Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
-
submitted
24/04/2024, 13:53
General
-
Target
Flexsense Sip. GRS024000000713 BSG 40-700-135 .exe
-
Size
1.1MB
-
MD5
48a36bd787c0f37b6dee121a52c1029e
-
SHA1
dbfbe457dfcb24f5930cece2d0d6632135760db9
-
SHA256
d45e2d0c57b3e3da8e0f740c8e57d1483f90e62251a8f2c97b4ebfbfa6a6f92e
-
SHA512
976e60e841d87c5b1ae05a80d4c1f8fc58a568baca03d71bcac86cc6a19d5b5e0c902a31aa368acd7711c62d508e3aa48518f7f9113bf9c4e0e1f62e2a81cb94
-
SSDEEP
24576:bqDEvCTbMWu7rQYlBQcBiT6rprG8aArxxoy1/4/W5NU:bTvC/MTQYxsWR7aArG+5
Malware Config
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Detect ZGRat V1 33 IoCs
-
ZGRat
ZGRat is remote access trojan written in C#.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Flexsense Sip. GRS024000000713 BSG 40-700-135 .exe"C:\Users\Admin\AppData\Local\Temp\Flexsense Sip. GRS024000000713 BSG 40-700-135 .exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\Flexsense Sip. GRS024000000713 BSG 40-700-135 .exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
262KB
MD5f65af2a60fb1d9ad8a3685840d6be3d2
SHA1d00d12ada22bc59689a6e5b6960e8d417137c634
SHA256e25804400a89430834712f71c002c862c43b4522e691a5208c2c967a1fc14745
SHA512fde9554393050491e1a6d59442f56c7c1d48aad6699a4778d735a7d8343f099d8dc5b87a80bc07b6836a43eecc584130e7a435577d614ae8363edfa290fc24cf
-
Filesize
16KB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
336KB
-
Filesize
6.9MB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
328KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
256KB
-
Filesize
6.9MB
-
Filesize
256KB
-
Filesize
256KB