Analysis
- max time kernel
147s - max time network
125s - platform
windows10-2004_x64 - resource
win10v2004-20240419-en - resource tags
- submitted
07/05/2024, 01:58
General
- Target 0043e93f341cc7fdb89eda9e7080fddae76e668ef3f05a5920ea1c1e6f6fb417.exe
- Size 1.1MB
- Sample240507-cd578sgc95
- SHA256 0043e93f341cc7fdb89eda9e7080fddae76e668ef3f05a5920ea1c1e6f6fb417
Malware Config
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Detect ZGRat V1 33 IoCs
- ZGRat
ZGRat is remote access trojan written in C#.
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0043e93f341cc7fdb89eda9e7080fddae76e668ef3f05a5920ea1c1e6f6fb417.exe"C:\Users\Admin\AppData\Local\Temp\0043e93f341cc7fdb89eda9e7080fddae76e668ef3f05a5920ea1c1e6f6fb417.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\0043e93f341cc7fdb89eda9e7080fddae76e668ef3f05a5920ea1c1e6f6fb417.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
aut3DC4.tmp
memory/4420-12-0x0000000004570000-0x0000000004574000-memory.dmp
memory/4948-15-0x0000000000400000-0x0000000000446000-memory.dmp
memory/4948-16-0x0000000000400000-0x0000000000446000-memory.dmp
memory/4948-14-0x0000000000400000-0x0000000000446000-memory.dmp
memory/4948-13-0x0000000000400000-0x0000000000446000-memory.dmp
memory/4948-17-0x00000000740FE000-0x00000000740FF000-memory.dmp
memory/4948-18-0x0000000004F40000-0x0000000004F94000-memory.dmp
memory/4948-19-0x00000000740F0000-0x00000000748A0000-memory.dmp
memory/4948-21-0x0000000005030000-0x0000000005082000-memory.dmp
memory/4948-20-0x00000000055A0000-0x0000000005B44000-memory.dmp
memory/4948-22-0x00000000740F0000-0x00000000748A0000-memory.dmp
memory/4948-23-0x0000000005030000-0x000000000507D000-memory.dmp
memory/4948-82-0x0000000005030000-0x000000000507D000-memory.dmp
memory/4948-80-0x0000000005030000-0x000000000507D000-memory.dmp
memory/4948-76-0x0000000005030000-0x000000000507D000-memory.dmp
memory/4948-74-0x0000000005030000-0x000000000507D000-memory.dmp
memory/4948-72-0x0000000005030000-0x000000000507D000-memory.dmp
memory/4948-70-0x0000000005030000-0x000000000507D000-memory.dmp
memory/4948-68-0x0000000005030000-0x000000000507D000-memory.dmp
memory/4948-66-0x0000000005030000-0x000000000507D000-memory.dmp
memory/4948-64-0x0000000005030000-0x000000000507D000-memory.dmp
memory/4948-62-0x0000000005030000-0x000000000507D000-memory.dmp
memory/4948-60-0x0000000005030000-0x000000000507D000-memory.dmp
memory/4948-56-0x0000000005030000-0x000000000507D000-memory.dmp
memory/4948-54-0x0000000005030000-0x000000000507D000-memory.dmp
memory/4948-52-0x0000000005030000-0x000000000507D000-memory.dmp
memory/4948-50-0x0000000005030000-0x000000000507D000-memory.dmp
memory/4948-48-0x0000000005030000-0x000000000507D000-memory.dmp
memory/4948-46-0x0000000005030000-0x000000000507D000-memory.dmp
memory/4948-44-0x0000000005030000-0x000000000507D000-memory.dmp
memory/4948-42-0x0000000005030000-0x000000000507D000-memory.dmp
memory/4948-40-0x0000000005030000-0x000000000507D000-memory.dmp
memory/4948-38-0x0000000005030000-0x000000000507D000-memory.dmp
memory/4948-36-0x0000000005030000-0x000000000507D000-memory.dmp
memory/4948-34-0x0000000005030000-0x000000000507D000-memory.dmp
memory/4948-32-0x0000000005030000-0x000000000507D000-memory.dmp
memory/4948-30-0x0000000005030000-0x000000000507D000-memory.dmp
memory/4948-28-0x0000000005030000-0x000000000507D000-memory.dmp
memory/4948-26-0x0000000005030000-0x000000000507D000-memory.dmp
memory/4948-24-0x0000000005030000-0x000000000507D000-memory.dmp
memory/4948-78-0x0000000005030000-0x000000000507D000-memory.dmp
memory/4948-58-0x0000000005030000-0x000000000507D000-memory.dmp
memory/4948-1053-0x0000000005210000-0x0000000005276000-memory.dmp
memory/4948-1054-0x00000000740F0000-0x00000000748A0000-memory.dmp
memory/4948-1055-0x0000000006690000-0x00000000066E0000-memory.dmp
memory/4948-1056-0x0000000006780000-0x0000000006812000-memory.dmp
memory/4948-1057-0x00000000066F0000-0x00000000066FA000-memory.dmp
memory/4948-1058-0x0000000000400000-0x0000000000446000-memory.dmp
memory/4948-1059-0x00000000740FE000-0x00000000740FF000-memory.dmp
memory/4948-1060-0x00000000740F0000-0x00000000748A0000-memory.dmp