agenttesla | cd244ca9c1a284a8e9ea743bd516d93862b797465dad6dad5e28efe8d74ac372

Analysis

max time kernel
92s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09/05/2024, 01:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cd244ca9c1a284a8e9ea743bd516d93862b797465dad6dad5e28efe8d74ac372.exe
Size

1.2MB
MD5

e1098f13419f159b381bb0e618ac2b7a
SHA1

536dd41423d37a6821f57ddc983abbc25684161f
SHA256

cd244ca9c1a284a8e9ea743bd516d93862b797465dad6dad5e28efe8d74ac372
SHA512

ee34ff5006ebf9a6d5eb1c0b3addc9a79bdb91345f6002e7208dc57cb5dfad4e7ddbd05d9aa82399dcecc6271992eebb5830b3788f4ff5787a01d5e784347dbf
SSDEEP

24576:bqDEvCTbMWu7rQYlBQcBiT6rprG8a0jCuHtVr988:bTvC/MTQYxsWR7a0mOVh8

Score

10^/10

agenttesla zgrat keylogger rat spyware stealer trojan

Malware Config

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Detect ZGRat V1 33 IoCs

resource	yara_rule
behavioral2/memory/2580-59-0x0000000005810000-0x0000000005866000-memory.dmp	family_zgrat_v1
behavioral2/memory/2580-61-0x00000000058B0000-0x0000000005904000-memory.dmp	family_zgrat_v1
behavioral2/memory/2580-67-0x00000000058B0000-0x00000000058FE000-memory.dmp	family_zgrat_v1
behavioral2/memory/2580-75-0x00000000058B0000-0x00000000058FE000-memory.dmp	family_zgrat_v1
behavioral2/memory/2580-121-0x00000000058B0000-0x00000000058FE000-memory.dmp	family_zgrat_v1
behavioral2/memory/2580-117-0x00000000058B0000-0x00000000058FE000-memory.dmp	family_zgrat_v1
behavioral2/memory/2580-115-0x00000000058B0000-0x00000000058FE000-memory.dmp	family_zgrat_v1
behavioral2/memory/2580-114-0x00000000058B0000-0x00000000058FE000-memory.dmp	family_zgrat_v1
behavioral2/memory/2580-111-0x00000000058B0000-0x00000000058FE000-memory.dmp	family_zgrat_v1
behavioral2/memory/2580-109-0x00000000058B0000-0x00000000058FE000-memory.dmp	family_zgrat_v1
behavioral2/memory/2580-107-0x00000000058B0000-0x00000000058FE000-memory.dmp	family_zgrat_v1
behavioral2/memory/2580-105-0x00000000058B0000-0x00000000058FE000-memory.dmp	family_zgrat_v1
behavioral2/memory/2580-103-0x00000000058B0000-0x00000000058FE000-memory.dmp	family_zgrat_v1
behavioral2/memory/2580-101-0x00000000058B0000-0x00000000058FE000-memory.dmp	family_zgrat_v1
behavioral2/memory/2580-99-0x00000000058B0000-0x00000000058FE000-memory.dmp	family_zgrat_v1
behavioral2/memory/2580-95-0x00000000058B0000-0x00000000058FE000-memory.dmp	family_zgrat_v1
behavioral2/memory/2580-93-0x00000000058B0000-0x00000000058FE000-memory.dmp	family_zgrat_v1
behavioral2/memory/2580-91-0x00000000058B0000-0x00000000058FE000-memory.dmp	family_zgrat_v1
behavioral2/memory/2580-90-0x00000000058B0000-0x00000000058FE000-memory.dmp	family_zgrat_v1
behavioral2/memory/2580-87-0x00000000058B0000-0x00000000058FE000-memory.dmp	family_zgrat_v1
behavioral2/memory/2580-85-0x00000000058B0000-0x00000000058FE000-memory.dmp	family_zgrat_v1
behavioral2/memory/2580-83-0x00000000058B0000-0x00000000058FE000-memory.dmp	family_zgrat_v1
behavioral2/memory/2580-81-0x00000000058B0000-0x00000000058FE000-memory.dmp	family_zgrat_v1
behavioral2/memory/2580-79-0x00000000058B0000-0x00000000058FE000-memory.dmp	family_zgrat_v1
behavioral2/memory/2580-77-0x00000000058B0000-0x00000000058FE000-memory.dmp	family_zgrat_v1
behavioral2/memory/2580-73-0x00000000058B0000-0x00000000058FE000-memory.dmp	family_zgrat_v1
behavioral2/memory/2580-71-0x00000000058B0000-0x00000000058FE000-memory.dmp	family_zgrat_v1
behavioral2/memory/2580-69-0x00000000058B0000-0x00000000058FE000-memory.dmp	family_zgrat_v1
behavioral2/memory/2580-65-0x00000000058B0000-0x00000000058FE000-memory.dmp	family_zgrat_v1
behavioral2/memory/2580-119-0x00000000058B0000-0x00000000058FE000-memory.dmp	family_zgrat_v1
behavioral2/memory/2580-97-0x00000000058B0000-0x00000000058FE000-memory.dmp	family_zgrat_v1
behavioral2/memory/2580-63-0x00000000058B0000-0x00000000058FE000-memory.dmp	family_zgrat_v1
behavioral2/memory/2580-62-0x00000000058B0000-0x00000000058FE000-memory.dmp	family_zgrat_v1

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 528 set thread context of 2580	528	cd244ca9c1a284a8e9ea743bd516d93862b797465dad6dad5e28efe8d74ac372.exe	89

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2580	RegSvcs.exe
2580	RegSvcs.exe

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
3320	cd244ca9c1a284a8e9ea743bd516d93862b797465dad6dad5e28efe8d74ac372.exe
2988	cd244ca9c1a284a8e9ea743bd516d93862b797465dad6dad5e28efe8d74ac372.exe
64	cd244ca9c1a284a8e9ea743bd516d93862b797465dad6dad5e28efe8d74ac372.exe
528	cd244ca9c1a284a8e9ea743bd516d93862b797465dad6dad5e28efe8d74ac372.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2580	RegSvcs.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 3320 wrote to memory of 752	3320	cd244ca9c1a284a8e9ea743bd516d93862b797465dad6dad5e28efe8d74ac372.exe	83
PID 3320 wrote to memory of 752	3320	cd244ca9c1a284a8e9ea743bd516d93862b797465dad6dad5e28efe8d74ac372.exe	83
PID 3320 wrote to memory of 752	3320	cd244ca9c1a284a8e9ea743bd516d93862b797465dad6dad5e28efe8d74ac372.exe	83
PID 3320 wrote to memory of 2988	3320	cd244ca9c1a284a8e9ea743bd516d93862b797465dad6dad5e28efe8d74ac372.exe	84
PID 3320 wrote to memory of 2988	3320	cd244ca9c1a284a8e9ea743bd516d93862b797465dad6dad5e28efe8d74ac372.exe	84
PID 3320 wrote to memory of 2988	3320	cd244ca9c1a284a8e9ea743bd516d93862b797465dad6dad5e28efe8d74ac372.exe	84
PID 2988 wrote to memory of 4820	2988	cd244ca9c1a284a8e9ea743bd516d93862b797465dad6dad5e28efe8d74ac372.exe	85
PID 2988 wrote to memory of 4820	2988	cd244ca9c1a284a8e9ea743bd516d93862b797465dad6dad5e28efe8d74ac372.exe	85
PID 2988 wrote to memory of 4820	2988	cd244ca9c1a284a8e9ea743bd516d93862b797465dad6dad5e28efe8d74ac372.exe	85
PID 2988 wrote to memory of 64	2988	cd244ca9c1a284a8e9ea743bd516d93862b797465dad6dad5e28efe8d74ac372.exe	86
PID 2988 wrote to memory of 64	2988	cd244ca9c1a284a8e9ea743bd516d93862b797465dad6dad5e28efe8d74ac372.exe	86
PID 2988 wrote to memory of 64	2988	cd244ca9c1a284a8e9ea743bd516d93862b797465dad6dad5e28efe8d74ac372.exe	86
PID 64 wrote to memory of 2836	64	cd244ca9c1a284a8e9ea743bd516d93862b797465dad6dad5e28efe8d74ac372.exe	87
PID 64 wrote to memory of 2836	64	cd244ca9c1a284a8e9ea743bd516d93862b797465dad6dad5e28efe8d74ac372.exe	87
PID 64 wrote to memory of 2836	64	cd244ca9c1a284a8e9ea743bd516d93862b797465dad6dad5e28efe8d74ac372.exe	87
PID 64 wrote to memory of 528	64	cd244ca9c1a284a8e9ea743bd516d93862b797465dad6dad5e28efe8d74ac372.exe	88
PID 64 wrote to memory of 528	64	cd244ca9c1a284a8e9ea743bd516d93862b797465dad6dad5e28efe8d74ac372.exe	88
PID 64 wrote to memory of 528	64	cd244ca9c1a284a8e9ea743bd516d93862b797465dad6dad5e28efe8d74ac372.exe	88
PID 528 wrote to memory of 2580	528	cd244ca9c1a284a8e9ea743bd516d93862b797465dad6dad5e28efe8d74ac372.exe	89
PID 528 wrote to memory of 2580	528	cd244ca9c1a284a8e9ea743bd516d93862b797465dad6dad5e28efe8d74ac372.exe	89
PID 528 wrote to memory of 2580	528	cd244ca9c1a284a8e9ea743bd516d93862b797465dad6dad5e28efe8d74ac372.exe	89
PID 528 wrote to memory of 2580	528	cd244ca9c1a284a8e9ea743bd516d93862b797465dad6dad5e28efe8d74ac372.exe	89

C:\Users\Admin\AppData\Local\Temp\cd244ca9c1a284a8e9ea743bd516d93862b797465dad6dad5e28efe8d74ac372.exe
"C:\Users\Admin\AppData\Local\Temp\cd244ca9c1a284a8e9ea743bd516d93862b797465dad6dad5e28efe8d74ac372.exe"
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3320
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Users\Admin\AppData\Local\Temp\cd244ca9c1a284a8e9ea743bd516d93862b797465dad6dad5e28efe8d74ac372.exe"
  2⤵
  PID:752
- C:\Users\Admin\AppData\Local\Temp\cd244ca9c1a284a8e9ea743bd516d93862b797465dad6dad5e28efe8d74ac372.exe
  "C:\Users\Admin\AppData\Local\Temp\cd244ca9c1a284a8e9ea743bd516d93862b797465dad6dad5e28efe8d74ac372.exe"
  2⤵
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2988
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "C:\Users\Admin\AppData\Local\Temp\cd244ca9c1a284a8e9ea743bd516d93862b797465dad6dad5e28efe8d74ac372.exe"
    3⤵
    PID:4820
- - C:\Users\Admin\AppData\Local\Temp\cd244ca9c1a284a8e9ea743bd516d93862b797465dad6dad5e28efe8d74ac372.exe
    "C:\Users\Admin\AppData\Local\Temp\cd244ca9c1a284a8e9ea743bd516d93862b797465dad6dad5e28efe8d74ac372.exe"
    3⤵
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:64
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Users\Admin\AppData\Local\Temp\cd244ca9c1a284a8e9ea743bd516d93862b797465dad6dad5e28efe8d74ac372.exe"
      4⤵
      PID:2836
  - - C:\Users\Admin\AppData\Local\Temp\cd244ca9c1a284a8e9ea743bd516d93862b797465dad6dad5e28efe8d74ac372.exe
      "C:\Users\Admin\AppData\Local\Temp\cd244ca9c1a284a8e9ea743bd516d93862b797465dad6dad5e28efe8d74ac372.exe"
      4⤵
      Suspicious use of SetThreadContext
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:528
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        "C:\Users\Admin\AppData\Local\Temp\cd244ca9c1a284a8e9ea743bd516d93862b797465dad6dad5e28efe8d74ac372.exe"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2580

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\aut34EB.tmp

Filesize
263KB

MD5
9b9b53d76c5bb6b890157993cf720c64

SHA1
e03ae3b48974c2cb28d93f9548413f833a68ec53

SHA256
570edde4f1d9dec57454b81034d86c8fd194225f036b4f9acc1792eb5983dc37

SHA512
03fbeec082b8bafa5442f4a99d5222cf4fe1385110082e816244eff980e2b898d76b36f8528954ccbd292da2004229751f17cc079bfeb41b1bc4e2471a89c4f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\aut39DD.tmp

Filesize
9KB

MD5
9e008f52612eb18d978886b2dac7a875

SHA1
a00de2a307d992718ef79ee3201f60c0f6334c62

SHA256
d0140aa9de707325ad32929f68a3b48d09cf4c36776c8bb3754f3e657017cada

SHA512
1d661078af9a3e25422267922ff2304d406379582946d16988c0489b822337baf56ca421c16ccd9f9e8935347bcabb6d41abe6cbc88d0d769b94d4dff0507f21

Download Submit
C:\Users\Admin\AppData\Local\Temp\kinematical

Filesize
29KB

MD5
9a05158e4ba660c40d7d6098ff6c2364

SHA1
159140d36232b35d61ca8ea7286981c297b741c3

SHA256
259614cdc895ec0f9d0c0edabee619401dbbb77223c73fa04f0d42403fdddb58

SHA512
45d3f5cf6b3e8e18f4af5177706811a739f431582dadd653669c6fd62a59132ce280c9a1805f455e292306a58bbe4523672a94f481f31e6be2e91022055b922e

Download Submit
memory/2580-99-0x00000000058B0000-0x00000000058FE000-memory.dmp

Filesize
312KB

Download
memory/2580-55-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2580-57-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2580-56-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2580-58-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2580-59-0x0000000005810000-0x0000000005866000-memory.dmp

Filesize
344KB

Download
memory/2580-60-0x0000000005F30000-0x00000000064D4000-memory.dmp

Filesize
5.6MB

Download
memory/2580-61-0x00000000058B0000-0x0000000005904000-memory.dmp

Filesize
336KB

Download
memory/2580-67-0x00000000058B0000-0x00000000058FE000-memory.dmp

Filesize
312KB

Download
memory/2580-75-0x00000000058B0000-0x00000000058FE000-memory.dmp

Filesize
312KB

Download
memory/2580-121-0x00000000058B0000-0x00000000058FE000-memory.dmp

Filesize
312KB

Download
memory/2580-117-0x00000000058B0000-0x00000000058FE000-memory.dmp

Filesize
312KB

Download
memory/2580-115-0x00000000058B0000-0x00000000058FE000-memory.dmp

Filesize
312KB

Download
memory/2580-114-0x00000000058B0000-0x00000000058FE000-memory.dmp

Filesize
312KB

Download
memory/2580-111-0x00000000058B0000-0x00000000058FE000-memory.dmp

Filesize
312KB

Download
memory/2580-109-0x00000000058B0000-0x00000000058FE000-memory.dmp

Filesize
312KB

Download
memory/2580-107-0x00000000058B0000-0x00000000058FE000-memory.dmp

Filesize
312KB

Download
memory/2580-105-0x00000000058B0000-0x00000000058FE000-memory.dmp

Filesize
312KB

Download
memory/2580-103-0x00000000058B0000-0x00000000058FE000-memory.dmp

Filesize
312KB

Download
memory/2580-101-0x00000000058B0000-0x00000000058FE000-memory.dmp

Filesize
312KB

Download
memory/2580-93-0x00000000058B0000-0x00000000058FE000-memory.dmp

Filesize
312KB

Download
memory/2580-1110-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2580-95-0x00000000058B0000-0x00000000058FE000-memory.dmp

Filesize
312KB

Download
memory/2580-91-0x00000000058B0000-0x00000000058FE000-memory.dmp

Filesize
312KB

Download
memory/2580-90-0x00000000058B0000-0x00000000058FE000-memory.dmp

Filesize
312KB

Download
memory/2580-87-0x00000000058B0000-0x00000000058FE000-memory.dmp

Filesize
312KB

Download
memory/2580-85-0x00000000058B0000-0x00000000058FE000-memory.dmp

Filesize
312KB

Download
memory/2580-83-0x00000000058B0000-0x00000000058FE000-memory.dmp

Filesize
312KB

Download
memory/2580-81-0x00000000058B0000-0x00000000058FE000-memory.dmp

Filesize
312KB

Download
memory/2580-79-0x00000000058B0000-0x00000000058FE000-memory.dmp

Filesize
312KB

Download
memory/2580-77-0x00000000058B0000-0x00000000058FE000-memory.dmp

Filesize
312KB

Download
memory/2580-73-0x00000000058B0000-0x00000000058FE000-memory.dmp

Filesize
312KB

Download
memory/2580-71-0x00000000058B0000-0x00000000058FE000-memory.dmp

Filesize
312KB

Download
memory/2580-69-0x00000000058B0000-0x00000000058FE000-memory.dmp

Filesize
312KB

Download
memory/2580-65-0x00000000058B0000-0x00000000058FE000-memory.dmp

Filesize
312KB

Download
memory/2580-119-0x00000000058B0000-0x00000000058FE000-memory.dmp

Filesize
312KB

Download
memory/2580-97-0x00000000058B0000-0x00000000058FE000-memory.dmp

Filesize
312KB

Download
memory/2580-63-0x00000000058B0000-0x00000000058FE000-memory.dmp

Filesize
312KB

Download
memory/2580-62-0x00000000058B0000-0x00000000058FE000-memory.dmp

Filesize
312KB

Download
memory/2580-1106-0x0000000005AF0000-0x0000000005B56000-memory.dmp

Filesize
408KB

Download
memory/2580-1107-0x0000000006CB0000-0x0000000006D00000-memory.dmp

Filesize
320KB

Download
memory/2580-1108-0x0000000006DA0000-0x0000000006E32000-memory.dmp

Filesize
584KB

Download
memory/2580-1109-0x0000000006D20000-0x0000000006D2A000-memory.dmp

Filesize
40KB

Download
memory/3320-12-0x0000000001560000-0x0000000001564000-memory.dmp

Filesize
16KB

Download