agenttesla | 40f217fa3f84e58e8ddb7f29a6c1ca87da3ebf0c1cbf1db875befb6e639f1ed4

General

Target

40f217fa3f84e58e8ddb7f29a6c1ca87da3ebf0c1cbf1db875befb6e639f1ed4.exe
Size

1.1MB
MD5

ddc7674fce48177e9f6368a9587fdedb
SHA1

d48fb859350da04e24e306c809071b4e8c4d5c0c
SHA256

40f217fa3f84e58e8ddb7f29a6c1ca87da3ebf0c1cbf1db875befb6e639f1ed4
SHA512

3ef57451003b40e0666b8c7d629bfa4e7a871e2695c0a7644b22e84a0ee271479182629d54f78fa762221b4f9884d5143cbdae06453b8a74b200d6c948096273
SSDEEP

24576:vAHnh+eWsN3skA4RV1Hom2KXMmHat1YKQULjNMFpgAbConoP5:Sh+ZkldoPK8Yat1YKvXNMFG4Con8

Score

10^/10

agenttesla zgrat keylogger rat spyware stealer trojan

Malware Config

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Detect ZGRat V1 33 IoCs

Processes:

resource	yara_rule
behavioral2/memory/556-17-0x0000000002C20000-0x0000000002C76000-memory.dmp	family_zgrat_v1
behavioral2/memory/556-23-0x0000000002CB0000-0x0000000002D04000-memory.dmp	family_zgrat_v1
behavioral2/memory/556-29-0x0000000002CB0000-0x0000000002CFE000-memory.dmp	family_zgrat_v1
behavioral2/memory/556-35-0x0000000002CB0000-0x0000000002CFE000-memory.dmp	family_zgrat_v1
behavioral2/memory/556-33-0x0000000002CB0000-0x0000000002CFE000-memory.dmp	family_zgrat_v1
behavioral2/memory/556-39-0x0000000002CB0000-0x0000000002CFE000-memory.dmp	family_zgrat_v1
behavioral2/memory/556-37-0x0000000002CB0000-0x0000000002CFE000-memory.dmp	family_zgrat_v1
behavioral2/memory/556-41-0x0000000002CB0000-0x0000000002CFE000-memory.dmp	family_zgrat_v1
behavioral2/memory/556-31-0x0000000002CB0000-0x0000000002CFE000-memory.dmp	family_zgrat_v1
behavioral2/memory/556-43-0x0000000002CB0000-0x0000000002CFE000-memory.dmp	family_zgrat_v1
behavioral2/memory/556-27-0x0000000002CB0000-0x0000000002CFE000-memory.dmp	family_zgrat_v1
behavioral2/memory/556-25-0x0000000002CB0000-0x0000000002CFE000-memory.dmp	family_zgrat_v1
behavioral2/memory/556-24-0x0000000002CB0000-0x0000000002CFE000-memory.dmp	family_zgrat_v1
behavioral2/memory/556-45-0x0000000002CB0000-0x0000000002CFE000-memory.dmp	family_zgrat_v1
behavioral2/memory/556-49-0x0000000002CB0000-0x0000000002CFE000-memory.dmp	family_zgrat_v1
behavioral2/memory/556-47-0x0000000002CB0000-0x0000000002CFE000-memory.dmp	family_zgrat_v1
behavioral2/memory/556-51-0x0000000002CB0000-0x0000000002CFE000-memory.dmp	family_zgrat_v1
behavioral2/memory/556-53-0x0000000002CB0000-0x0000000002CFE000-memory.dmp	family_zgrat_v1
behavioral2/memory/556-57-0x0000000002CB0000-0x0000000002CFE000-memory.dmp	family_zgrat_v1
behavioral2/memory/556-55-0x0000000002CB0000-0x0000000002CFE000-memory.dmp	family_zgrat_v1
behavioral2/memory/556-59-0x0000000002CB0000-0x0000000002CFE000-memory.dmp	family_zgrat_v1
behavioral2/memory/556-61-0x0000000002CB0000-0x0000000002CFE000-memory.dmp	family_zgrat_v1
behavioral2/memory/556-65-0x0000000002CB0000-0x0000000002CFE000-memory.dmp	family_zgrat_v1
behavioral2/memory/556-63-0x0000000002CB0000-0x0000000002CFE000-memory.dmp	family_zgrat_v1
behavioral2/memory/556-69-0x0000000002CB0000-0x0000000002CFE000-memory.dmp	family_zgrat_v1
behavioral2/memory/556-71-0x0000000002CB0000-0x0000000002CFE000-memory.dmp	family_zgrat_v1
behavioral2/memory/556-73-0x0000000002CB0000-0x0000000002CFE000-memory.dmp	family_zgrat_v1
behavioral2/memory/556-77-0x0000000002CB0000-0x0000000002CFE000-memory.dmp	family_zgrat_v1
behavioral2/memory/556-83-0x0000000002CB0000-0x0000000002CFE000-memory.dmp	family_zgrat_v1
behavioral2/memory/556-81-0x0000000002CB0000-0x0000000002CFE000-memory.dmp	family_zgrat_v1
behavioral2/memory/556-79-0x0000000002CB0000-0x0000000002CFE000-memory.dmp	family_zgrat_v1
behavioral2/memory/556-75-0x0000000002CB0000-0x0000000002CFE000-memory.dmp	family_zgrat_v1
behavioral2/memory/556-67-0x0000000002CB0000-0x0000000002CFE000-memory.dmp	family_zgrat_v1

