agenttesla | 73d25bac1fe03ff4d8c114c49b62154ef651607f3c8398a9cbdab38d70791b61

General

Target

73d25bac1fe03ff4d8c114c49b62154ef651607f3c8398a9cbdab38d70791b61.exe
Size

1.3MB
MD5

e0d619ab78f91ae4c6f01841f903a2a1
SHA1

737b05b2e06af2f6b45a346b4f13f79f95d8e056
SHA256

73d25bac1fe03ff4d8c114c49b62154ef651607f3c8398a9cbdab38d70791b61
SHA512

8e948f9a6ddf457b0bdc44b0bb2939786379ad9c65dbc1256a5681c67837704833ba2cd298dc3d3ffb8e9a29340e01fad2821b8d15901c501458476b9119d855
SSDEEP

24576:YAHnh+eWsN3skA4RV1Hom2KXMmHaiUrV3dfyvoIvyh5:fh+ZkldoPK8YaiUpb08

Score

10^/10

agenttesla zgrat keylogger rat spyware stealer trojan

Malware Config

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Detect ZGRat V1 33 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2888-15-0x00000000021D0000-0x0000000002224000-memory.dmp	family_zgrat_v1
behavioral1/memory/2888-20-0x0000000002220000-0x0000000002272000-memory.dmp	family_zgrat_v1
behavioral1/memory/2888-21-0x0000000002220000-0x000000000226D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2888-22-0x0000000002220000-0x000000000226D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2888-24-0x0000000002220000-0x000000000226D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2888-30-0x0000000002220000-0x000000000226D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2888-32-0x0000000002220000-0x000000000226D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2888-34-0x0000000002220000-0x000000000226D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2888-36-0x0000000002220000-0x000000000226D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2888-38-0x0000000002220000-0x000000000226D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2888-28-0x0000000002220000-0x000000000226D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2888-26-0x0000000002220000-0x000000000226D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2888-40-0x0000000002220000-0x000000000226D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2888-44-0x0000000002220000-0x000000000226D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2888-42-0x0000000002220000-0x000000000226D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2888-50-0x0000000002220000-0x000000000226D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2888-56-0x0000000002220000-0x000000000226D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2888-54-0x0000000002220000-0x000000000226D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2888-58-0x0000000002220000-0x000000000226D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2888-52-0x0000000002220000-0x000000000226D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2888-48-0x0000000002220000-0x000000000226D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2888-60-0x0000000002220000-0x000000000226D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2888-46-0x0000000002220000-0x000000000226D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2888-64-0x0000000002220000-0x000000000226D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2888-68-0x0000000002220000-0x000000000226D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2888-70-0x0000000002220000-0x000000000226D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2888-66-0x0000000002220000-0x000000000226D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2888-72-0x0000000002220000-0x000000000226D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2888-80-0x0000000002220000-0x000000000226D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2888-78-0x0000000002220000-0x000000000226D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2888-76-0x0000000002220000-0x000000000226D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2888-74-0x0000000002220000-0x000000000226D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2888-62-0x0000000002220000-0x000000000226D000-memory.dmp	family_zgrat_v1

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Suspicious use of SetThreadContext 1 IoCs

Processes:

73d25bac1fe03ff4d8c114c49b62154ef651607f3c8398a9cbdab38d70791b61.exe

description	pid	process	target process
PID 2768 set thread context of 2888	2768	73d25bac1fe03ff4d8c114c49b62154ef651607f3c8398a9cbdab38d70791b61.exe	RegSvcs.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

RegSvcs.exe

pid process

2888 RegSvcs.exe
2888 RegSvcs.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

73d25bac1fe03ff4d8c114c49b62154ef651607f3c8398a9cbdab38d70791b61.exe

pid process

2768 73d25bac1fe03ff4d8c114c49b62154ef651607f3c8398a9cbdab38d70791b61.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RegSvcs.exe

description pid process

Token: SeDebugPrivilege 2888 RegSvcs.exe

pid	process
2888	RegSvcs.exe
2888	RegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	2888	RegSvcs.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

73d25bac1fe03ff4d8c114c49b62154ef651607f3c8398a9cbdab38d70791b61.exe

pid	process
2768	73d25bac1fe03ff4d8c114c49b62154ef651607f3c8398a9cbdab38d70791b61.exe
2768	73d25bac1fe03ff4d8c114c49b62154ef651607f3c8398a9cbdab38d70791b61.exe

Suspicious use of SendNotifyMessage 2 IoCs

Processes:

73d25bac1fe03ff4d8c114c49b62154ef651607f3c8398a9cbdab38d70791b61.exe

pid	process
2768	73d25bac1fe03ff4d8c114c49b62154ef651607f3c8398a9cbdab38d70791b61.exe
2768	73d25bac1fe03ff4d8c114c49b62154ef651607f3c8398a9cbdab38d70791b61.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

73d25bac1fe03ff4d8c114c49b62154ef651607f3c8398a9cbdab38d70791b61.exe

description	pid	process	target process
PID 2768 wrote to memory of 2888	2768	73d25bac1fe03ff4d8c114c49b62154ef651607f3c8398a9cbdab38d70791b61.exe	RegSvcs.exe
PID 2768 wrote to memory of 2888	2768	73d25bac1fe03ff4d8c114c49b62154ef651607f3c8398a9cbdab38d70791b61.exe	RegSvcs.exe
PID 2768 wrote to memory of 2888	2768	73d25bac1fe03ff4d8c114c49b62154ef651607f3c8398a9cbdab38d70791b61.exe	RegSvcs.exe
PID 2768 wrote to memory of 2888	2768	73d25bac1fe03ff4d8c114c49b62154ef651607f3c8398a9cbdab38d70791b61.exe	RegSvcs.exe
PID 2768 wrote to memory of 2888	2768	73d25bac1fe03ff4d8c114c49b62154ef651607f3c8398a9cbdab38d70791b61.exe	RegSvcs.exe
PID 2768 wrote to memory of 2888	2768	73d25bac1fe03ff4d8c114c49b62154ef651607f3c8398a9cbdab38d70791b61.exe	RegSvcs.exe
PID 2768 wrote to memory of 2888	2768	73d25bac1fe03ff4d8c114c49b62154ef651607f3c8398a9cbdab38d70791b61.exe	RegSvcs.exe
PID 2768 wrote to memory of 2888	2768	73d25bac1fe03ff4d8c114c49b62154ef651607f3c8398a9cbdab38d70791b61.exe	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\73d25bac1fe03ff4d8c114c49b62154ef651607f3c8398a9cbdab38d70791b61.exe
"C:\Users\Admin\AppData\Local\Temp\73d25bac1fe03ff4d8c114c49b62154ef651607f3c8398a9cbdab38d70791b61.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2768

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Users\Admin\AppData\Local\Temp\73d25bac1fe03ff4d8c114c49b62154ef651607f3c8398a9cbdab38d70791b61.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2888

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2768-10-0x0000000000620000-0x0000000000624000-memory.dmp

Filesize
16KB

Download
memory/2888-11-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2888-13-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2888-14-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2888-16-0x00000000743A0000-0x0000000074A8E000-memory.dmp

Filesize
6.9MB

Download
memory/2888-15-0x00000000021D0000-0x0000000002224000-memory.dmp

Filesize
336KB

Download
memory/2888-17-0x0000000002000000-0x0000000002040000-memory.dmp

Filesize
256KB

Download
memory/2888-18-0x0000000002000000-0x0000000002040000-memory.dmp

Filesize
256KB

Download
memory/2888-19-0x0000000002000000-0x0000000002040000-memory.dmp

Filesize
256KB

Download
memory/2888-20-0x0000000002220000-0x0000000002272000-memory.dmp

Filesize
328KB

Download
memory/2888-21-0x0000000002220000-0x000000000226D000-memory.dmp

Filesize
308KB

Download
memory/2888-22-0x0000000002220000-0x000000000226D000-memory.dmp

Filesize
308KB

Download
memory/2888-24-0x0000000002220000-0x000000000226D000-memory.dmp

Filesize
308KB

Download
memory/2888-30-0x0000000002220000-0x000000000226D000-memory.dmp

Filesize
308KB

Download
memory/2888-32-0x0000000002220000-0x000000000226D000-memory.dmp

Filesize
308KB

Download
memory/2888-34-0x0000000002220000-0x000000000226D000-memory.dmp

Filesize
308KB

Download
memory/2888-36-0x0000000002220000-0x000000000226D000-memory.dmp

Filesize
308KB

Download
memory/2888-38-0x0000000002220000-0x000000000226D000-memory.dmp

Filesize
308KB

Download
memory/2888-28-0x0000000002220000-0x000000000226D000-memory.dmp

Filesize
308KB

Download
memory/2888-26-0x0000000002220000-0x000000000226D000-memory.dmp

Filesize
308KB

Download
memory/2888-40-0x0000000002220000-0x000000000226D000-memory.dmp

Filesize
308KB

Download
memory/2888-44-0x0000000002220000-0x000000000226D000-memory.dmp

Filesize
308KB

Download
memory/2888-42-0x0000000002220000-0x000000000226D000-memory.dmp

Filesize
308KB

Download
memory/2888-50-0x0000000002220000-0x000000000226D000-memory.dmp

Filesize
308KB

Download
memory/2888-56-0x0000000002220000-0x000000000226D000-memory.dmp

Filesize
308KB

Download
memory/2888-54-0x0000000002220000-0x000000000226D000-memory.dmp

Filesize
308KB

Download
memory/2888-58-0x0000000002220000-0x000000000226D000-memory.dmp

Filesize
308KB

Download
memory/2888-52-0x0000000002220000-0x000000000226D000-memory.dmp

Filesize
308KB

Download
memory/2888-48-0x0000000002220000-0x000000000226D000-memory.dmp

Filesize
308KB

Download
memory/2888-60-0x0000000002220000-0x000000000226D000-memory.dmp

Filesize
308KB

Download
memory/2888-46-0x0000000002220000-0x000000000226D000-memory.dmp

Filesize
308KB

Download
memory/2888-64-0x0000000002220000-0x000000000226D000-memory.dmp

Filesize
308KB

Download
memory/2888-68-0x0000000002220000-0x000000000226D000-memory.dmp

Filesize
308KB

Download
memory/2888-70-0x0000000002220000-0x000000000226D000-memory.dmp

Filesize
308KB

Download
memory/2888-66-0x0000000002220000-0x000000000226D000-memory.dmp

Filesize
308KB

Download
memory/2888-72-0x0000000002220000-0x000000000226D000-memory.dmp

Filesize
308KB

Download
memory/2888-80-0x0000000002220000-0x000000000226D000-memory.dmp

Filesize
308KB

Download
memory/2888-78-0x0000000002220000-0x000000000226D000-memory.dmp

Filesize
308KB

Download
memory/2888-76-0x0000000002220000-0x000000000226D000-memory.dmp

Filesize
308KB

Download
memory/2888-74-0x0000000002220000-0x000000000226D000-memory.dmp

Filesize
308KB

Download
memory/2888-62-0x0000000002220000-0x000000000226D000-memory.dmp

Filesize
308KB

Download
memory/2888-1051-0x0000000002000000-0x0000000002040000-memory.dmp

Filesize
256KB

Download
memory/2888-1052-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2888-1053-0x00000000743A0000-0x0000000074A8E000-memory.dmp

Filesize
6.9MB

Download
memory/2888-1054-0x0000000002000000-0x0000000002040000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads