agenttesla | f5f93fd662d6d3d55c5c47ead5a931ed8eb8a066d9bd29113903506e7cf56fdb

General

Target

QUOTATION_APRQTRA031244·PDF.scr.exe
Size

285KB
MD5

9d2813c3fe48db6f7cd2450a14ff0f65
SHA1

f039e86a0b12ce00afbc29d6683325dd4e354c55
SHA256

f5f93fd662d6d3d55c5c47ead5a931ed8eb8a066d9bd29113903506e7cf56fdb
SHA512

922a0e4341fcc622902f631e012ed186c91c7b752d9281171186953afca4801ca760f13dbb8bd237200b024eb6111cb1f04d73a1b0205ffab472112d422c0300
SSDEEP

6144:BS691E08tYLpZ0Egrdm4Vz0Rpppppppppppppppppppppppppppppd:BSalgrdm4Vz0RppppppppppppppppppX

Score

10^/10

agenttesla zgrat keylogger rat spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
gator3220.hostgator.com
Port:
587
Username:
[email protected]
Password:
RaFv@tsTUK55@@<<!!
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Detect ZGRat V1 34 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4528-4-0x00000000087C0000-0x00000000089F0000-memory.dmp	family_zgrat_v1
behavioral2/memory/4528-6-0x00000000087C0000-0x00000000089EB000-memory.dmp	family_zgrat_v1
behavioral2/memory/4528-7-0x00000000087C0000-0x00000000089EB000-memory.dmp	family_zgrat_v1
behavioral2/memory/4528-9-0x00000000087C0000-0x00000000089EB000-memory.dmp	family_zgrat_v1
behavioral2/memory/4528-11-0x00000000087C0000-0x00000000089EB000-memory.dmp	family_zgrat_v1
behavioral2/memory/4528-13-0x00000000087C0000-0x00000000089EB000-memory.dmp	family_zgrat_v1
behavioral2/memory/4528-15-0x00000000087C0000-0x00000000089EB000-memory.dmp	family_zgrat_v1
behavioral2/memory/4528-17-0x00000000087C0000-0x00000000089EB000-memory.dmp	family_zgrat_v1
behavioral2/memory/4528-19-0x00000000087C0000-0x00000000089EB000-memory.dmp	family_zgrat_v1
behavioral2/memory/4528-21-0x00000000087C0000-0x00000000089EB000-memory.dmp	family_zgrat_v1
behavioral2/memory/4528-23-0x00000000087C0000-0x00000000089EB000-memory.dmp	family_zgrat_v1
behavioral2/memory/4528-25-0x00000000087C0000-0x00000000089EB000-memory.dmp	family_zgrat_v1
behavioral2/memory/4528-27-0x00000000087C0000-0x00000000089EB000-memory.dmp	family_zgrat_v1
behavioral2/memory/4528-29-0x00000000087C0000-0x00000000089EB000-memory.dmp	family_zgrat_v1
behavioral2/memory/4528-31-0x00000000087C0000-0x00000000089EB000-memory.dmp	family_zgrat_v1
behavioral2/memory/4528-33-0x00000000087C0000-0x00000000089EB000-memory.dmp	family_zgrat_v1
behavioral2/memory/4528-35-0x00000000087C0000-0x00000000089EB000-memory.dmp	family_zgrat_v1
behavioral2/memory/4528-37-0x00000000087C0000-0x00000000089EB000-memory.dmp	family_zgrat_v1
behavioral2/memory/4528-39-0x00000000087C0000-0x00000000089EB000-memory.dmp	family_zgrat_v1
behavioral2/memory/4528-43-0x00000000087C0000-0x00000000089EB000-memory.dmp	family_zgrat_v1
behavioral2/memory/4528-41-0x00000000087C0000-0x00000000089EB000-memory.dmp	family_zgrat_v1
behavioral2/memory/4528-45-0x00000000087C0000-0x00000000089EB000-memory.dmp	family_zgrat_v1
behavioral2/memory/4528-47-0x00000000087C0000-0x00000000089EB000-memory.dmp	family_zgrat_v1
behavioral2/memory/4528-49-0x00000000087C0000-0x00000000089EB000-memory.dmp	family_zgrat_v1
behavioral2/memory/4528-51-0x00000000087C0000-0x00000000089EB000-memory.dmp	family_zgrat_v1
behavioral2/memory/4528-53-0x00000000087C0000-0x00000000089EB000-memory.dmp	family_zgrat_v1
behavioral2/memory/4528-55-0x00000000087C0000-0x00000000089EB000-memory.dmp	family_zgrat_v1
behavioral2/memory/4528-57-0x00000000087C0000-0x00000000089EB000-memory.dmp	family_zgrat_v1
behavioral2/memory/4528-59-0x00000000087C0000-0x00000000089EB000-memory.dmp	family_zgrat_v1
behavioral2/memory/4528-61-0x00000000087C0000-0x00000000089EB000-memory.dmp	family_zgrat_v1
behavioral2/memory/4528-63-0x00000000087C0000-0x00000000089EB000-memory.dmp	family_zgrat_v1
behavioral2/memory/4528-65-0x00000000087C0000-0x00000000089EB000-memory.dmp	family_zgrat_v1
behavioral2/memory/4528-69-0x00000000087C0000-0x00000000089EB000-memory.dmp	family_zgrat_v1
behavioral2/memory/4528-67-0x00000000087C0000-0x00000000089EB000-memory.dmp	family_zgrat_v1

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

274 ip-api.com
Suspicious use of SetThreadContext 1 IoCs

Processes:

QUOTATION_APRQTRA031244·PDF.scr.exe

description pid process target process

PID 4528 set thread context of 1216 4528 QUOTATION_APRQTRA031244·PDF.scr.exe aspnet_compiler.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

aspnet_compiler.exe

pid process

1216 aspnet_compiler.exe
1216 aspnet_compiler.exe

flow	ioc
274	ip-api.com

description	pid	process	target process
PID 4528 set thread context of 1216	4528	QUOTATION_APRQTRA031244·PDF.scr.exe	aspnet_compiler.exe

pid	process
1216	aspnet_compiler.exe
1216	aspnet_compiler.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

QUOTATION_APRQTRA031244·PDF.scr.exeaspnet_compiler.exe

description	pid	process
Token: SeDebugPrivilege	4528	QUOTATION_APRQTRA031244·PDF.scr.exe
Token: SeDebugPrivilege	4528	QUOTATION_APRQTRA031244·PDF.scr.exe
Token: SeDebugPrivilege	1216	aspnet_compiler.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

aspnet_compiler.exe

pid process

1216 aspnet_compiler.exe

pid	process
1216	aspnet_compiler.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

QUOTATION_APRQTRA031244·PDF.scr.exe

description	pid	process	target process
PID 4528 wrote to memory of 1216	4528	QUOTATION_APRQTRA031244·PDF.scr.exe	aspnet_compiler.exe
PID 4528 wrote to memory of 1216	4528	QUOTATION_APRQTRA031244·PDF.scr.exe	aspnet_compiler.exe
PID 4528 wrote to memory of 1216	4528	QUOTATION_APRQTRA031244·PDF.scr.exe	aspnet_compiler.exe
PID 4528 wrote to memory of 1216	4528	QUOTATION_APRQTRA031244·PDF.scr.exe	aspnet_compiler.exe
PID 4528 wrote to memory of 1216	4528	QUOTATION_APRQTRA031244·PDF.scr.exe	aspnet_compiler.exe
PID 4528 wrote to memory of 1216	4528	QUOTATION_APRQTRA031244·PDF.scr.exe	aspnet_compiler.exe
PID 4528 wrote to memory of 1216	4528	QUOTATION_APRQTRA031244·PDF.scr.exe	aspnet_compiler.exe
PID 4528 wrote to memory of 1216	4528	QUOTATION_APRQTRA031244·PDF.scr.exe	aspnet_compiler.exe

C:\Users\Admin\AppData\Local\Temp\QUOTATION_APRQTRA031244·PDF.scr.exe
"C:\Users\Admin\AppData\Local\Temp\QUOTATION_APRQTRA031244·PDF.scr.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4528

C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1216

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1216-4897-0x0000000074640000-0x0000000074DF0000-memory.dmp

Filesize
7.7MB

Download
memory/1216-4896-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1216-4898-0x0000000005420000-0x0000000005430000-memory.dmp

Filesize
64KB

Download
memory/1216-4899-0x0000000006870000-0x00000000068C0000-memory.dmp

Filesize
320KB

Download
memory/1216-4900-0x0000000006AF0000-0x0000000006AFA000-memory.dmp

Filesize
40KB

Download
memory/1216-4902-0x0000000005420000-0x0000000005430000-memory.dmp

Filesize
64KB

Download
memory/1216-4901-0x0000000074640000-0x0000000074DF0000-memory.dmp

Filesize
7.7MB

Download
memory/4528-35-0x00000000087C0000-0x00000000089EB000-memory.dmp

Filesize
2.2MB

Download
memory/4528-41-0x00000000087C0000-0x00000000089EB000-memory.dmp

Filesize
2.2MB

Download
memory/4528-4-0x00000000087C0000-0x00000000089F0000-memory.dmp

Filesize
2.2MB

Download
memory/4528-5-0x0000000008FA0000-0x0000000009544000-memory.dmp

Filesize
5.6MB

Download
memory/4528-6-0x00000000087C0000-0x00000000089EB000-memory.dmp

Filesize
2.2MB

Download
memory/4528-7-0x00000000087C0000-0x00000000089EB000-memory.dmp

Filesize
2.2MB

Download
memory/4528-9-0x00000000087C0000-0x00000000089EB000-memory.dmp

Filesize
2.2MB

Download
memory/4528-11-0x00000000087C0000-0x00000000089EB000-memory.dmp

Filesize
2.2MB

Download
memory/4528-13-0x00000000087C0000-0x00000000089EB000-memory.dmp

Filesize
2.2MB

Download
memory/4528-15-0x00000000087C0000-0x00000000089EB000-memory.dmp

Filesize
2.2MB

Download
memory/4528-17-0x00000000087C0000-0x00000000089EB000-memory.dmp

Filesize
2.2MB

Download
memory/4528-19-0x00000000087C0000-0x00000000089EB000-memory.dmp

Filesize
2.2MB

Download
memory/4528-21-0x00000000087C0000-0x00000000089EB000-memory.dmp

Filesize
2.2MB

Download
memory/4528-23-0x00000000087C0000-0x00000000089EB000-memory.dmp

Filesize
2.2MB

Download
memory/4528-25-0x00000000087C0000-0x00000000089EB000-memory.dmp

Filesize
2.2MB

Download
memory/4528-27-0x00000000087C0000-0x00000000089EB000-memory.dmp

Filesize
2.2MB

Download
memory/4528-29-0x00000000087C0000-0x00000000089EB000-memory.dmp

Filesize
2.2MB

Download
memory/4528-31-0x00000000087C0000-0x00000000089EB000-memory.dmp

Filesize
2.2MB

Download
memory/4528-33-0x00000000087C0000-0x00000000089EB000-memory.dmp

Filesize
2.2MB

Download
memory/4528-2-0x0000000004D70000-0x0000000004E02000-memory.dmp

Filesize
584KB

Download
memory/4528-37-0x00000000087C0000-0x00000000089EB000-memory.dmp

Filesize
2.2MB

Download
memory/4528-39-0x00000000087C0000-0x00000000089EB000-memory.dmp

Filesize
2.2MB

Download
memory/4528-43-0x00000000087C0000-0x00000000089EB000-memory.dmp

Filesize
2.2MB

Download
memory/4528-3-0x0000000004F90000-0x0000000004FA0000-memory.dmp

Filesize
64KB

Download
memory/4528-45-0x00000000087C0000-0x00000000089EB000-memory.dmp

Filesize
2.2MB

Download
memory/4528-47-0x00000000087C0000-0x00000000089EB000-memory.dmp

Filesize
2.2MB

Download
memory/4528-49-0x00000000087C0000-0x00000000089EB000-memory.dmp

Filesize
2.2MB

Download
memory/4528-51-0x00000000087C0000-0x00000000089EB000-memory.dmp

Filesize
2.2MB

Download
memory/4528-53-0x00000000087C0000-0x00000000089EB000-memory.dmp

Filesize
2.2MB

Download
memory/4528-55-0x00000000087C0000-0x00000000089EB000-memory.dmp

Filesize
2.2MB

Download
memory/4528-57-0x00000000087C0000-0x00000000089EB000-memory.dmp

Filesize
2.2MB

Download
memory/4528-59-0x00000000087C0000-0x00000000089EB000-memory.dmp

Filesize
2.2MB

Download
memory/4528-61-0x00000000087C0000-0x00000000089EB000-memory.dmp

Filesize
2.2MB

Download
memory/4528-63-0x00000000087C0000-0x00000000089EB000-memory.dmp

Filesize
2.2MB

Download
memory/4528-65-0x00000000087C0000-0x00000000089EB000-memory.dmp

Filesize
2.2MB

Download
memory/4528-69-0x00000000087C0000-0x00000000089EB000-memory.dmp

Filesize
2.2MB

Download
memory/4528-67-0x00000000087C0000-0x00000000089EB000-memory.dmp

Filesize
2.2MB

Download
memory/4528-2713-0x0000000074640000-0x0000000074DF0000-memory.dmp

Filesize
7.7MB

Download
memory/4528-3051-0x0000000004F90000-0x0000000004FA0000-memory.dmp

Filesize
64KB

Download
memory/4528-4888-0x00000000047F0000-0x00000000047F1000-memory.dmp

Filesize
4KB

Download
memory/4528-1-0x0000000074640000-0x0000000074DF0000-memory.dmp

Filesize
7.7MB

Download
memory/4528-0-0x0000000000390000-0x00000000003DE000-memory.dmp

Filesize
312KB

Download
memory/4528-4889-0x0000000006CC0000-0x0000000006D2C000-memory.dmp

Filesize
432KB

Download
memory/4528-4890-0x0000000006D30000-0x0000000006D7C000-memory.dmp

Filesize
304KB

Download
memory/4528-4891-0x0000000006DF0000-0x0000000006E56000-memory.dmp

Filesize
408KB

Download
memory/4528-4892-0x00000000008C0000-0x0000000000914000-memory.dmp

Filesize
336KB

Download
memory/4528-4895-0x0000000074640000-0x0000000074DF0000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads