_v1 behavioral2/memory/1428-76-0x0000000005660000-0x00000000056AC000-memory.dmp family_zgrat_v1 behavioral2/memory/1428-66-0x0000000005660000-0x00000000056AC000-memory.dmp family_zgrat_v1 behavioral2/memory/1428-64-0x0000000005660000-0x00000000056AC000-memory.dmp family_zgrat_v1 behavioral2/memory/1428-60-0x0000000005660000-0x00000000056AC000-memory.dmp family_zgrat_v1 behavioral2/memory/1428-58-0x0000000005660000-0x00000000056AC000-memory.dmp family_zgrat_v1 behavioral2/memory/1428-56-0x0000000005660000-0x00000000056AC000-memory.dmp family_zgrat_v1 behavioral2/memory/1428-54-0x0000000005660000-0x00000000056AC000-memory.dmp family_zgrat_v1 behavioral2/memory/1428-22-0x0000000005660000-0x00000000056AC000-memory.dmp family_zgrat_v1 behavioral2/memory/1428-21-0x0000000005660000-0x00000000056AC000-memory.dmp family_zgrat_v1 -
Suspicious use of SetThreadContext 1 IoCs
Processes:
401e45565b7f7e6756a5026e71b5408b5e3ab7448ecb73d62c2557e584047141.exedescription pid Process procid_target PID 4280 set thread context of 1428 4280 401e45565b7f7e6756a5026e71b5408b5e3ab7448ecb73d62c2557e584047141.exe 90 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
RegSvcs.exepid Process 1428 RegSvcs.exe 1428 RegSvcs.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
401e45565b7f7e6756a5026e71b5408b5e3ab7448ecb73d62c2557e584047141.exepid Process 4280 401e45565b7f7e6756a5026e71b5408b5e3ab7448ecb73d62c2557e584047141.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RegSvcs.exedescription pid Process Token: SeDebugPrivilege 1428 RegSvcs.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
401e45565b7f7e6756a5026e71b5408b5e3ab7448ecb73d62c2557e584047141.exepid Process 4280 401e45565b7f7e6756a5026e71b5408b5e3ab7448ecb73d62c2557e584047141.exe 4280 401e45565b7f7e6756a5026e71b5408b5e3ab7448ecb73d62c2557e584047141.exe -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
401e45565b7f7e6756a5026e71b5408b5e3ab7448ecb73d62c2557e584047141.exepid Process 4280 401e45565b7f7e6756a5026e71b5408b5e3ab7448ecb73d62c2557e584047141.exe 4280 401e45565b7f7e6756a5026e71b5408b5e3ab7448ecb73d62c2557e584047141.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
401e45565b7f7e6756a5026e71b5408b5e3ab7448ecb73d62c2557e584047141.exedescription pid Process procid_target PID 4280 wrote to memory of 1428 4280 401e45565b7f7e6756a5026e71b5408b5e3ab7448ecb73d62c2557e584047141.exe 90 PID 4280 wrote to memory of 1428 4280 401e45565b7f7e6756a5026e71b5408b5e3ab7448ecb73d62c2557e584047141.exe 90 PID 4280 wrote to memory of 1428 4280 401e45565b7f7e6756a5026e71b5408b5e3ab7448ecb73d62c2557e584047141.exe 90 PID 4280 wrote to memory of 1428 4280 401e45565b7f7e6756a5026e71b5408b5e3ab7448ecb73d62c2557e584047141.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\401e45565b7f7e6756a5026e71b5408b5e3ab7448ecb73d62c2557e584047141.exe"C:\Users\Admin\AppData\Local\Temp\401e45565b7f7e6756a5026e71b5408b5e3ab7448ecb73d62c2557e584047141.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4280 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\401e45565b7f7e6756a5026e71b5408b5e3ab7448ecb73d62c2557e584047141.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1428
-