agenttesla | d89996c1e3cd59f959934b14e930277f5434a5c1e667990de94c1e4cb2f243eb

General

Target

d89996c1e3cd59f959934b14e930277f5434a5c1e667990de94c1e4cb2f243eb.exe
Size

1.1MB
MD5

67e9c69943cca3c70450366e16f19d5c
SHA1

5ed01d66f03554f7df9022d53b99a5a26a835d69
SHA256

d89996c1e3cd59f959934b14e930277f5434a5c1e667990de94c1e4cb2f243eb
SHA512

9d7701c7767385c24e2a8d33dce07be249b7d68fdd6f8cb9e3491c3e6f93aa51022d7d62487f7bd704f03c2813f2a28dc9f1cbdf5c805494babf9ec9208fe5ce
SSDEEP

24576:FAHnh+eWsN3skA4RV1Hom2KXMmHamTHSffZ/CYrV5:0h+ZkldoPK8YamzSffZL

Score

10^/10

agenttesla zgrat keylogger rat spyware stealer trojan

Malware Config

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Detect ZGRat V1 34 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2372-16-0x0000000000AF0000-0x0000000000B46000-memory.dmp	family_zgrat_v1
behavioral1/memory/2372-20-0x00000000042D0000-0x0000000004324000-memory.dmp	family_zgrat_v1
behavioral1/memory/2372-26-0x00000000042D0000-0x000000000431E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2372-24-0x00000000042D0000-0x000000000431E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2372-80-0x00000000042D0000-0x000000000431E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2372-70-0x00000000042D0000-0x000000000431E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2372-64-0x00000000042D0000-0x000000000431E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2372-60-0x00000000042D0000-0x000000000431E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2372-50-0x00000000042D0000-0x000000000431E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2372-46-0x00000000042D0000-0x000000000431E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2372-36-0x00000000042D0000-0x000000000431E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2372-34-0x00000000042D0000-0x000000000431E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2372-32-0x00000000042D0000-0x000000000431E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2372-30-0x00000000042D0000-0x000000000431E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2372-28-0x00000000042D0000-0x000000000431E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2372-22-0x00000000042D0000-0x000000000431E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2372-21-0x00000000042D0000-0x000000000431E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2372-78-0x00000000042D0000-0x000000000431E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2372-76-0x00000000042D0000-0x000000000431E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2372-74-0x00000000042D0000-0x000000000431E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2372-72-0x00000000042D0000-0x000000000431E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2372-68-0x00000000042D0000-0x000000000431E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2372-66-0x00000000042D0000-0x000000000431E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2372-62-0x00000000042D0000-0x000000000431E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2372-58-0x00000000042D0000-0x000000000431E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2372-56-0x00000000042D0000-0x000000000431E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2372-54-0x00000000042D0000-0x000000000431E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2372-52-0x00000000042D0000-0x000000000431E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2372-48-0x00000000042D0000-0x000000000431E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2372-47-0x00000000042D0000-0x000000000431E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2372-44-0x00000000042D0000-0x000000000431E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2372-42-0x00000000042D0000-0x000000000431E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2372-40-0x00000000042D0000-0x000000000431E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2372-38-0x00000000042D0000-0x000000000431E000-memory.dmp	family_zgrat_v1

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 ip-api.com

flow	ioc
4	ip-api.com

Suspicious use of SetThreadContext 1 IoCs

Processes:

d89996c1e3cd59f959934b14e930277f5434a5c1e667990de94c1e4cb2f243eb.exe

description	pid	process	target process
PID 2912 set thread context of 2372	2912	d89996c1e3cd59f959934b14e930277f5434a5c1e667990de94c1e4cb2f243eb.exe	RegSvcs.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

RegSvcs.exe

pid process

2372 RegSvcs.exe
2372 RegSvcs.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

d89996c1e3cd59f959934b14e930277f5434a5c1e667990de94c1e4cb2f243eb.exe

pid process

2912 d89996c1e3cd59f959934b14e930277f5434a5c1e667990de94c1e4cb2f243eb.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RegSvcs.exe

description pid process

Token: SeDebugPrivilege 2372 RegSvcs.exe

pid	process
2372	RegSvcs.exe
2372	RegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	2372	RegSvcs.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

d89996c1e3cd59f959934b14e930277f5434a5c1e667990de94c1e4cb2f243eb.exe

pid	process
2912	d89996c1e3cd59f959934b14e930277f5434a5c1e667990de94c1e4cb2f243eb.exe
2912	d89996c1e3cd59f959934b14e930277f5434a5c1e667990de94c1e4cb2f243eb.exe

