Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
08-05-2024 07:21
General
-
Target
SecuriteInfo.com.Trojan-Downloader.Autoit.gen.6551.1850.exe
-
Size
1.1MB
-
MD5
07da191aaf1694030851e095ae5fe747
-
SHA1
23761afda1ff5dcdf996c8d50993c0060a4ce09d
-
SHA256
a1cf662c445e81ec27bf49d85200cc1142ef655d4a80326e7940c5f9944569ca
-
SHA512
7b54adb7a047fc4a85243936c0cfda6acc81292f2a249550bd70fae8771558e54a976acf1d7770b6980f1cb11c41253ec99cef5c3c093c57d76151797d7c84f8
-
SSDEEP
24576:H4lavt0LkLL9IMixoEgea1qsykyuGeq9MmCS:ikwkn9IMHea1q8zaPCS
Malware Config
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Detect ZGRat V1 33 IoCs
-
ZGRat
ZGRat is remote access trojan written in C#.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious behavior: MapViewOfSection 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 4 IoCs
-
Suspicious use of SendNotifyMessage 4 IoCs
-
Suspicious use of WriteProcessMemory 19 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan-Downloader.Autoit.gen.6551.1850.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan-Downloader.Autoit.gen.6551.1850.exe"1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan-Downloader.Autoit.gen.6551.1850.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan-Downloader.Autoit.gen.6551.1850.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan-Downloader.Autoit.gen.6551.1850.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan-Downloader.Autoit.gen.6551.1850.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
262KB
MD59cc73ce9fede92c7922aec58ae417db7
SHA1132e3f5f1e636a8deba17864a19b78a70403ae9e
SHA2561da1a02aad01ef04c923e2dac894c555ac627f97c5a171d7facef4c00924ec2f
SHA512219828521a21258714729bbaf3a2561ac926054e5cd7049266777881b99c715a7eb6bfa05869c8cceeaa90174b29a5e8257d28f4c81bf70ea91ed77c23299a15
-
Filesize
28KB
MD5d223e8744057b6f802d4817dcfe7442c
SHA19dae775116084543cba496f7f5d654d0d32f3339
SHA2569c27b133fe4eb6780ebe878fccc0ef24cabe6a5e4d0f1142bb12e66b6e13b51b
SHA5120b617ca9b614152e2a7f2b15c4c16b0a9dbae76a0e84b673b74e0f5d7ebd3617db498d9eb8ccecf4e56f4fade294d44348b91dcaafb1f23e942083fc10a7afb9
-
Filesize
16KB
-
Filesize
308KB
-
Filesize
4KB
-
Filesize
280KB
-
Filesize
308KB
-
Filesize
336KB
-
Filesize
328KB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
308KB
-
Filesize
6.9MB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
280KB
-
Filesize
308KB
-
Filesize
280KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
6.9MB
-
Filesize
280KB
-
Filesize
4KB
-
Filesize
6.9MB