Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
07-05-2024 01:37
General
-
Target
detailed_inventory list.exe
-
Size
1.3MB
-
MD5
ecc1957c533cf2349d9fc098416e3ccb
-
SHA1
431d19037b7e42d5cd9dc8b2f0b74d1afba1dbf6
-
SHA256
1508ae003b124c788d43b4cdfc2234c304ec557cffb088280671893e3c89bab0
-
SHA512
e11555309666d894ca448f0f51f94ec20a6761c4b00e89953a8b04cf7f1d4ed0a0fd56f7ee5bbc951df8a0c5119205d793c551bf5b4cb4762c93afb50c5d2e22
-
SSDEEP
24576:bqDEvCTbMWu7rQYlBQcBiT6rprG8a01CKvDfd+1bP:bTvC/MTQYxsWR7a08Kvjcb
Malware Config
Extracted
Protocol: smtp- Host:
pathway-professionals.com - Port:
587 - Username:
[email protected] - Password:
Victor12340@
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Detect ZGRat V1 33 IoCs
-
ZGRat
ZGRat is remote access trojan written in C#.
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\detailed_inventory list.exe"C:\Users\Admin\AppData\Local\Temp\detailed_inventory list.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\detailed_inventory list.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
266KB
MD533927179b5f6ba214a6ddae7558f879c
SHA18d4c3128b01b1532aa5907977d84040a0e79e51e
SHA256cf1a5ca456b95423052b2d356649abb7e42b18c56b9635bf9642cf52d9da81b7
SHA512616148adb5dcbe41722bcfecf68e7f99e69e3ed165903c90f2fad226f39c29a5a13220883dd62b5eaea0662778f0cd03f109f411dfeb1c1ba3c9a9f595f2b141
-
Filesize
16KB
-
Filesize
284KB
-
Filesize
284KB
-
Filesize
284KB
-
Filesize
284KB
-
Filesize
4KB
-
Filesize
344KB
-
Filesize
5.6MB
-
Filesize
7.7MB
-
Filesize
344KB
-
Filesize
7.7MB
-
Filesize
316KB
-
Filesize
316KB
-
Filesize
316KB
-
Filesize
316KB
-
Filesize
316KB
-
Filesize
316KB
-
Filesize
316KB
-
Filesize
316KB
-
Filesize
316KB
-
Filesize
316KB
-
Filesize
316KB
-
Filesize
316KB
-
Filesize
316KB
-
Filesize
316KB
-
Filesize
316KB
-
Filesize
316KB
-
Filesize
316KB
-
Filesize
316KB
-
Filesize
316KB
-
Filesize
316KB
-
Filesize
316KB
-
Filesize
316KB
-
Filesize
316KB
-
Filesize
316KB
-
Filesize
316KB
-
Filesize
316KB
-
Filesize
316KB
-
Filesize
316KB
-
Filesize
316KB
-
Filesize
7.7MB
-
Filesize
316KB
-
Filesize
316KB
-
Filesize
408KB
-
Filesize
7.7MB
-
Filesize
320KB
-
Filesize
624KB
-
Filesize
584KB
-
Filesize
40KB
-
Filesize
284KB
-
Filesize
4KB
-
Filesize
7.7MB