Suspicious use of SendNotifyMessage 2 IoCs

Processes:

d89996c1e3cd59f959934b14e930277f5434a5c1e667990de94c1e4cb2f243eb.exe

pid	process
2912	d89996c1e3cd59f959934b14e930277f5434a5c1e667990de94c1e4cb2f243eb.exe
2912	d89996c1e3cd59f959934b14e930277f5434a5c1e667990de94c1e4cb2f243eb.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

d89996c1e3cd59f959934b14e930277f5434a5c1e667990de94c1e4cb2f243eb.exe

description	pid	process	target process
PID 2912 wrote to memory of 2372	2912	d89996c1e3cd59f959934b14e930277f5434a5c1e667990de94c1e4cb2f243eb.exe	RegSvcs.exe
PID 2912 wrote to memory of 2372	2912	d89996c1e3cd59f959934b14e930277f5434a5c1e667990de94c1e4cb2f243eb.exe	RegSvcs.exe
PID 2912 wrote to memory of 2372	2912	d89996c1e3cd59f959934b14e930277f5434a5c1e667990de94c1e4cb2f243eb.exe	RegSvcs.exe
PID 2912 wrote to memory of 2372	2912	d89996c1e3cd59f959934b14e930277f5434a5c1e667990de94c1e4cb2f243eb.exe	RegSvcs.exe
PID 2912 wrote to memory of 2372	2912	d89996c1e3cd59f959934b14e930277f5434a5c1e667990de94c1e4cb2f243eb.exe	RegSvcs.exe
PID 2912 wrote to memory of 2372	2912	d89996c1e3cd59f959934b14e930277f5434a5c1e667990de94c1e4cb2f243eb.exe	RegSvcs.exe
PID 2912 wrote to memory of 2372	2912	d89996c1e3cd59f959934b14e930277f5434a5c1e667990de94c1e4cb2f243eb.exe	RegSvcs.exe
PID 2912 wrote to memory of 2372	2912	d89996c1e3cd59f959934b14e930277f5434a5c1e667990de94c1e4cb2f243eb.exe	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\d89996c1e3cd59f959934b14e930277f5434a5c1e667990de94c1e4cb2f243eb.exe
"C:\Users\Admin\AppData\Local\Temp\d89996c1e3cd59f959934b14e930277f5434a5c1e667990de94c1e4cb2f243eb.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2912

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Users\Admin\AppData\Local\Temp\d89996c1e3cd59f959934b14e930277f5434a5c1e667990de94c1e4cb2f243eb.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2372

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\caulds
Filesize
263KB

MD5
3e9da8d523799a78bfd37c133c865a9f

SHA1
ddc287b8623dc1df7e776fc2d733b3a81ea382ca

SHA256
86dd950cb73fc9d87df98d59ba2501d132fa0b48dc4c594b2e4ce29193113d69

SHA512
1c1f89ebe82696e858e24314e0f23ab7283fb2db841f79f3a91ced125f7aaae51321f3b3454ed1b36bf6d5bddf64663fe61e9a6ba8c10b6643d8c6344c8487b7

Download Submit
memory/2372-28-0x00000000042D0000-0x000000000431E000-memory.dmp

Filesize
312KB

Download
memory/2372-1067-0x0000000074700000-0x0000000074DEE000-memory.dmp

Filesize
6.9MB

Download
memory/2372-14-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2372-22-0x00000000042D0000-0x000000000431E000-memory.dmp

Filesize
312KB

Download
memory/2372-16-0x0000000000AF0000-0x0000000000B46000-memory.dmp

Filesize
344KB

Download
memory/2372-17-0x0000000074700000-0x0000000074DEE000-memory.dmp

Filesize
6.9MB

Download
memory/2372-19-0x0000000004A20000-0x0000000004A60000-memory.dmp

Filesize
256KB

Download
memory/2372-18-0x0000000004A20000-0x0000000004A60000-memory.dmp

Filesize
256KB

Download
memory/2372-20-0x00000000042D0000-0x0000000004324000-memory.dmp

Filesize
336KB

Download
memory/2372-26-0x00000000042D0000-0x000000000431E000-memory.dmp

Filesize
312KB

Download
memory/2372-24-0x00000000042D0000-0x000000000431E000-memory.dmp

Filesize
312KB

Download
memory/2372-80-0x00000000042D0000-0x000000000431E000-memory.dmp

Filesize
312KB

Download
memory/2372-70-0x00000000042D0000-0x000000000431E000-memory.dmp

Filesize
312KB

Download
memory/2372-64-0x00000000042D0000-0x000000000431E000-memory.dmp

Filesize
312KB

Download
memory/2372-60-0x00000000042D0000-0x000000000431E000-memory.dmp

Filesize
312KB

Download
memory/2372-50-0x00000000042D0000-0x000000000431E000-memory.dmp

Filesize
312KB

Download
memory/2372-46-0x00000000042D0000-0x000000000431E000-memory.dmp

Filesize
312KB

Download
memory/2372-78-0x00000000042D0000-0x000000000431E000-memory.dmp

Filesize
312KB

Download
memory/2372-34-0x00000000042D0000-0x000000000431E000-memory.dmp

Filesize
312KB

Download
memory/2372-32-0x00000000042D0000-0x000000000431E000-memory.dmp

Filesize
312KB

Download
memory/2372-30-0x00000000042D0000-0x000000000431E000-memory.dmp

Filesize
312KB

Download
memory/2372-1068-0x0000000004A20000-0x0000000004A60000-memory.dmp

Filesize
256KB

Download
memory/2372-15-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2372-12-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2372-36-0x00000000042D0000-0x000000000431E000-memory.dmp

Filesize
312KB

Download
memory/2372-76-0x00000000042D0000-0x000000000431E000-memory.dmp

Filesize
312KB

Download
memory/2372-74-0x00000000042D0000-0x000000000431E000-memory.dmp

Filesize
312KB

Download
memory/2372-72-0x00000000042D0000-0x000000000431E000-memory.dmp

Filesize
312KB

Download
memory/2372-68-0x00000000042D0000-0x000000000431E000-memory.dmp

Filesize
312KB

Download
memory/2372-66-0x00000000042D0000-0x000000000431E000-memory.dmp

Filesize
312KB

Download
memory/2372-62-0x00000000042D0000-0x000000000431E000-memory.dmp

Filesize
312KB

Download
memory/2372-58-0x00000000042D0000-0x000000000431E000-memory.dmp

Filesize
312KB

Download
memory/2372-56-0x00000000042D0000-0x000000000431E000-memory.dmp

Filesize
312KB

Download
memory/2372-54-0x00000000042D0000-0x000000000431E000-memory.dmp

Filesize
312KB

Download
memory/2372-52-0x00000000042D0000-0x000000000431E000-memory.dmp

Filesize
312KB

Download
memory/2372-48-0x00000000042D0000-0x000000000431E000-memory.dmp

Filesize
312KB

Download
memory/2372-47-0x00000000042D0000-0x000000000431E000-memory.dmp

Filesize
312KB

Download
memory/2372-44-0x00000000042D0000-0x000000000431E000-memory.dmp

Filesize
312KB

Download
memory/2372-42-0x00000000042D0000-0x000000000431E000-memory.dmp

Filesize
312KB

Download
memory/2372-40-0x00000000042D0000-0x000000000431E000-memory.dmp

Filesize
312KB

Download
memory/2372-1065-0x0000000004A20000-0x0000000004A60000-memory.dmp

Filesize
256KB

Download
memory/2372-38-0x00000000042D0000-0x000000000431E000-memory.dmp

Filesize
312KB

Download
memory/2372-1066-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2372-21-0x00000000042D0000-0x000000000431E000-memory.dmp

Filesize
312KB

Download
memory/2912-11-0x0000000000700000-0x0000000000704000-memory.dmp

Filesize
16KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads