Analysis

  • max time kernel
    93s
  • max time network
    128s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08-04-2024 01:18

General

  • Target

    401e45565b7f7e6756a5026e71b5408b5e3ab7448ecb73d62c2557e584047141.exe

  • Size

    1.2MB

  • MD5

    cf72b283e93d4a046e5d574a428b18f0

  • SHA1

    fe793c28b4f4e4cbb4b235dad81acd0ab002bb01

  • SHA256

    401e45565b7f7e6756a5026e71b5408b5e3ab7448ecb73d62c2557e584047141

  • SHA512

    d464af83f46f7e14e6845879776155e0ef79601e67bc040ef140e6c5a97870c2d60b69d262d5902c2bfa2806c1e00ef9af71e36f112602811c27610c8bd918bf

  • SSDEEP

    24576:UAHnh+eWsN3skA4RV1Hom2KXMmHaedfN2ffZ/socXiFi5:jh+ZkldoPK8Yaed1mZ/socSK

Malware Config

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Detect ZGRat V1 33 IoCs
  • ZGRat

    ZGRat is remote access trojan written in C#.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\401e45565b7f7e6756a5026e71b5408b5e3ab7448ecb73d62c2557e584047141.exe
    "C:\Users\Admin\AppData\Local\Temp\401e45565b7f7e6756a5026e71b5408b5e3ab7448ecb73d62c2557e584047141.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4280
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Users\Admin\AppData\Local\Temp\401e45565b7f7e6756a5026e71b5408b5e3ab7448ecb73d62c2557e584047141.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1428

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1428-11-0x0000000000400000-0x0000000000446000-memory.dmp

    Filesize

    280KB

  • memory/1428-12-0x0000000000400000-0x0000000000446000-memory.dmp

    Filesize

    280KB

  • memory/1428-14-0x0000000000400000-0x0000000000446000-memory.dmp

    Filesize

    280KB

  • memory/1428-13-0x0000000000400000-0x0000000000446000-memory.dmp

    Filesize

    280KB

  • memory/1428-15-0x00000000055B0000-0x0000000005604000-memory.dmp

    Filesize

    336KB

  • memory/1428-17-0x0000000005650000-0x0000000005660000-memory.dmp

    Filesize

    64KB

  • memory/1428-16-0x0000000074880000-0x0000000075030000-memory.dmp

    Filesize

    7.7MB

  • memory/1428-18-0x0000000005650000-0x0000000005660000-memory.dmp

    Filesize

    64KB

  • memory/1428-20-0x0000000005660000-0x00000000056B2000-memory.dmp

    Filesize

    328KB

  • memory/1428-19-0x0000000005C10000-0x00000000061B4000-memory.dmp

    Filesize

    5.6MB

  • memory/1428-26-0x0000000005660000-0x00000000056AC000-memory.dmp

    Filesize

    304KB

  • memory/1428-38-0x0000000005660000-0x00000000056AC000-memory.dmp

    Filesize

    304KB

  • memory/1428-36-0x0000000005660000-0x00000000056AC000-memory.dmp

    Filesize

    304KB

  • memory/1428-34-0x0000000005660000-0x00000000056AC000-memory.dmp

    Filesize

    304KB

  • memory/1428-40-0x0000000005660000-0x00000000056AC000-memory.dmp

    Filesize

    304KB

  • memory/1428-32-0x0000000005660000-0x00000000056AC000-memory.dmp

    Filesize

    304KB

  • memory/1428-42-0x0000000005660000-0x00000000056AC000-memory.dmp

    Filesize

    304KB

  • memory/1428-44-0x0000000005660000-0x00000000056AC000-memory.dmp

    Filesize

    304KB

  • memory/1428-30-0x0000000005660000-0x00000000056AC000-memory.dmp

    Filesize

    304KB

  • memory/1428-28-0x0000000005660000-0x00000000056AC000-memory.dmp

    Filesize

    304KB

  • memory/1428-46-0x0000000005660000-0x00000000056AC000-memory.dmp

    Filesize

    304KB

  • memory/1428-50-0x0000000005660000-0x00000000056AC000-memory.dmp

    Filesize

    304KB

  • memory/1428-52-0x0000000005660000-0x00000000056AC000-memory.dmp

    Filesize

    304KB

  • memory/1428-48-0x0000000005660000-0x00000000056AC000-memory.dmp

    Filesize

    304KB

  • memory/1428-24-0x0000000005660000-0x00000000056AC000-memory.dmp

    Filesize

    304KB

  • memory/1428-62-0x0000000005660000-0x00000000056AC000-memory.dmp

    Filesize

    304KB

  • memory/1428-68-0x0000000005660000-0x00000000056AC000-memory.dmp

    Filesize

    304KB

  • memory/1428-70-0x0000000005660000-0x00000000056AC000-memory.dmp

    Filesize

    304KB

  • memory/1428-72-0x0000000005660000-0x00000000056AC000-memory.dmp

    Filesize

    304KB

  • memory/1428-74-0x0000000005660000-0x00000000056AC000-memory.dmp

    Filesize

    304KB

  • memory/1428-78-0x0000000005660000-0x00000000056AC000-memory.dmp

    Filesize

    304KB

  • memory/1428-80-0x0000000005660000-0x00000000056AC000-memory.dmp

    Filesize

    304KB

  • memory/1428-76-0x0000000005660000-0x00000000056AC000-memory.dmp

    Filesize

    304KB

  • memory/1428-66-0x0000000005660000-0x00000000056AC000-memory.dmp

    Filesize

    304KB

  • memory/1428-64-0x0000000005660000-0x00000000056AC000-memory.dmp

    Filesize

    304KB

  • memory/1428-60-0x0000000005660000-0x00000000056AC000-memory.dmp

    Filesize

    304KB

  • memory/1428-58-0x0000000005660000-0x00000000056AC000-memory.dmp

    Filesize

    304KB

  • memory/1428-56-0x0000000005660000-0x00000000056AC000-memory.dmp

    Filesize

    304KB

  • memory/1428-54-0x0000000005660000-0x00000000056AC000-memory.dmp

    Filesize

    304KB

  • memory/1428-22-0x0000000005660000-0x00000000056AC000-memory.dmp

    Filesize

    304KB

  • memory/1428-21-0x0000000005660000-0x00000000056AC000-memory.dmp

    Filesize

    304KB

  • memory/1428-1051-0x0000000005650000-0x0000000005660000-memory.dmp

    Filesize

    64KB

  • memory/1428-1052-0x0000000005860000-0x00000000058C6000-memory.dmp

    Filesize

    408KB

  • memory/1428-1053-0x0000000006680000-0x00000000066D0000-memory.dmp

    Filesize

    320KB

  • memory/1428-1054-0x0000000006770000-0x0000000006802000-memory.dmp

    Filesize

    584KB

  • memory/1428-1055-0x00000000066D0000-0x00000000066DA000-memory.dmp

    Filesize

    40KB

  • memory/1428-1056-0x0000000000400000-0x0000000000446000-memory.dmp

    Filesize

    280KB

  • memory/1428-1057-0x0000000074880000-0x0000000075030000-memory.dmp

    Filesize

    7.7MB

  • memory/1428-1058-0x0000000005650000-0x0000000005660000-memory.dmp

    Filesize

    64KB

  • memory/4280-10-0x0000000004780000-0x0000000004784000-memory.dmp

    Filesize

    16KB