Analysis

  • max time kernel
    120s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    06/05/2024, 01:06 UTC

General

  • Target

    57effe25b0694954debe861780a0dd92b8925dbf599129644e14c10344c1a1eb.exe

  • Size

    1.2MB

  • MD5

    d4089829797177e6d008fcb4379ce1a0

  • SHA1

    50286992343b8a628d879cddc53a6eb954436d42

  • SHA256

    57effe25b0694954debe861780a0dd92b8925dbf599129644e14c10344c1a1eb

  • SHA512

    f28af57f563e9340eef734895702bd95236c764b158c445b3a704e45b56b981eda16c0254b1647eaec290500096abb75940785cc591bbcab84d75373ce26e5ff

  • SSDEEP

    24576:DAHnh+eWsN3skA4RV1Hom2KXMmHa22yAys4uZRbAgXKzibK5:Oh+ZkldoPK8Ya22yAypuZmgaziE

Malware Config

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Detect ZGRat V1 33 IoCs
  • ZGRat

    ZGRat is remote access trojan written in C#.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\57effe25b0694954debe861780a0dd92b8925dbf599129644e14c10344c1a1eb.exe
    "C:\Users\Admin\AppData\Local\Temp\57effe25b0694954debe861780a0dd92b8925dbf599129644e14c10344c1a1eb.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2880
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Users\Admin\AppData\Local\Temp\57effe25b0694954debe861780a0dd92b8925dbf599129644e14c10344c1a1eb.exe"
      2⤵
      • Accesses Microsoft Outlook profiles
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • outlook_office_path
      • outlook_win_path
      PID:1752

Network

  • flag-us
    DNS
    api.ipify.org
    RegSvcs.exe
    Remote address:
    8.8.8.8:53
    Request
    api.ipify.org
    IN A
    Response
    api.ipify.org
    IN A
    104.26.13.205
    api.ipify.org
    IN A
    172.67.74.152
    api.ipify.org
    IN A
    104.26.12.205
  • flag-us
    GET
    https://api.ipify.org/
    RegSvcs.exe
    Remote address:
    104.26.13.205:443
    Request
    GET / HTTP/1.1
    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
    Host: api.ipify.org
    Connection: Keep-Alive
    Response
    HTTP/1.1 200 OK
    Date: Mon, 06 May 2024 01:07:07 GMT
    Content-Type: text/plain
    Content-Length: 14
    Connection: keep-alive
    Vary: Origin
    CF-Cache-Status: DYNAMIC
    Server: cloudflare
    CF-RAY: 87f5124ffbfa93e3-LHR
  • 104.26.13.205:443
    https://api.ipify.org/
    tls, http
    RegSvcs.exe
    1.0kB
    5.7kB
    11
    11

    HTTP Request

    GET https://api.ipify.org/

    HTTP Response

    200
  • 8.8.8.8:53
    api.ipify.org
    dns
    RegSvcs.exe
    59 B
    107 B
    1
    1

    DNS Request

    api.ipify.org

    DNS Response

    104.26.13.205
    172.67.74.152
    104.26.12.205

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1752-63-0x0000000000660000-0x00000000006AE000-memory.dmp

    Filesize

    312KB

  • memory/1752-79-0x0000000000660000-0x00000000006AE000-memory.dmp

    Filesize

    312KB

  • memory/1752-14-0x0000000000400000-0x0000000000449000-memory.dmp

    Filesize

    292KB

  • memory/1752-13-0x0000000000400000-0x0000000000449000-memory.dmp

    Filesize

    292KB

  • memory/1752-15-0x000000007415E000-0x000000007415F000-memory.dmp

    Filesize

    4KB

  • memory/1752-16-0x0000000000370000-0x00000000003C6000-memory.dmp

    Filesize

    344KB

  • memory/1752-17-0x0000000000660000-0x00000000006B4000-memory.dmp

    Filesize

    336KB

  • memory/1752-18-0x0000000074150000-0x000000007483E000-memory.dmp

    Filesize

    6.9MB

  • memory/1752-19-0x0000000074150000-0x000000007483E000-memory.dmp

    Filesize

    6.9MB

  • memory/1752-65-0x0000000000660000-0x00000000006AE000-memory.dmp

    Filesize

    312KB

  • memory/1752-49-0x0000000000660000-0x00000000006AE000-memory.dmp

    Filesize

    312KB

  • memory/1752-35-0x0000000000660000-0x00000000006AE000-memory.dmp

    Filesize

    312KB

  • memory/1752-20-0x0000000000660000-0x00000000006AE000-memory.dmp

    Filesize

    312KB

  • memory/1752-60-0x0000000000660000-0x00000000006AE000-memory.dmp

    Filesize

    312KB

  • memory/1752-27-0x0000000000660000-0x00000000006AE000-memory.dmp

    Filesize

    312KB

  • memory/1752-61-0x0000000000660000-0x00000000006AE000-memory.dmp

    Filesize

    312KB

  • memory/1752-77-0x0000000000660000-0x00000000006AE000-memory.dmp

    Filesize

    312KB

  • memory/1752-76-0x0000000000660000-0x00000000006AE000-memory.dmp

    Filesize

    312KB

  • memory/1752-73-0x0000000000660000-0x00000000006AE000-memory.dmp

    Filesize

    312KB

  • memory/1752-71-0x0000000000660000-0x00000000006AE000-memory.dmp

    Filesize

    312KB

  • memory/1752-69-0x0000000000660000-0x00000000006AE000-memory.dmp

    Filesize

    312KB

  • memory/1752-67-0x0000000000660000-0x00000000006AE000-memory.dmp

    Filesize

    312KB

  • memory/1752-11-0x0000000000400000-0x0000000000449000-memory.dmp

    Filesize

    292KB

  • memory/1752-1056-0x0000000074150000-0x000000007483E000-memory.dmp

    Filesize

    6.9MB

  • memory/1752-21-0x0000000000660000-0x00000000006AE000-memory.dmp

    Filesize

    312KB

  • memory/1752-57-0x0000000000660000-0x00000000006AE000-memory.dmp

    Filesize

    312KB

  • memory/1752-55-0x0000000000660000-0x00000000006AE000-memory.dmp

    Filesize

    312KB

  • memory/1752-53-0x0000000000660000-0x00000000006AE000-memory.dmp

    Filesize

    312KB

  • memory/1752-51-0x0000000000660000-0x00000000006AE000-memory.dmp

    Filesize

    312KB

  • memory/1752-47-0x0000000000660000-0x00000000006AE000-memory.dmp

    Filesize

    312KB

  • memory/1752-45-0x0000000000660000-0x00000000006AE000-memory.dmp

    Filesize

    312KB

  • memory/1752-43-0x0000000000660000-0x00000000006AE000-memory.dmp

    Filesize

    312KB

  • memory/1752-41-0x0000000000660000-0x00000000006AE000-memory.dmp

    Filesize

    312KB

  • memory/1752-39-0x0000000000660000-0x00000000006AE000-memory.dmp

    Filesize

    312KB

  • memory/1752-37-0x0000000000660000-0x00000000006AE000-memory.dmp

    Filesize

    312KB

  • memory/1752-33-0x0000000000660000-0x00000000006AE000-memory.dmp

    Filesize

    312KB

  • memory/1752-31-0x0000000000660000-0x00000000006AE000-memory.dmp

    Filesize

    312KB

  • memory/1752-29-0x0000000000660000-0x00000000006AE000-memory.dmp

    Filesize

    312KB

  • memory/1752-25-0x0000000000660000-0x00000000006AE000-memory.dmp

    Filesize

    312KB

  • memory/1752-23-0x0000000000660000-0x00000000006AE000-memory.dmp

    Filesize

    312KB

  • memory/1752-217-0x0000000074150000-0x000000007483E000-memory.dmp

    Filesize

    6.9MB

  • memory/1752-1053-0x0000000074150000-0x000000007483E000-memory.dmp

    Filesize

    6.9MB

  • memory/1752-1054-0x0000000000400000-0x0000000000449000-memory.dmp

    Filesize

    292KB

  • memory/1752-1055-0x000000007415E000-0x000000007415F000-memory.dmp

    Filesize

    4KB

  • memory/2880-10-0x0000000000160000-0x0000000000164000-memory.dmp

    Filesize

    16KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.