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

34 ip-api.com

flow	ioc
34	ip-api.com

Suspicious use of SetThreadContext 1 IoCs

Processes:

40f217fa3f84e58e8ddb7f29a6c1ca87da3ebf0c1cbf1db875befb6e639f1ed4.exe

description	pid	process	target process
PID 4940 set thread context of 556	4940	40f217fa3f84e58e8ddb7f29a6c1ca87da3ebf0c1cbf1db875befb6e639f1ed4.exe	RegSvcs.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

RegSvcs.exe

pid process

556 RegSvcs.exe
556 RegSvcs.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

40f217fa3f84e58e8ddb7f29a6c1ca87da3ebf0c1cbf1db875befb6e639f1ed4.exe

pid process

4940 40f217fa3f84e58e8ddb7f29a6c1ca87da3ebf0c1cbf1db875befb6e639f1ed4.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RegSvcs.exe

description pid process

Token: SeDebugPrivilege 556 RegSvcs.exe

pid	process
556	RegSvcs.exe
556	RegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	556	RegSvcs.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

40f217fa3f84e58e8ddb7f29a6c1ca87da3ebf0c1cbf1db875befb6e639f1ed4.exe

pid	process
4940	40f217fa3f84e58e8ddb7f29a6c1ca87da3ebf0c1cbf1db875befb6e639f1ed4.exe
4940	40f217fa3f84e58e8ddb7f29a6c1ca87da3ebf0c1cbf1db875befb6e639f1ed4.exe

Suspicious use of SendNotifyMessage 2 IoCs

Processes:

40f217fa3f84e58e8ddb7f29a6c1ca87da3ebf0c1cbf1db875befb6e639f1ed4.exe

pid	process
4940	40f217fa3f84e58e8ddb7f29a6c1ca87da3ebf0c1cbf1db875befb6e639f1ed4.exe
4940	40f217fa3f84e58e8ddb7f29a6c1ca87da3ebf0c1cbf1db875befb6e639f1ed4.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

40f217fa3f84e58e8ddb7f29a6c1ca87da3ebf0c1cbf1db875befb6e639f1ed4.exe

description	pid	process	target process
PID 4940 wrote to memory of 556	4940	40f217fa3f84e58e8ddb7f29a6c1ca87da3ebf0c1cbf1db875befb6e639f1ed4.exe	RegSvcs.exe
PID 4940 wrote to memory of 556	4940	40f217fa3f84e58e8ddb7f29a6c1ca87da3ebf0c1cbf1db875befb6e639f1ed4.exe	RegSvcs.exe
PID 4940 wrote to memory of 556	4940	40f217fa3f84e58e8ddb7f29a6c1ca87da3ebf0c1cbf1db875befb6e639f1ed4.exe	RegSvcs.exe
PID 4940 wrote to memory of 556	4940	40f217fa3f84e58e8ddb7f29a6c1ca87da3ebf0c1cbf1db875befb6e639f1ed4.exe	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\40f217fa3f84e58e8ddb7f29a6c1ca87da3ebf0c1cbf1db875befb6e639f1ed4.exe
"C:\Users\Admin\AppData\Local\Temp\40f217fa3f84e58e8ddb7f29a6c1ca87da3ebf0c1cbf1db875befb6e639f1ed4.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4940

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Users\Admin\AppData\Local\Temp\40f217fa3f84e58e8ddb7f29a6c1ca87da3ebf0c1cbf1db875befb6e639f1ed4.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:556

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\autC4C7.tmp
Filesize
263KB

MD5
ff328d958dc9e63ccf0746083daea81f

SHA1
d6bbeafc2c274a8ea90fe2c5e0c11867e5f3cf4d

SHA256
e951e7fb4976f483b7919b24961e35805213402692f29300c306bd7f50d20210

SHA512
6cc3b472807470772607d4310c2b9aaff7f5286aa9897df20bbddccc20b2fc772f7a880d5af04f0b03561d5c777aeb686821dd526827ad74d6c961bc242f828a

Download Submit
memory/556-14-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/556-16-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/556-15-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/556-13-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/556-17-0x0000000002C20000-0x0000000002C76000-memory.dmp

Filesize
344KB

Download
memory/556-19-0x00000000051D0000-0x00000000051E0000-memory.dmp

Filesize
64KB

Download
memory/556-18-0x0000000073920000-0x00000000740D0000-memory.dmp

Filesize
7.7MB

Download
memory/556-21-0x00000000051D0000-0x00000000051E0000-memory.dmp

Filesize
64KB

Download
memory/556-20-0x00000000051D0000-0x00000000051E0000-memory.dmp

Filesize
64KB

Download
memory/556-22-0x0000000005790000-0x0000000005D34000-memory.dmp

Filesize
5.6MB

Download
memory/556-23-0x0000000002CB0000-0x0000000002D04000-memory.dmp

Filesize
336KB

Download
memory/556-29-0x0000000002CB0000-0x0000000002CFE000-memory.dmp

Filesize
312KB

Download
memory/556-35-0x0000000002CB0000-0x0000000002CFE000-memory.dmp

Filesize
312KB

Download
memory/556-33-0x0000000002CB0000-0x0000000002CFE000-memory.dmp

Filesize
312KB

Download
memory/556-39-0x0000000002CB0000-0x0000000002CFE000-memory.dmp

Filesize
312KB

Download
memory/556-37-0x0000000002CB0000-0x0000000002CFE000-memory.dmp

Filesize
312KB

Download
memory/556-41-0x0000000002CB0000-0x0000000002CFE000-memory.dmp

Filesize
312KB

Download
memory/556-31-0x0000000002CB0000-0x0000000002CFE000-memory.dmp

Filesize
312KB

Download
memory/556-43-0x0000000002CB0000-0x0000000002CFE000-memory.dmp

Filesize
312KB

Download
memory/556-27-0x0000000002CB0000-0x0000000002CFE000-memory.dmp

Filesize
312KB

Download
memory/556-25-0x0000000002CB0000-0x0000000002CFE000-memory.dmp

Filesize
312KB

Download
memory/556-24-0x0000000002CB0000-0x0000000002CFE000-memory.dmp

Filesize
312KB

Download
memory/556-45-0x0000000002CB0000-0x0000000002CFE000-memory.dmp

Filesize
312KB

Download
memory/556-49-0x0000000002CB0000-0x0000000002CFE000-memory.dmp

Filesize
312KB

Download
memory/556-47-0x0000000002CB0000-0x0000000002CFE000-memory.dmp

Filesize
312KB

Download
memory/556-51-0x0000000002CB0000-0x0000000002CFE000-memory.dmp

Filesize
312KB

Download
memory/556-53-0x0000000002CB0000-0x0000000002CFE000-memory.dmp

Filesize
312KB

Download
memory/556-57-0x0000000002CB0000-0x0000000002CFE000-memory.dmp

Filesize
312KB

Download
memory/556-55-0x0000000002CB0000-0x0000000002CFE000-memory.dmp

Filesize
312KB

Download
memory/556-59-0x0000000002CB0000-0x0000000002CFE000-memory.dmp

Filesize
312KB

Download
memory/556-61-0x0000000002CB0000-0x0000000002CFE000-memory.dmp

Filesize
312KB

Download
memory/556-65-0x0000000002CB0000-0x0000000002CFE000-memory.dmp

Filesize
312KB

Download
memory/556-63-0x0000000002CB0000-0x0000000002CFE000-memory.dmp

Filesize
312KB

Download
memory/556-69-0x0000000002CB0000-0x0000000002CFE000-memory.dmp

Filesize
312KB

Download
memory/556-71-0x0000000002CB0000-0x0000000002CFE000-memory.dmp

Filesize
312KB

Download
memory/556-73-0x0000000002CB0000-0x0000000002CFE000-memory.dmp

Filesize
312KB

Download
memory/556-77-0x0000000002CB0000-0x0000000002CFE000-memory.dmp

Filesize
312KB

Download
memory/556-83-0x0000000002CB0000-0x0000000002CFE000-memory.dmp

Filesize
312KB

Download
memory/556-81-0x0000000002CB0000-0x0000000002CFE000-memory.dmp

Filesize
312KB

Download
memory/556-79-0x0000000002CB0000-0x0000000002CFE000-memory.dmp

Filesize
312KB

Download
memory/556-75-0x0000000002CB0000-0x0000000002CFE000-memory.dmp

Filesize
312KB

Download
memory/556-67-0x0000000002CB0000-0x0000000002CFE000-memory.dmp

Filesize
312KB

Download
memory/556-1068-0x00000000051D0000-0x00000000051E0000-memory.dmp

Filesize
64KB

Download
memory/556-1069-0x0000000005250000-0x00000000052B6000-memory.dmp

Filesize
408KB

Download
memory/556-1070-0x00000000063F0000-0x0000000006440000-memory.dmp

Filesize
320KB

Download
memory/556-1071-0x00000000064E0000-0x0000000006572000-memory.dmp

Filesize
584KB

Download
memory/556-1072-0x0000000006460000-0x000000000646A000-memory.dmp

Filesize
40KB

Download
memory/556-1073-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/556-1074-0x0000000073920000-0x00000000740D0000-memory.dmp

Filesize
7.7MB

Download
memory/556-1075-0x00000000051D0000-0x00000000051E0000-memory.dmp

Filesize
64KB

Download
memory/556-1076-0x00000000051D0000-0x00000000051E0000-memory.dmp

Filesize
64KB

Download
memory/556-1077-0x00000000051D0000-0x00000000051E0000-memory.dmp

Filesize
64KB

Download
memory/4940-12-0x0000000000F70000-0x0000000000F74000-memory.dmp

Filesize
16KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads