Analysis
-
max time kernel
117s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
07-05-2024 17:43
Static task
static1
Behavioral task
behavioral1
Sample
IMG_77020316.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
IMG_77020316.exe
Resource
win10v2004-20240426-en
General
-
Target
IMG_77020316.exe
-
Size
305KB
-
MD5
2c44da62f5bf398810c3a0588098e2c8
-
SHA1
b916038164d5cc19bf02da2fae9ec5ce33df5ca5
-
SHA256
224e23285395f06085656e63dbc4c1bbfb28433ed4d4a7a398ca9f8c7a77dd1e
-
SHA512
3451bd258dab8a11286df5fe3c3e965e85e32e110c00d2073f9327927a97c468b9fa00a1d8d13fdafd69cdeda1cede79cdfcf3f58636e6cc9b748f13d97a8f30
-
SSDEEP
1536:EUGtkijLv6JQJvtzAZiN4M1LG99rGsa8OXK34PNu0PB92EC3CNjm5Lh1c3h0b:aD2MZG9ZGsIK34PNX92ECSNKF13b
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
66.29.151.236 - Port:
587 - Username:
[email protected] - Password:
AvydGQ8TIDH9 - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Detect ZGRat V1 34 IoCs
resource yara_rule behavioral1/memory/1736-3-0x00000000065F0000-0x0000000006820000-memory.dmp family_zgrat_v1 behavioral1/memory/1736-4-0x00000000065F0000-0x000000000681B000-memory.dmp family_zgrat_v1 behavioral1/memory/1736-15-0x00000000065F0000-0x000000000681B000-memory.dmp family_zgrat_v1 behavioral1/memory/1736-5-0x00000000065F0000-0x000000000681B000-memory.dmp family_zgrat_v1 behavioral1/memory/1736-7-0x00000000065F0000-0x000000000681B000-memory.dmp family_zgrat_v1 behavioral1/memory/1736-54-0x00000000065F0000-0x000000000681B000-memory.dmp family_zgrat_v1 behavioral1/memory/1736-13-0x00000000065F0000-0x000000000681B000-memory.dmp family_zgrat_v1 behavioral1/memory/1736-61-0x00000000065F0000-0x000000000681B000-memory.dmp family_zgrat_v1 behavioral1/memory/1736-59-0x00000000065F0000-0x000000000681B000-memory.dmp family_zgrat_v1 behavioral1/memory/1736-57-0x00000000065F0000-0x000000000681B000-memory.dmp family_zgrat_v1 behavioral1/memory/1736-55-0x00000000065F0000-0x000000000681B000-memory.dmp family_zgrat_v1 behavioral1/memory/1736-51-0x00000000065F0000-0x000000000681B000-memory.dmp family_zgrat_v1 behavioral1/memory/1736-63-0x00000000065F0000-0x000000000681B000-memory.dmp family_zgrat_v1 behavioral1/memory/1736-49-0x00000000065F0000-0x000000000681B000-memory.dmp family_zgrat_v1 behavioral1/memory/1736-47-0x00000000065F0000-0x000000000681B000-memory.dmp family_zgrat_v1 behavioral1/memory/1736-45-0x00000000065F0000-0x000000000681B000-memory.dmp family_zgrat_v1 behavioral1/memory/1736-43-0x00000000065F0000-0x000000000681B000-memory.dmp family_zgrat_v1 behavioral1/memory/1736-41-0x00000000065F0000-0x000000000681B000-memory.dmp family_zgrat_v1 behavioral1/memory/1736-39-0x00000000065F0000-0x000000000681B000-memory.dmp family_zgrat_v1 behavioral1/memory/1736-37-0x00000000065F0000-0x000000000681B000-memory.dmp family_zgrat_v1 behavioral1/memory/1736-35-0x00000000065F0000-0x000000000681B000-memory.dmp family_zgrat_v1 behavioral1/memory/1736-33-0x00000000065F0000-0x000000000681B000-memory.dmp family_zgrat_v1 behavioral1/memory/1736-31-0x00000000065F0000-0x000000000681B000-memory.dmp family_zgrat_v1 behavioral1/memory/1736-29-0x00000000065F0000-0x000000000681B000-memory.dmp family_zgrat_v1 behavioral1/memory/1736-27-0x00000000065F0000-0x000000000681B000-memory.dmp family_zgrat_v1 behavioral1/memory/1736-25-0x00000000065F0000-0x000000000681B000-memory.dmp family_zgrat_v1 behavioral1/memory/1736-23-0x00000000065F0000-0x000000000681B000-memory.dmp family_zgrat_v1 behavioral1/memory/1736-21-0x00000000065F0000-0x000000000681B000-memory.dmp family_zgrat_v1 behavioral1/memory/1736-19-0x00000000065F0000-0x000000000681B000-memory.dmp family_zgrat_v1 behavioral1/memory/1736-17-0x00000000065F0000-0x000000000681B000-memory.dmp family_zgrat_v1 behavioral1/memory/1736-11-0x00000000065F0000-0x000000000681B000-memory.dmp family_zgrat_v1 behavioral1/memory/1736-9-0x00000000065F0000-0x000000000681B000-memory.dmp family_zgrat_v1 behavioral1/memory/1736-65-0x00000000065F0000-0x000000000681B000-memory.dmp family_zgrat_v1 behavioral1/memory/1736-67-0x00000000065F0000-0x000000000681B000-memory.dmp family_zgrat_v1 -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\kcsof = "C:\\Users\\Admin\\AppData\\Roaming\\kcsof.exe" IMG_77020316.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 6 api.ipify.org 7 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1736 set thread context of 3016 1736 IMG_77020316.exe 28 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3016 IMG_77020316.exe 3016 IMG_77020316.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1736 IMG_77020316.exe Token: SeDebugPrivilege 1736 IMG_77020316.exe Token: SeDebugPrivilege 3016 IMG_77020316.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1736 wrote to memory of 3016 1736 IMG_77020316.exe 28 PID 1736 wrote to memory of 3016 1736 IMG_77020316.exe 28 PID 1736 wrote to memory of 3016 1736 IMG_77020316.exe 28 PID 1736 wrote to memory of 3016 1736 IMG_77020316.exe 28 PID 1736 wrote to memory of 3016 1736 IMG_77020316.exe 28 PID 1736 wrote to memory of 3016 1736 IMG_77020316.exe 28 PID 1736 wrote to memory of 3016 1736 IMG_77020316.exe 28 PID 1736 wrote to memory of 3016 1736 IMG_77020316.exe 28 PID 1736 wrote to memory of 3016 1736 IMG_77020316.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\IMG_77020316.exe"C:\Users\Admin\AppData\Local\Temp\IMG_77020316.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\IMG_77020316.exe"C:\Users\Admin\AppData\Local\Temp\IMG_77020316.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3016
-