agenttesla | b3ee243fec9de264cfd5f0743552ffc89b1379236153d36b48d9d520620228ed

General

Target

b3ee243fec9de264cfd5f0743552ffc89b1379236153d36b48d9d520620228ed.exe
Size

1.1MB
MD5

623ee380ebde7c5c8f12d9847de16305
SHA1

caea83bfa0f2c44a5f4645dc1fb1642e57dca3f4
SHA256

b3ee243fec9de264cfd5f0743552ffc89b1379236153d36b48d9d520620228ed
SHA512

74ab2ce17e0536a21281647228d7cb5b79f67dbac56bb76652a3954b9dd291c9f6953b80d625acec21c5c1427255ab6046eae88ce5ac80cba64b6fe3768905ea
SSDEEP

24576:pAHnh+eWsN3skA4RV1Hom2KXMmHaOrw/kS0dI8+cLUkf5:wh+ZkldoPK8YaOukOcLr

Score

10^/10

agenttesla zgrat keylogger rat spyware stealer trojan

Malware Config

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Detect ZGRat V1 33 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2616-16-0x0000000000450000-0x00000000004A4000-memory.dmp	family_zgrat_v1
behavioral1/memory/2616-20-0x0000000000890000-0x00000000008E4000-memory.dmp	family_zgrat_v1
behavioral1/memory/2616-21-0x0000000000890000-0x00000000008DD000-memory.dmp	family_zgrat_v1
behavioral1/memory/2616-22-0x0000000000890000-0x00000000008DD000-memory.dmp	family_zgrat_v1
behavioral1/memory/2616-24-0x0000000000890000-0x00000000008DD000-memory.dmp	family_zgrat_v1
behavioral1/memory/2616-28-0x0000000000890000-0x00000000008DD000-memory.dmp	family_zgrat_v1
behavioral1/memory/2616-30-0x0000000000890000-0x00000000008DD000-memory.dmp	family_zgrat_v1
behavioral1/memory/2616-26-0x0000000000890000-0x00000000008DD000-memory.dmp	family_zgrat_v1
behavioral1/memory/2616-32-0x0000000000890000-0x00000000008DD000-memory.dmp	family_zgrat_v1
behavioral1/memory/2616-34-0x0000000000890000-0x00000000008DD000-memory.dmp	family_zgrat_v1
behavioral1/memory/2616-44-0x0000000000890000-0x00000000008DD000-memory.dmp	family_zgrat_v1
behavioral1/memory/2616-50-0x0000000000890000-0x00000000008DD000-memory.dmp	family_zgrat_v1
behavioral1/memory/2616-56-0x0000000000890000-0x00000000008DD000-memory.dmp	family_zgrat_v1
behavioral1/memory/2616-62-0x0000000000890000-0x00000000008DD000-memory.dmp	family_zgrat_v1
behavioral1/memory/2616-60-0x0000000000890000-0x00000000008DD000-memory.dmp	family_zgrat_v1
behavioral1/memory/2616-58-0x0000000000890000-0x00000000008DD000-memory.dmp	family_zgrat_v1
behavioral1/memory/2616-66-0x0000000000890000-0x00000000008DD000-memory.dmp	family_zgrat_v1
behavioral1/memory/2616-68-0x0000000000890000-0x00000000008DD000-memory.dmp	family_zgrat_v1
behavioral1/memory/2616-64-0x0000000000890000-0x00000000008DD000-memory.dmp	family_zgrat_v1
behavioral1/memory/2616-54-0x0000000000890000-0x00000000008DD000-memory.dmp	family_zgrat_v1
behavioral1/memory/2616-70-0x0000000000890000-0x00000000008DD000-memory.dmp	family_zgrat_v1
behavioral1/memory/2616-52-0x0000000000890000-0x00000000008DD000-memory.dmp	family_zgrat_v1
behavioral1/memory/2616-72-0x0000000000890000-0x00000000008DD000-memory.dmp	family_zgrat_v1
behavioral1/memory/2616-48-0x0000000000890000-0x00000000008DD000-memory.dmp	family_zgrat_v1
behavioral1/memory/2616-76-0x0000000000890000-0x00000000008DD000-memory.dmp	family_zgrat_v1
behavioral1/memory/2616-80-0x0000000000890000-0x00000000008DD000-memory.dmp	family_zgrat_v1
behavioral1/memory/2616-78-0x0000000000890000-0x00000000008DD000-memory.dmp	family_zgrat_v1
behavioral1/memory/2616-74-0x0000000000890000-0x00000000008DD000-memory.dmp	family_zgrat_v1
behavioral1/memory/2616-46-0x0000000000890000-0x00000000008DD000-memory.dmp	family_zgrat_v1
behavioral1/memory/2616-42-0x0000000000890000-0x00000000008DD000-memory.dmp	family_zgrat_v1
behavioral1/memory/2616-40-0x0000000000890000-0x00000000008DD000-memory.dmp	family_zgrat_v1
behavioral1/memory/2616-38-0x0000000000890000-0x00000000008DD000-memory.dmp	family_zgrat_v1
behavioral1/memory/2616-36-0x0000000000890000-0x00000000008DD000-memory.dmp	family_zgrat_v1

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 ip-api.com

flow	ioc
4	ip-api.com

Suspicious use of SetThreadContext 1 IoCs

Processes:

b3ee243fec9de264cfd5f0743552ffc89b1379236153d36b48d9d520620228ed.exe

description	pid	process	target process
PID 1692 set thread context of 2616	1692	b3ee243fec9de264cfd5f0743552ffc89b1379236153d36b48d9d520620228ed.exe	RegSvcs.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

RegSvcs.exe

pid process

2616 RegSvcs.exe
2616 RegSvcs.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

b3ee243fec9de264cfd5f0743552ffc89b1379236153d36b48d9d520620228ed.exe

pid process

1692 b3ee243fec9de264cfd5f0743552ffc89b1379236153d36b48d9d520620228ed.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RegSvcs.exe

description pid process

Token: SeDebugPrivilege 2616 RegSvcs.exe

pid	process
2616	RegSvcs.exe
2616	RegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	2616	RegSvcs.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

b3ee243fec9de264cfd5f0743552ffc89b1379236153d36b48d9d520620228ed.exe

pid	process
1692	b3ee243fec9de264cfd5f0743552ffc89b1379236153d36b48d9d520620228ed.exe
1692	b3ee243fec9de264cfd5f0743552ffc89b1379236153d36b48d9d520620228ed.exe

Suspicious use of SendNotifyMessage 2 IoCs

Processes:

b3ee243fec9de264cfd5f0743552ffc89b1379236153d36b48d9d520620228ed.exe

pid	process
1692	b3ee243fec9de264cfd5f0743552ffc89b1379236153d36b48d9d520620228ed.exe
1692	b3ee243fec9de264cfd5f0743552ffc89b1379236153d36b48d9d520620228ed.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

b3ee243fec9de264cfd5f0743552ffc89b1379236153d36b48d9d520620228ed.exe

description	pid	process	target process
PID 1692 wrote to memory of 2616	1692	b3ee243fec9de264cfd5f0743552ffc89b1379236153d36b48d9d520620228ed.exe	RegSvcs.exe
PID 1692 wrote to memory of 2616	1692	b3ee243fec9de264cfd5f0743552ffc89b1379236153d36b48d9d520620228ed.exe	RegSvcs.exe
PID 1692 wrote to memory of 2616	1692	b3ee243fec9de264cfd5f0743552ffc89b1379236153d36b48d9d520620228ed.exe	RegSvcs.exe
PID 1692 wrote to memory of 2616	1692	b3ee243fec9de264cfd5f0743552ffc89b1379236153d36b48d9d520620228ed.exe	RegSvcs.exe
PID 1692 wrote to memory of 2616	1692	b3ee243fec9de264cfd5f0743552ffc89b1379236153d36b48d9d520620228ed.exe	RegSvcs.exe
PID 1692 wrote to memory of 2616	1692	b3ee243fec9de264cfd5f0743552ffc89b1379236153d36b48d9d520620228ed.exe	RegSvcs.exe
PID 1692 wrote to memory of 2616	1692	b3ee243fec9de264cfd5f0743552ffc89b1379236153d36b48d9d520620228ed.exe	RegSvcs.exe
PID 1692 wrote to memory of 2616	1692	b3ee243fec9de264cfd5f0743552ffc89b1379236153d36b48d9d520620228ed.exe	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\b3ee243fec9de264cfd5f0743552ffc89b1379236153d36b48d9d520620228ed.exe
"C:\Users\Admin\AppData\Local\Temp\b3ee243fec9de264cfd5f0743552ffc89b1379236153d36b48d9d520620228ed.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1692

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Users\Admin\AppData\Local\Temp\b3ee243fec9de264cfd5f0743552ffc89b1379236153d36b48d9d520620228ed.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2616

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\orographically
Filesize
262KB

MD5
08f3164f66456fd3891bc4d13481905c

SHA1
c5d5ccadfaf5229b57db852a098516b01d42e6ca

SHA256
51526fcb85fed1fb2810ef1fd5386bb2e39514aa89328cdd31d4413074e0f1fe

SHA512
a7c9de657cbb8c9ce6784af8034bbfdee04a5779fce560a21921385e37ecef7bce5e50e66253cbad1565768caed29a961686ea55a64a9d1c62ba07b1845257e6

Download Submit
memory/1692-11-0x00000000000B0000-0x00000000000B4000-memory.dmp

Filesize
16KB

Download
memory/2616-12-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2616-14-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2616-15-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2616-16-0x0000000000450000-0x00000000004A4000-memory.dmp

Filesize
336KB

Download
memory/2616-17-0x0000000074390000-0x0000000074A7E000-memory.dmp

Filesize
6.9MB

Download
memory/2616-18-0x0000000004440000-0x0000000004480000-memory.dmp

Filesize
256KB

Download
memory/2616-19-0x0000000004440000-0x0000000004480000-memory.dmp

Filesize
256KB

Download
memory/2616-20-0x0000000000890000-0x00000000008E4000-memory.dmp

Filesize
336KB

Download
memory/2616-21-0x0000000000890000-0x00000000008DD000-memory.dmp

Filesize
308KB

Download
memory/2616-22-0x0000000000890000-0x00000000008DD000-memory.dmp

Filesize
308KB

Download
memory/2616-24-0x0000000000890000-0x00000000008DD000-memory.dmp

Filesize
308KB

Download
memory/2616-28-0x0000000000890000-0x00000000008DD000-memory.dmp

Filesize
308KB

Download
memory/2616-30-0x0000000000890000-0x00000000008DD000-memory.dmp

Filesize
308KB

Download
memory/2616-26-0x0000000000890000-0x00000000008DD000-memory.dmp

Filesize
308KB

Download
memory/2616-32-0x0000000000890000-0x00000000008DD000-memory.dmp

Filesize
308KB

Download
memory/2616-34-0x0000000000890000-0x00000000008DD000-memory.dmp

Filesize
308KB

Download
memory/2616-44-0x0000000000890000-0x00000000008DD000-memory.dmp

Filesize
308KB

Download
memory/2616-50-0x0000000000890000-0x00000000008DD000-memory.dmp

Filesize
308KB

Download
memory/2616-56-0x0000000000890000-0x00000000008DD000-memory.dmp

Filesize
308KB

Download
memory/2616-62-0x0000000000890000-0x00000000008DD000-memory.dmp

Filesize
308KB

Download
memory/2616-60-0x0000000000890000-0x00000000008DD000-memory.dmp

Filesize
308KB

Download
memory/2616-58-0x0000000000890000-0x00000000008DD000-memory.dmp

Filesize
308KB

Download
memory/2616-66-0x0000000000890000-0x00000000008DD000-memory.dmp

Filesize
308KB

Download
memory/2616-68-0x0000000000890000-0x00000000008DD000-memory.dmp

Filesize
308KB

Download
memory/2616-64-0x0000000000890000-0x00000000008DD000-memory.dmp

Filesize
308KB

Download
memory/2616-54-0x0000000000890000-0x00000000008DD000-memory.dmp

Filesize
308KB

Download
memory/2616-70-0x0000000000890000-0x00000000008DD000-memory.dmp

Filesize
308KB

Download
memory/2616-52-0x0000000000890000-0x00000000008DD000-memory.dmp

Filesize
308KB

Download
memory/2616-72-0x0000000000890000-0x00000000008DD000-memory.dmp

Filesize
308KB

Download
memory/2616-48-0x0000000000890000-0x00000000008DD000-memory.dmp

Filesize
308KB

Download
memory/2616-76-0x0000000000890000-0x00000000008DD000-memory.dmp

Filesize
308KB

Download
memory/2616-80-0x0000000000890000-0x00000000008DD000-memory.dmp

Filesize
308KB

Download
memory/2616-78-0x0000000000890000-0x00000000008DD000-memory.dmp

Filesize
308KB

Download
memory/2616-74-0x0000000000890000-0x00000000008DD000-memory.dmp

Filesize
308KB

Download
memory/2616-46-0x0000000000890000-0x00000000008DD000-memory.dmp

Filesize
308KB

Download
memory/2616-42-0x0000000000890000-0x00000000008DD000-memory.dmp

Filesize
308KB

Download
memory/2616-40-0x0000000000890000-0x00000000008DD000-memory.dmp

Filesize
308KB

Download
memory/2616-38-0x0000000000890000-0x00000000008DD000-memory.dmp

Filesize
308KB

Download
memory/2616-36-0x0000000000890000-0x00000000008DD000-memory.dmp

Filesize
308KB

Download
memory/2616-1065-0x0000000004440000-0x0000000004480000-memory.dmp

Filesize
256KB

Download
memory/2616-1066-0x0000000074390000-0x0000000074A7E000-memory.dmp

Filesize
6.9MB

Download
memory/2616-1067-0x0000000004440000-0x0000000004480000-memory.dmp

Filesize
256KB

Download
memory/2616-1068-0x0000000004440000-0x0000000004480000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads