Analysis
-
max time kernel
147s -
max time network
109s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
07-05-2024 01:06
General
-
Target
EXJ-CHPV-05-N01-001.exe
-
Size
767KB
-
MD5
57d4e5602ac60212f7c422321c9b0b80
-
SHA1
a6d42a59f9d8121cfaab73f4b2b416e229fbafcd
-
SHA256
8a2fc6d9e2cc5549bc52b8914be340fbd0f72ae63d6f8b7959d1854342767e26
-
SHA512
b725661cbd3d35d889289fb86a3ca2a6355768cd35e047ff82f64c7717759703c24af2f2ee7bc31f50af3fc073fe9a1dee560d71305f180a2cb56676021aeed0
-
SSDEEP
12288:BLS6MKtR/ZZ4xYalDPn+v1spR4R9xSQkyRZNQKMza1Nn9zD7N+bd0/:pS6MkR/ZytPnIY2bSQkyRZNXMzeN1o0/
Malware Config
Extracted
Protocol: smtp- Host:
smtp.strato.de - Port:
587 - Username:
[email protected] - Password:
Oy1)8JSu_qPx(rzV_{Xu
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Detect ZGRat V1 33 IoCs
-
ZGRat
ZGRat is remote access trojan written in C#.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\EXJ-CHPV-05-N01-001.exe"C:\Users\Admin\AppData\Local\Temp\EXJ-CHPV-05-N01-001.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
284KB
-
Filesize
284KB
-
Filesize
4KB
-
Filesize
352KB
-
Filesize
5.6MB
-
Filesize
7.7MB
-
Filesize
344KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
7.7MB
-
Filesize
320KB
-
Filesize
7.7MB
-
Filesize
320KB
-
Filesize
284KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
4KB
-
Filesize
40KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
284KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
284KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
408KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
624KB
-
Filesize
584KB
-
Filesize
10.8MB
-
Filesize
632KB
-
Filesize
8KB
-
Filesize
168KB
-
Filesize
10.8MB