Analysis
-
max time kernel
142s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
07-05-2024 01:40
General
-
Target
27ea6655cc7fc86d945b3b4fb3a552152d52d5a0bbef1bae743fc9e4cac97b3e.exe
-
Size
1.2MB
-
MD5
e4fd60fd28fd5b3a169fb723a669bb00
-
SHA1
cd200b326dfcda10b965b46b732dc5b91d6c4cb0
-
SHA256
27ea6655cc7fc86d945b3b4fb3a552152d52d5a0bbef1bae743fc9e4cac97b3e
-
SHA512
3074b377e1312e1fc4a06b70e1bfac7a7d15f278bca1f537a59d0f6dbe7d74c154fcc173462124f4c35c92d416ba5f973355754b77848a7bee8bd4a9d359ba30
-
SSDEEP
24576:JqDEvCTbMWu7rQYlBQcBiT6rprG8akqfYcaPP/UmA6/ISnkR2:JTvC/MTQYxsWR7akqfYc0UmA6Vn4
Malware Config
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Detect ZGRat V1 33 IoCs
-
ZGRat
ZGRat is remote access trojan written in C#.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\27ea6655cc7fc86d945b3b4fb3a552152d52d5a0bbef1bae743fc9e4cac97b3e.exe"C:\Users\Admin\AppData\Local\Temp\27ea6655cc7fc86d945b3b4fb3a552152d52d5a0bbef1bae743fc9e4cac97b3e.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\27ea6655cc7fc86d945b3b4fb3a552152d52d5a0bbef1bae743fc9e4cac97b3e.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
263KB
MD5e23417e61ef49204cce50c17eec57354
SHA10534ab57b559e701e73e2d15da7392dc9321a467
SHA25605891802b43a822191b0ab80227f2daddf81c82ab47f212c678e90df968a2d1b
SHA5129e6412e41e84ac60918f40b55a2a905ff50d58704d9dec04ee3c2e37c074cc9a7f5af9d11a5e5c5b391c09750fc4a447c1fd09404ef4273e6e4fe22656f7b7ce
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
4KB
-
Filesize
344KB
-
Filesize
7.7MB
-
Filesize
5.6MB
-
Filesize
336KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
408KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
7.7MB
-
Filesize
320KB
-
Filesize
584KB
-
Filesize
40KB
-
Filesize
280KB
-
Filesize
4KB
-
Filesize
7.7MB
-
Filesize
16KB