agenttesla | cd244ca9c1a284a8e9ea743bd516d93862b797465dad6dad5e28efe8d74ac372

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/05/2024, 01:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cd244ca9c1a284a8e9ea743bd516d93862b797465dad6dad5e28efe8d74ac372.exe
Size

1.2MB
MD5

e1098f13419f159b381bb0e618ac2b7a
SHA1

536dd41423d37a6821f57ddc983abbc25684161f
SHA256

cd244ca9c1a284a8e9ea743bd516d93862b797465dad6dad5e28efe8d74ac372
SHA512

ee34ff5006ebf9a6d5eb1c0b3addc9a79bdb91345f6002e7208dc57cb5dfad4e7ddbd05d9aa82399dcecc6271992eebb5830b3788f4ff5787a01d5e784347dbf
SSDEEP

24576:bqDEvCTbMWu7rQYlBQcBiT6rprG8a0jCuHtVr988:bTvC/MTQYxsWR7a0mOVh8

Score

10^/10

agenttesla zgrat keylogger rat spyware stealer trojan

Malware Config

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Detect ZGRat V1 33 IoCs

resource	yara_rule
behavioral1/memory/2540-17-0x00000000005E0000-0x0000000000636000-memory.dmp	family_zgrat_v1
behavioral1/memory/2540-20-0x0000000000840000-0x0000000000894000-memory.dmp	family_zgrat_v1
behavioral1/memory/2540-24-0x0000000000840000-0x000000000088E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2540-68-0x0000000000840000-0x000000000088E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2540-80-0x0000000000840000-0x000000000088E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2540-78-0x0000000000840000-0x000000000088E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2540-76-0x0000000000840000-0x000000000088E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2540-74-0x0000000000840000-0x000000000088E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2540-72-0x0000000000840000-0x000000000088E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2540-70-0x0000000000840000-0x000000000088E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2540-66-0x0000000000840000-0x000000000088E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2540-64-0x0000000000840000-0x000000000088E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2540-62-0x0000000000840000-0x000000000088E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2540-60-0x0000000000840000-0x000000000088E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2540-58-0x0000000000840000-0x000000000088E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2540-56-0x0000000000840000-0x000000000088E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2540-54-0x0000000000840000-0x000000000088E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2540-52-0x0000000000840000-0x000000000088E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2540-50-0x0000000000840000-0x000000000088E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2540-48-0x0000000000840000-0x000000000088E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2540-46-0x0000000000840000-0x000000000088E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2540-44-0x0000000000840000-0x000000000088E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2540-42-0x0000000000840000-0x000000000088E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2540-40-0x0000000000840000-0x000000000088E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2540-38-0x0000000000840000-0x000000000088E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2540-36-0x0000000000840000-0x000000000088E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2540-34-0x0000000000840000-0x000000000088E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2540-32-0x0000000000840000-0x000000000088E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2540-30-0x0000000000840000-0x000000000088E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2540-28-0x0000000000840000-0x000000000088E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2540-26-0x0000000000840000-0x000000000088E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2540-22-0x0000000000840000-0x000000000088E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2540-21-0x0000000000840000-0x000000000088E000-memory.dmp	family_zgrat_v1

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	ip-api.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2660 set thread context of 2540	2660	cd244ca9c1a284a8e9ea743bd516d93862b797465dad6dad5e28efe8d74ac372.exe	28

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2540	RegSvcs.exe
2540	RegSvcs.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2660	cd244ca9c1a284a8e9ea743bd516d93862b797465dad6dad5e28efe8d74ac372.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2540	RegSvcs.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2660 wrote to memory of 2540	2660	cd244ca9c1a284a8e9ea743bd516d93862b797465dad6dad5e28efe8d74ac372.exe	28
PID 2660 wrote to memory of 2540	2660	cd244ca9c1a284a8e9ea743bd516d93862b797465dad6dad5e28efe8d74ac372.exe	28
PID 2660 wrote to memory of 2540	2660	cd244ca9c1a284a8e9ea743bd516d93862b797465dad6dad5e28efe8d74ac372.exe	28
PID 2660 wrote to memory of 2540	2660	cd244ca9c1a284a8e9ea743bd516d93862b797465dad6dad5e28efe8d74ac372.exe	28
PID 2660 wrote to memory of 2540	2660	cd244ca9c1a284a8e9ea743bd516d93862b797465dad6dad5e28efe8d74ac372.exe	28
PID 2660 wrote to memory of 2540	2660	cd244ca9c1a284a8e9ea743bd516d93862b797465dad6dad5e28efe8d74ac372.exe	28
PID 2660 wrote to memory of 2540	2660	cd244ca9c1a284a8e9ea743bd516d93862b797465dad6dad5e28efe8d74ac372.exe	28
PID 2660 wrote to memory of 2540	2660	cd244ca9c1a284a8e9ea743bd516d93862b797465dad6dad5e28efe8d74ac372.exe	28

C:\Users\Admin\AppData\Local\Temp\cd244ca9c1a284a8e9ea743bd516d93862b797465dad6dad5e28efe8d74ac372.exe
"C:\Users\Admin\AppData\Local\Temp\cd244ca9c1a284a8e9ea743bd516d93862b797465dad6dad5e28efe8d74ac372.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2660
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Users\Admin\AppData\Local\Temp\cd244ca9c1a284a8e9ea743bd516d93862b797465dad6dad5e28efe8d74ac372.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2540

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\vitraillist

Filesize
263KB

MD5
9b9b53d76c5bb6b890157993cf720c64

SHA1
e03ae3b48974c2cb28d93f9548413f833a68ec53

SHA256
570edde4f1d9dec57454b81034d86c8fd194225f036b4f9acc1792eb5983dc37

SHA512
03fbeec082b8bafa5442f4a99d5222cf4fe1385110082e816244eff980e2b898d76b36f8528954ccbd292da2004229751f17cc079bfeb41b1bc4e2471a89c4f3

Download Submit
memory/2540-58-0x0000000000840000-0x000000000088E000-memory.dmp

Filesize
312KB

Download
memory/2540-56-0x0000000000840000-0x000000000088E000-memory.dmp

Filesize
312KB

Download
memory/2540-15-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2540-14-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2540-16-0x000000007432E000-0x000000007432F000-memory.dmp

Filesize
4KB

Download
memory/2540-17-0x00000000005E0000-0x0000000000636000-memory.dmp

Filesize
344KB

Download
memory/2540-18-0x0000000074320000-0x0000000074A0E000-memory.dmp

Filesize
6.9MB

Download
memory/2540-19-0x0000000074320000-0x0000000074A0E000-memory.dmp

Filesize
6.9MB

Download
memory/2540-20-0x0000000000840000-0x0000000000894000-memory.dmp

Filesize
336KB

Download
memory/2540-24-0x0000000000840000-0x000000000088E000-memory.dmp

Filesize
312KB

Download
memory/2540-68-0x0000000000840000-0x000000000088E000-memory.dmp

Filesize
312KB

Download
memory/2540-80-0x0000000000840000-0x000000000088E000-memory.dmp

Filesize
312KB

Download
memory/2540-78-0x0000000000840000-0x000000000088E000-memory.dmp

Filesize
312KB

Download
memory/2540-76-0x0000000000840000-0x000000000088E000-memory.dmp

Filesize
312KB

Download
memory/2540-74-0x0000000000840000-0x000000000088E000-memory.dmp

Filesize
312KB

Download
memory/2540-72-0x0000000000840000-0x000000000088E000-memory.dmp

Filesize
312KB

Download
memory/2540-70-0x0000000000840000-0x000000000088E000-memory.dmp

Filesize
312KB

Download
memory/2540-1067-0x0000000074320000-0x0000000074A0E000-memory.dmp

Filesize
6.9MB

Download
memory/2540-64-0x0000000000840000-0x000000000088E000-memory.dmp

Filesize
312KB

Download
memory/2540-62-0x0000000000840000-0x000000000088E000-memory.dmp

Filesize
312KB

Download
memory/2540-12-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2540-60-0x0000000000840000-0x000000000088E000-memory.dmp

Filesize
312KB

Download
memory/2540-66-0x0000000000840000-0x000000000088E000-memory.dmp

Filesize
312KB

Download
memory/2540-54-0x0000000000840000-0x000000000088E000-memory.dmp

Filesize
312KB

Download
memory/2540-52-0x0000000000840000-0x000000000088E000-memory.dmp

Filesize
312KB

Download
memory/2540-50-0x0000000000840000-0x000000000088E000-memory.dmp

Filesize
312KB

Download
memory/2540-48-0x0000000000840000-0x000000000088E000-memory.dmp

Filesize
312KB

Download
memory/2540-46-0x0000000000840000-0x000000000088E000-memory.dmp

Filesize
312KB

Download
memory/2540-44-0x0000000000840000-0x000000000088E000-memory.dmp

Filesize
312KB

Download
memory/2540-42-0x0000000000840000-0x000000000088E000-memory.dmp

Filesize
312KB

Download
memory/2540-40-0x0000000000840000-0x000000000088E000-memory.dmp

Filesize
312KB

Download
memory/2540-38-0x0000000000840000-0x000000000088E000-memory.dmp

Filesize
312KB

Download
memory/2540-36-0x0000000000840000-0x000000000088E000-memory.dmp

Filesize
312KB

Download
memory/2540-34-0x0000000000840000-0x000000000088E000-memory.dmp

Filesize
312KB

Download
memory/2540-32-0x0000000000840000-0x000000000088E000-memory.dmp

Filesize
312KB

Download
memory/2540-30-0x0000000000840000-0x000000000088E000-memory.dmp

Filesize
312KB

Download
memory/2540-28-0x0000000000840000-0x000000000088E000-memory.dmp

Filesize
312KB

Download
memory/2540-26-0x0000000000840000-0x000000000088E000-memory.dmp

Filesize
312KB

Download
memory/2540-22-0x0000000000840000-0x000000000088E000-memory.dmp

Filesize
312KB

Download
memory/2540-21-0x0000000000840000-0x000000000088E000-memory.dmp

Filesize
312KB

Download
memory/2540-1065-0x0000000074320000-0x0000000074A0E000-memory.dmp

Filesize
6.9MB

Download
memory/2540-1066-0x000000007432E000-0x000000007432F000-memory.dmp

Filesize
4KB

Download
memory/2660-11-0x0000000000110000-0x0000000000114000-memory.dmp

Filesize
16KB

Download