Analysis

  • max time kernel
    141s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/05/2024, 20:55

General

  • Target

    423720630070804e01179413187d08c244a30225e658e38b9647ec6c26622d26.exe

  • Size

    1.1MB

  • MD5

    343dcea7093067c0d16339e9838b0141

  • SHA1

    65b00a604b0b14e846adbce16e9367a4294c8c3f

  • SHA256

    423720630070804e01179413187d08c244a30225e658e38b9647ec6c26622d26

  • SHA512

    cc17aa351f7542d093055aaa604a7abc4c5292c4fd588803cd5ebd6d0ce2e8b27736371228ace24abbae89539d28ba79f9948caaedf3c201c26da6a32b814e54

  • SSDEEP

    24576:rqDEvCTbMWu7rQYlBQcBiT6rprG8ay0Jr+3mqPwS9vdrpCvNa:rTvC/MTQYxsWR7ayy3ADS

Malware Config

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Detect ZGRat V1 33 IoCs
  • ZGRat

    ZGRat is remote access trojan written in C#.

  • Detect packed .NET executables. Mostly AgentTeslaV4. 33 IoCs
  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 33 IoCs
  • Detects executables referencing Windows vault credential objects. Observed in infostealers 33 IoCs
  • Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers 33 IoCs
  • Detects executables referencing many email and collaboration clients. Observed in information stealers 33 IoCs
  • Detects executables referencing many file transfer clients. Observed in information stealers 33 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\423720630070804e01179413187d08c244a30225e658e38b9647ec6c26622d26.exe
    "C:\Users\Admin\AppData\Local\Temp\423720630070804e01179413187d08c244a30225e658e38b9647ec6c26622d26.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3148
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Users\Admin\AppData\Local\Temp\423720630070804e01179413187d08c244a30225e658e38b9647ec6c26622d26.exe"
      2⤵
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2344
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4388 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:5880

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\aut644.tmp

            Filesize

            262KB

            MD5

            313eae27f36307c0fb7a3ffdda8dae2a

            SHA1

            487b428fcfd56f11c32c5f1cb73993ae359d09eb

            SHA256

            119e6cd988d8df285a9512b7567cb1088a33d78a4a2f112454c9dad5f3fdf525

            SHA512

            581aa6bb6562d5f99814a0fcc24d7d6190d06fe40c8e29731860138b75dd2ca0e0a3a085910e5fe66e181ddca7711057b24dfd8f008ae25b2813d92dd3798902

          • memory/2344-13-0x0000000000400000-0x0000000000446000-memory.dmp

            Filesize

            280KB

          • memory/2344-14-0x0000000000400000-0x0000000000446000-memory.dmp

            Filesize

            280KB

          • memory/2344-16-0x0000000000400000-0x0000000000446000-memory.dmp

            Filesize

            280KB

          • memory/2344-15-0x0000000000400000-0x0000000000446000-memory.dmp

            Filesize

            280KB

          • memory/2344-17-0x000000007405E000-0x000000007405F000-memory.dmp

            Filesize

            4KB

          • memory/2344-18-0x00000000050B0000-0x0000000005104000-memory.dmp

            Filesize

            336KB

          • memory/2344-19-0x0000000074050000-0x0000000074800000-memory.dmp

            Filesize

            7.7MB

          • memory/2344-20-0x0000000074050000-0x0000000074800000-memory.dmp

            Filesize

            7.7MB

          • memory/2344-21-0x0000000074050000-0x0000000074800000-memory.dmp

            Filesize

            7.7MB

          • memory/2344-22-0x00000000056D0000-0x0000000005C74000-memory.dmp

            Filesize

            5.6MB

          • memory/2344-23-0x0000000005170000-0x00000000051C2000-memory.dmp

            Filesize

            328KB

          • memory/2344-29-0x0000000005170000-0x00000000051BD000-memory.dmp

            Filesize

            308KB

          • memory/2344-42-0x0000000005170000-0x00000000051BD000-memory.dmp

            Filesize

            308KB

          • memory/2344-39-0x0000000005170000-0x00000000051BD000-memory.dmp

            Filesize

            308KB

          • memory/2344-81-0x0000000005170000-0x00000000051BD000-memory.dmp

            Filesize

            308KB

          • memory/2344-77-0x0000000005170000-0x00000000051BD000-memory.dmp

            Filesize

            308KB

          • memory/2344-73-0x0000000005170000-0x00000000051BD000-memory.dmp

            Filesize

            308KB

          • memory/2344-71-0x0000000005170000-0x00000000051BD000-memory.dmp

            Filesize

            308KB

          • memory/2344-69-0x0000000005170000-0x00000000051BD000-memory.dmp

            Filesize

            308KB

          • memory/2344-65-0x0000000005170000-0x00000000051BD000-memory.dmp

            Filesize

            308KB

          • memory/2344-63-0x0000000005170000-0x00000000051BD000-memory.dmp

            Filesize

            308KB

          • memory/2344-62-0x0000000005170000-0x00000000051BD000-memory.dmp

            Filesize

            308KB

          • memory/2344-59-0x0000000005170000-0x00000000051BD000-memory.dmp

            Filesize

            308KB

          • memory/2344-55-0x0000000005170000-0x00000000051BD000-memory.dmp

            Filesize

            308KB

          • memory/2344-53-0x0000000005170000-0x00000000051BD000-memory.dmp

            Filesize

            308KB

          • memory/2344-51-0x0000000005170000-0x00000000051BD000-memory.dmp

            Filesize

            308KB

          • memory/2344-47-0x0000000005170000-0x00000000051BD000-memory.dmp

            Filesize

            308KB

          • memory/2344-45-0x0000000005170000-0x00000000051BD000-memory.dmp

            Filesize

            308KB

          • memory/2344-43-0x0000000005170000-0x00000000051BD000-memory.dmp

            Filesize

            308KB

          • memory/2344-37-0x0000000005170000-0x00000000051BD000-memory.dmp

            Filesize

            308KB

          • memory/2344-35-0x0000000005170000-0x00000000051BD000-memory.dmp

            Filesize

            308KB

          • memory/2344-33-0x0000000005170000-0x00000000051BD000-memory.dmp

            Filesize

            308KB

          • memory/2344-31-0x0000000005170000-0x00000000051BD000-memory.dmp

            Filesize

            308KB

          • memory/2344-83-0x0000000005170000-0x00000000051BD000-memory.dmp

            Filesize

            308KB

          • memory/2344-79-0x0000000005170000-0x00000000051BD000-memory.dmp

            Filesize

            308KB

          • memory/2344-75-0x0000000005170000-0x00000000051BD000-memory.dmp

            Filesize

            308KB

          • memory/2344-67-0x0000000005170000-0x00000000051BD000-memory.dmp

            Filesize

            308KB

          • memory/2344-57-0x0000000005170000-0x00000000051BD000-memory.dmp

            Filesize

            308KB

          • memory/2344-49-0x0000000005170000-0x00000000051BD000-memory.dmp

            Filesize

            308KB

          • memory/2344-27-0x0000000005170000-0x00000000051BD000-memory.dmp

            Filesize

            308KB

          • memory/2344-25-0x0000000005170000-0x00000000051BD000-memory.dmp

            Filesize

            308KB

          • memory/2344-24-0x0000000005170000-0x00000000051BD000-memory.dmp

            Filesize

            308KB

          • memory/2344-1056-0x0000000074050000-0x0000000074800000-memory.dmp

            Filesize

            7.7MB

          • memory/2344-1057-0x0000000005370000-0x00000000053D6000-memory.dmp

            Filesize

            408KB

          • memory/2344-1059-0x0000000006230000-0x00000000062C2000-memory.dmp

            Filesize

            584KB

          • memory/2344-1060-0x0000000000400000-0x0000000000446000-memory.dmp

            Filesize

            280KB

          • memory/2344-1062-0x0000000000400000-0x0000000000446000-memory.dmp

            Filesize

            280KB

          • memory/2344-1063-0x0000000074050000-0x0000000074800000-memory.dmp

            Filesize

            7.7MB

          • memory/3148-12-0x00000000026F0000-0x00000000026F4000-memory.dmp

            Filesize

            16KB