Analysis
-
max time kernel
141s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
24-04-2024 02:28
Static task
static1
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20240221-en
General
-
Target
tmp.exe
-
Size
1.3MB
-
MD5
f5f8fafcfec35eae5610bceebcdac898
-
SHA1
8dc1e3d6066a0694d6a97662772dd67b7ce1442e
-
SHA256
06cbb214e44791a90b28dc4df31057d48c7ec87a0ed3567cdcd8b7dd0da8625d
-
SHA512
f3ddb08fc2893f5d5372b990ed43d7076a51b8245c87a438763ffe39a39cb100190e91e812e78ad48cce6fa4de5293e278d3cff4007521aee94d718fd3c709d3
-
SSDEEP
24576:hAHnh+eWsN3skA4RV1Hom2KXMmHaLli8dqKGDGDpA5:4h+ZkldoPK8YaLjddGB
Malware Config
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Detect ZGRat V1 33 IoCs
Processes:
resource yara_rule behavioral2/memory/4112-17-0x0000000005810000-0x0000000005864000-memory.dmp family_zgrat_v1 behavioral2/memory/4112-19-0x00000000058D0000-0x0000000005922000-memory.dmp family_zgrat_v1 behavioral2/memory/4112-23-0x00000000058D0000-0x000000000591D000-memory.dmp family_zgrat_v1 behavioral2/memory/4112-33-0x00000000058D0000-0x000000000591D000-memory.dmp family_zgrat_v1 behavioral2/memory/4112-37-0x00000000058D0000-0x000000000591D000-memory.dmp family_zgrat_v1 behavioral2/memory/4112-49-0x00000000058D0000-0x000000000591D000-memory.dmp family_zgrat_v1 behavioral2/memory/4112-51-0x00000000058D0000-0x000000000591D000-memory.dmp family_zgrat_v1 behavioral2/memory/4112-47-0x00000000058D0000-0x000000000591D000-memory.dmp family_zgrat_v1 behavioral2/memory/4112-55-0x00000000058D0000-0x000000000591D000-memory.dmp family_zgrat_v1 behavioral2/memory/4112-59-0x00000000058D0000-0x000000000591D000-memory.dmp family_zgrat_v1 behavioral2/memory/4112-57-0x00000000058D0000-0x000000000591D000-memory.dmp family_zgrat_v1 behavioral2/memory/4112-63-0x00000000058D0000-0x000000000591D000-memory.dmp family_zgrat_v1 behavioral2/memory/4112-65-0x00000000058D0000-0x000000000591D000-memory.dmp family_zgrat_v1 behavioral2/memory/4112-67-0x00000000058D0000-0x000000000591D000-memory.dmp family_zgrat_v1 behavioral2/memory/4112-71-0x00000000058D0000-0x000000000591D000-memory.dmp family_zgrat_v1 behavioral2/memory/4112-73-0x00000000058D0000-0x000000000591D000-memory.dmp family_zgrat_v1 behavioral2/memory/4112-75-0x00000000058D0000-0x000000000591D000-memory.dmp family_zgrat_v1 behavioral2/memory/4112-69-0x00000000058D0000-0x000000000591D000-memory.dmp family_zgrat_v1 behavioral2/memory/4112-79-0x00000000058D0000-0x000000000591D000-memory.dmp family_zgrat_v1 behavioral2/memory/4112-77-0x00000000058D0000-0x000000000591D000-memory.dmp family_zgrat_v1 behavioral2/memory/4112-61-0x00000000058D0000-0x000000000591D000-memory.dmp family_zgrat_v1 behavioral2/memory/4112-53-0x00000000058D0000-0x000000000591D000-memory.dmp family_zgrat_v1 behavioral2/memory/4112-45-0x00000000058D0000-0x000000000591D000-memory.dmp family_zgrat_v1 behavioral2/memory/4112-43-0x00000000058D0000-0x000000000591D000-memory.dmp family_zgrat_v1 behavioral2/memory/4112-41-0x00000000058D0000-0x000000000591D000-memory.dmp family_zgrat_v1 behavioral2/memory/4112-39-0x00000000058D0000-0x000000000591D000-memory.dmp family_zgrat_v1 behavioral2/memory/4112-35-0x00000000058D0000-0x000000000591D000-memory.dmp family_zgrat_v1 behavioral2/memory/4112-31-0x00000000058D0000-0x000000000591D000-memory.dmp family_zgrat_v1 behavioral2/memory/4112-29-0x00000000058D0000-0x000000000591D000-memory.dmp family_zgrat_v1 behavioral2/memory/4112-27-0x00000000058D0000-0x000000000591D000-memory.dmp family_zgrat_v1 behavioral2/memory/4112-25-0x00000000058D0000-0x000000000591D000-memory.dmp family_zgrat_v1 behavioral2/memory/4112-21-0x00000000058D0000-0x000000000591D000-memory.dmp family_zgrat_v1 behavioral2/memory/4112-20-0x00000000058D0000-0x000000000591D000-memory.dmp family_zgrat_v1 -
Suspicious use of SetThreadContext 1 IoCs
Processes:
tmp.exedescription pid process target process PID 2620 set thread context of 4112 2620 tmp.exe RegSvcs.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
RegSvcs.exepid process 4112 RegSvcs.exe 4112 RegSvcs.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
tmp.exepid process 2620 tmp.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RegSvcs.exedescription pid process Token: SeDebugPrivilege 4112 RegSvcs.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
tmp.exepid process 2620 tmp.exe 2620 tmp.exe -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
tmp.exepid process 2620 tmp.exe 2620 tmp.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
tmp.exedescription pid process target process PID 2620 wrote to memory of 4112 2620 tmp.exe RegSvcs.exe PID 2620 wrote to memory of 4112 2620 tmp.exe RegSvcs.exe PID 2620 wrote to memory of 4112 2620 tmp.exe RegSvcs.exe PID 2620 wrote to memory of 4112 2620 tmp.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4112
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1324 --field-trial-handle=2280,i,1836084024518340990,18250262151825427757,262144 --variations-seed-version /prefetch:81⤵PID:4360
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2620-10-0x00000000039D0000-0x00000000039D4000-memory.dmpFilesize
16KB
-
memory/4112-11-0x0000000000400000-0x0000000000446000-memory.dmpFilesize
280KB
-
memory/4112-12-0x0000000000400000-0x0000000000446000-memory.dmpFilesize
280KB
-
memory/4112-13-0x0000000000400000-0x0000000000446000-memory.dmpFilesize
280KB
-
memory/4112-14-0x0000000000400000-0x0000000000446000-memory.dmpFilesize
280KB
-
memory/4112-15-0x0000000074040000-0x00000000747F0000-memory.dmpFilesize
7.7MB
-
memory/4112-16-0x0000000005860000-0x0000000005870000-memory.dmpFilesize
64KB
-
memory/4112-17-0x0000000005810000-0x0000000005864000-memory.dmpFilesize
336KB
-
memory/4112-19-0x00000000058D0000-0x0000000005922000-memory.dmpFilesize
328KB
-
memory/4112-18-0x0000000005E20000-0x00000000063C4000-memory.dmpFilesize
5.6MB
-
memory/4112-23-0x00000000058D0000-0x000000000591D000-memory.dmpFilesize
308KB
-
memory/4112-33-0x00000000058D0000-0x000000000591D000-memory.dmpFilesize
308KB
-
memory/4112-37-0x00000000058D0000-0x000000000591D000-memory.dmpFilesize
308KB
-
memory/4112-49-0x00000000058D0000-0x000000000591D000-memory.dmpFilesize
308KB
-
memory/4112-51-0x00000000058D0000-0x000000000591D000-memory.dmpFilesize
308KB
-
memory/4112-47-0x00000000058D0000-0x000000000591D000-memory.dmpFilesize
308KB
-
memory/4112-55-0x00000000058D0000-0x000000000591D000-memory.dmpFilesize
308KB
-
memory/4112-59-0x00000000058D0000-0x000000000591D000-memory.dmpFilesize
308KB
-
memory/4112-57-0x00000000058D0000-0x000000000591D000-memory.dmpFilesize
308KB
-
memory/4112-63-0x00000000058D0000-0x000000000591D000-memory.dmpFilesize
308KB
-
memory/4112-65-0x00000000058D0000-0x000000000591D000-memory.dmpFilesize
308KB
-
memory/4112-67-0x00000000058D0000-0x000000000591D000-memory.dmpFilesize
308KB
-
memory/4112-71-0x00000000058D0000-0x000000000591D000-memory.dmpFilesize
308KB
-
memory/4112-73-0x00000000058D0000-0x000000000591D000-memory.dmpFilesize
308KB
-
memory/4112-75-0x00000000058D0000-0x000000000591D000-memory.dmpFilesize
308KB
-
memory/4112-69-0x00000000058D0000-0x000000000591D000-memory.dmpFilesize
308KB
-
memory/4112-79-0x00000000058D0000-0x000000000591D000-memory.dmpFilesize
308KB
-
memory/4112-77-0x00000000058D0000-0x000000000591D000-memory.dmpFilesize
308KB
-
memory/4112-61-0x00000000058D0000-0x000000000591D000-memory.dmpFilesize
308KB
-
memory/4112-53-0x00000000058D0000-0x000000000591D000-memory.dmpFilesize
308KB
-
memory/4112-45-0x00000000058D0000-0x000000000591D000-memory.dmpFilesize
308KB
-
memory/4112-43-0x00000000058D0000-0x000000000591D000-memory.dmpFilesize
308KB
-
memory/4112-41-0x00000000058D0000-0x000000000591D000-memory.dmpFilesize
308KB
-
memory/4112-39-0x00000000058D0000-0x000000000591D000-memory.dmpFilesize
308KB
-
memory/4112-35-0x00000000058D0000-0x000000000591D000-memory.dmpFilesize
308KB
-
memory/4112-31-0x00000000058D0000-0x000000000591D000-memory.dmpFilesize
308KB
-
memory/4112-29-0x00000000058D0000-0x000000000591D000-memory.dmpFilesize
308KB
-
memory/4112-27-0x00000000058D0000-0x000000000591D000-memory.dmpFilesize
308KB
-
memory/4112-25-0x00000000058D0000-0x000000000591D000-memory.dmpFilesize
308KB
-
memory/4112-21-0x00000000058D0000-0x000000000591D000-memory.dmpFilesize
308KB
-
memory/4112-20-0x00000000058D0000-0x000000000591D000-memory.dmpFilesize
308KB
-
memory/4112-1050-0x0000000005860000-0x0000000005870000-memory.dmpFilesize
64KB
-
memory/4112-1051-0x0000000005AD0000-0x0000000005B36000-memory.dmpFilesize
408KB
-
memory/4112-1052-0x00000000068F0000-0x0000000006940000-memory.dmpFilesize
320KB
-
memory/4112-1053-0x00000000069E0000-0x0000000006A72000-memory.dmpFilesize
584KB
-
memory/4112-1054-0x0000000006940000-0x000000000694A000-memory.dmpFilesize
40KB
-
memory/4112-1055-0x0000000000400000-0x0000000000446000-memory.dmpFilesize
280KB
-
memory/4112-1056-0x0000000074040000-0x00000000747F0000-memory.dmpFilesize
7.7MB
-
memory/4112-1057-0x0000000005860000-0x0000000005870000-memory.dmpFilesize
64KB
-
memory/4112-1058-0x0000000005860000-0x0000000005870000-memory.dmpFilesize
64KB
-
memory/4112-1059-0x0000000005860000-0x0000000005870000-memory.dmpFilesize
64KB