Analysis Overview
SHA256
45d4b0a1c89a7192b5a3de30e1568200d33941e8bc6b983c6bf5fe525fe83761
Threat Level: Known bad
The file 45d4b0a1c89a7192b5a3de30e1568200d33941e8bc6b983c6bf5fe525fe83761 was found to be: Known bad.
Malicious Activity Summary
Detect ZGRat V1
AgentTesla
ZGRat
Executes dropped EXE
Drops startup file
AutoIT Executable
Suspicious use of SetThreadContext
Unsigned PE
Suspicious use of SendNotifyMessage
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory
Suspicious use of FindShellTrayWindow
MITRE ATT&CK
Analysis: static1
Detonation Overview
Reported
2024-05-09 01:16
Signatures
AutoIT Executable
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-05-09 01:16
Reported
2024-05-09 01:19
Platform
win7-20240221-en
Max time kernel
118s
Max time network
125s
Command Line
Signatures
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\45d4b0a1c89a7192b5a3de30e1568200d33941e8bc6b983c6bf5fe525fe83761.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\45d4b0a1c89a7192b5a3de30e1568200d33941e8bc6b983c6bf5fe525fe83761.exe | N/A |
Suspicious use of SendNotifyMessage
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\45d4b0a1c89a7192b5a3de30e1568200d33941e8bc6b983c6bf5fe525fe83761.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\45d4b0a1c89a7192b5a3de30e1568200d33941e8bc6b983c6bf5fe525fe83761.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\45d4b0a1c89a7192b5a3de30e1568200d33941e8bc6b983c6bf5fe525fe83761.exe
"C:\Users\Admin\AppData\Local\Temp\45d4b0a1c89a7192b5a3de30e1568200d33941e8bc6b983c6bf5fe525fe83761.exe"
Network
Files
memory/1912-11-0x00000000002D0000-0x00000000002D4000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\croc
| MD5 | 48067d5ba3abc44be5a4cd2cba27fd2e |
| SHA1 | c3b617cb75eb48b8da34eaa3b5eac41610231078 |
| SHA256 | 035e764be5a63a345536a38aa9adcaa1eeedcfdf75af7731b14d93266aa04e0c |
| SHA512 | bb03360a1d9e1cb02b1ed0d01d391c089038b97645a4a99eb291a6e546ccbcc9dadc80f2367f3acd2f2e593d3173007dd46c8072a0e13f76176f0ec3156faeae |
Analysis: behavioral2
Detonation Overview
Submitted
2024-05-09 01:16
Reported
2024-05-09 01:19
Platform
win10v2004-20240226-en
Max time kernel
152s
Max time network
150s
Command Line
Signatures
AgentTesla
Detect ZGRat V1
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
ZGRat
Drops startup file
| Description | Indicator | Process | Target |
| File created | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\name.vbs | C:\Users\Admin\AppData\Local\directory\name.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\directory\name.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\directory\name.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 4144 set thread context of 3388 | N/A | C:\Users\Admin\AppData\Local\directory\name.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Suspicious behavior: MapViewOfSection
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\directory\name.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\directory\name.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\45d4b0a1c89a7192b5a3de30e1568200d33941e8bc6b983c6bf5fe525fe83761.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\45d4b0a1c89a7192b5a3de30e1568200d33941e8bc6b983c6bf5fe525fe83761.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\45d4b0a1c89a7192b5a3de30e1568200d33941e8bc6b983c6bf5fe525fe83761.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\directory\name.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\directory\name.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\directory\name.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\directory\name.exe | N/A |
Suspicious use of SendNotifyMessage
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\45d4b0a1c89a7192b5a3de30e1568200d33941e8bc6b983c6bf5fe525fe83761.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\45d4b0a1c89a7192b5a3de30e1568200d33941e8bc6b983c6bf5fe525fe83761.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\45d4b0a1c89a7192b5a3de30e1568200d33941e8bc6b983c6bf5fe525fe83761.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\directory\name.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\directory\name.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\directory\name.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\directory\name.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\45d4b0a1c89a7192b5a3de30e1568200d33941e8bc6b983c6bf5fe525fe83761.exe
"C:\Users\Admin\AppData\Local\Temp\45d4b0a1c89a7192b5a3de30e1568200d33941e8bc6b983c6bf5fe525fe83761.exe"
C:\Users\Admin\AppData\Local\directory\name.exe
"C:\Users\Admin\AppData\Local\Temp\45d4b0a1c89a7192b5a3de30e1568200d33941e8bc6b983c6bf5fe525fe83761.exe"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Users\Admin\AppData\Local\Temp\45d4b0a1c89a7192b5a3de30e1568200d33941e8bc6b983c6bf5fe525fe83761.exe"
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3760 --field-trial-handle=2256,i,6670388345726423024,18382795228658886258,262144 --variations-seed-version /prefetch:8
C:\Users\Admin\AppData\Local\directory\name.exe
"C:\Users\Admin\AppData\Local\directory\name.exe"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Users\Admin\AppData\Local\directory\name.exe"
Network
| Country | Destination | Domain | Proto |
| US | 20.231.121.79:80 | tcp | |
| US | 8.8.8.8:53 | 28.118.140.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.210.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 50.23.12.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 171.39.242.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 142.53.16.96.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 14.160.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 133.211.185.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | chromewebstore.googleapis.com | udp |
| US | 8.8.8.8:53 | chromewebstore.googleapis.com | udp |
| GB | 216.58.201.106:443 | chromewebstore.googleapis.com | tcp |
| US | 8.8.8.8:53 | 106.201.58.216.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 31.243.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 232.168.11.51.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 104.219.191.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 9.179.89.13.in-addr.arpa | udp |
Files
C:\Users\Admin\AppData\Local\Temp\aut1558.tmp
| MD5 | 48067d5ba3abc44be5a4cd2cba27fd2e |
| SHA1 | c3b617cb75eb48b8da34eaa3b5eac41610231078 |
| SHA256 | 035e764be5a63a345536a38aa9adcaa1eeedcfdf75af7731b14d93266aa04e0c |
| SHA512 | bb03360a1d9e1cb02b1ed0d01d391c089038b97645a4a99eb291a6e546ccbcc9dadc80f2367f3acd2f2e593d3173007dd46c8072a0e13f76176f0ec3156faeae |
memory/2512-12-0x00000000026E0000-0x00000000026E4000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\croc
| MD5 | 959545bbbb274e818e4a196c161cd12e |
| SHA1 | 2ebedf8528442dd1e76a87c427a0136d468eeb32 |
| SHA256 | 83b2d62ff1ea7f54f2cea00d0967740918c5b658348938304c6e7c6e9bfd4fda |
| SHA512 | b2f00c2613b2dcb1d1bf8795b4f1ce7357a92f7b5da1f2d8be8f2f8e9fcde17f6febd0b153fb18ecf93f248369e148114c86e94e0c378e03afc33c48d9cdeb3c |
C:\Users\Admin\AppData\Local\Temp\colliquefaction
| MD5 | 382d8276cbfb61ad34b47f75811c0991 |
| SHA1 | 3e578b3dac05a4f3a46dadfa245f82021958a3d6 |
| SHA256 | c24e9092b9f3d21ba59b49b3369bbcfb6eca4b6f27569b5e989395bdc0f94e91 |
| SHA512 | 4d71b5c4439003d747a5674b5670c4138dc9787ba29b9fac1d4eb8a06043ae71c376a2e28f611020a8659bd5d5eeac29c2fef60ca2972a1151fb575612fe2273 |
C:\Users\Admin\AppData\Local\Temp\aut65EA.tmp
| MD5 | 63b9c40ef0cb553678ffa8d53c7e30f2 |
| SHA1 | 372e44d28d6fa195aedce7246be3405238ef4d60 |
| SHA256 | 56e107f09bd8b3d74443ab0594c70e2a99b8e2c2468787cf006620739fd48e72 |
| SHA512 | 7885ed1be177e3b330e85098493497275d18ba8b74d2237adfbfe46e0f000d066c3e351154a8e8ee63b114f21978a30291f369cd340bde036f4f67d29ab9d445 |
memory/3388-45-0x0000000000400000-0x0000000000447000-memory.dmp
memory/3388-47-0x0000000000400000-0x0000000000447000-memory.dmp
memory/3388-46-0x0000000000400000-0x0000000000447000-memory.dmp
memory/3388-48-0x0000000000400000-0x0000000000447000-memory.dmp
memory/3388-49-0x0000000000400000-0x0000000000447000-memory.dmp
memory/3388-50-0x0000000002B10000-0x0000000002B66000-memory.dmp