agenttesla | be62769221f4db9ab152e7c2aebec4c1855f61087381bf75d322ab1f9685c782

Analysis

max time kernel
120s
max time network
146s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
09-05-2024 10:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

be62769221f4db9ab152e7c2aebec4c1855f61087381bf75d322ab1f9685c782.exe
Size

2.3MB
MD5

fe703d2fa965479822244b16bb6dc89d
SHA1

1b5f59ee47ff3df701758e4d8fc3ea277006d72c
SHA256

be62769221f4db9ab152e7c2aebec4c1855f61087381bf75d322ab1f9685c782
SHA512

9b96af9ee5f5e6cb84c119d7737fea0c77ba1ea8d68332281a181d66abd08f51e6c853c2028a9a0b8d9136ec619f8d85b4749041d1f3e27be8dc0b6e59bed653
SSDEEP

49152:e/72i9CswGQ7izXQX2KmiYAZ/KW7WbI28uRqj09u:OSipM2zXtqYA4BT8u4g

Score

10^/10

agenttesla purelogstealer zgrat keylogger rat spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
gator3220.hostgator.com
Port:
587
Username:
[email protected]
Password:
RaFv@tsTUK55@@<<!!
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Detect ZGRat V1 34 IoCs

resource	yara_rule
behavioral1/memory/3040-4-0x00000000052A0000-0x00000000054D0000-memory.dmp	family_zgrat_v1
behavioral1/memory/3040-5-0x00000000052A0000-0x00000000054CA000-memory.dmp	family_zgrat_v1
behavioral1/memory/3040-6-0x00000000052A0000-0x00000000054CA000-memory.dmp	family_zgrat_v1
behavioral1/memory/3040-10-0x00000000052A0000-0x00000000054CA000-memory.dmp	family_zgrat_v1
behavioral1/memory/3040-8-0x00000000052A0000-0x00000000054CA000-memory.dmp	family_zgrat_v1
behavioral1/memory/3040-12-0x00000000052A0000-0x00000000054CA000-memory.dmp	family_zgrat_v1
behavioral1/memory/3040-14-0x00000000052A0000-0x00000000054CA000-memory.dmp	family_zgrat_v1
behavioral1/memory/3040-16-0x00000000052A0000-0x00000000054CA000-memory.dmp	family_zgrat_v1
behavioral1/memory/3040-18-0x00000000052A0000-0x00000000054CA000-memory.dmp	family_zgrat_v1
behavioral1/memory/3040-20-0x00000000052A0000-0x00000000054CA000-memory.dmp	family_zgrat_v1
behavioral1/memory/3040-22-0x00000000052A0000-0x00000000054CA000-memory.dmp	family_zgrat_v1
behavioral1/memory/3040-24-0x00000000052A0000-0x00000000054CA000-memory.dmp	family_zgrat_v1
behavioral1/memory/3040-26-0x00000000052A0000-0x00000000054CA000-memory.dmp	family_zgrat_v1
behavioral1/memory/3040-28-0x00000000052A0000-0x00000000054CA000-memory.dmp	family_zgrat_v1
behavioral1/memory/3040-30-0x00000000052A0000-0x00000000054CA000-memory.dmp	family_zgrat_v1
behavioral1/memory/3040-32-0x00000000052A0000-0x00000000054CA000-memory.dmp	family_zgrat_v1
behavioral1/memory/3040-34-0x00000000052A0000-0x00000000054CA000-memory.dmp	family_zgrat_v1
behavioral1/memory/3040-36-0x00000000052A0000-0x00000000054CA000-memory.dmp	family_zgrat_v1
behavioral1/memory/3040-38-0x00000000052A0000-0x00000000054CA000-memory.dmp	family_zgrat_v1
behavioral1/memory/3040-40-0x00000000052A0000-0x00000000054CA000-memory.dmp	family_zgrat_v1
behavioral1/memory/3040-42-0x00000000052A0000-0x00000000054CA000-memory.dmp	family_zgrat_v1
behavioral1/memory/3040-44-0x00000000052A0000-0x00000000054CA000-memory.dmp	family_zgrat_v1
behavioral1/memory/3040-46-0x00000000052A0000-0x00000000054CA000-memory.dmp	family_zgrat_v1
behavioral1/memory/3040-48-0x00000000052A0000-0x00000000054CA000-memory.dmp	family_zgrat_v1
behavioral1/memory/3040-50-0x00000000052A0000-0x00000000054CA000-memory.dmp	family_zgrat_v1
behavioral1/memory/3040-52-0x00000000052A0000-0x00000000054CA000-memory.dmp	family_zgrat_v1
behavioral1/memory/3040-54-0x00000000052A0000-0x00000000054CA000-memory.dmp	family_zgrat_v1
behavioral1/memory/3040-56-0x00000000052A0000-0x00000000054CA000-memory.dmp	family_zgrat_v1
behavioral1/memory/3040-58-0x00000000052A0000-0x00000000054CA000-memory.dmp	family_zgrat_v1
behavioral1/memory/3040-68-0x00000000052A0000-0x00000000054CA000-memory.dmp	family_zgrat_v1
behavioral1/memory/3040-66-0x00000000052A0000-0x00000000054CA000-memory.dmp	family_zgrat_v1
behavioral1/memory/3040-64-0x00000000052A0000-0x00000000054CA000-memory.dmp	family_zgrat_v1
behavioral1/memory/3040-62-0x00000000052A0000-0x00000000054CA000-memory.dmp	family_zgrat_v1
behavioral1/memory/3040-60-0x00000000052A0000-0x00000000054CA000-memory.dmp	family_zgrat_v1

PureLog Stealer
PureLog Stealer is an infostealer written in C#.
stealer purelogstealer

PureLog Stealer payload 1 IoCs

resource	yara_rule
behavioral1/memory/3040-1-0x0000000000BA0000-0x0000000000DE6000-memory.dmp	family_purelog_stealer

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	ip-api.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3040 set thread context of 1416	3040	be62769221f4db9ab152e7c2aebec4c1855f61087381bf75d322ab1f9685c782.exe	31

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1416	aspnet_compiler.exe
1416	aspnet_compiler.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3040	be62769221f4db9ab152e7c2aebec4c1855f61087381bf75d322ab1f9685c782.exe
Token: SeDebugPrivilege	3040	be62769221f4db9ab152e7c2aebec4c1855f61087381bf75d322ab1f9685c782.exe
Token: SeDebugPrivilege	1416	aspnet_compiler.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1416	aspnet_compiler.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3040 wrote to memory of 1416	3040	be62769221f4db9ab152e7c2aebec4c1855f61087381bf75d322ab1f9685c782.exe	31
PID 3040 wrote to memory of 1416	3040	be62769221f4db9ab152e7c2aebec4c1855f61087381bf75d322ab1f9685c782.exe	31
PID 3040 wrote to memory of 1416	3040	be62769221f4db9ab152e7c2aebec4c1855f61087381bf75d322ab1f9685c782.exe	31
PID 3040 wrote to memory of 1416	3040	be62769221f4db9ab152e7c2aebec4c1855f61087381bf75d322ab1f9685c782.exe	31
PID 3040 wrote to memory of 1416	3040	be62769221f4db9ab152e7c2aebec4c1855f61087381bf75d322ab1f9685c782.exe	31
PID 3040 wrote to memory of 1416	3040	be62769221f4db9ab152e7c2aebec4c1855f61087381bf75d322ab1f9685c782.exe	31
PID 3040 wrote to memory of 1416	3040	be62769221f4db9ab152e7c2aebec4c1855f61087381bf75d322ab1f9685c782.exe	31
PID 3040 wrote to memory of 1416	3040	be62769221f4db9ab152e7c2aebec4c1855f61087381bf75d322ab1f9685c782.exe	31
PID 3040 wrote to memory of 1416	3040	be62769221f4db9ab152e7c2aebec4c1855f61087381bf75d322ab1f9685c782.exe	31

C:\Users\Admin\AppData\Local\Temp\be62769221f4db9ab152e7c2aebec4c1855f61087381bf75d322ab1f9685c782.exe
"C:\Users\Admin\AppData\Local\Temp\be62769221f4db9ab152e7c2aebec4c1855f61087381bf75d322ab1f9685c782.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3040
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1416

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1416-4905-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1416-4908-0x00000000748A0000-0x0000000074F8E000-memory.dmp

Filesize
6.9MB

Download
memory/1416-4907-0x00000000748A0000-0x0000000074F8E000-memory.dmp

Filesize
6.9MB

Download
memory/1416-4909-0x00000000748A0000-0x0000000074F8E000-memory.dmp

Filesize
6.9MB

Download
memory/3040-0-0x00000000748AE000-0x00000000748AF000-memory.dmp

Filesize
4KB

Download
memory/3040-1-0x0000000000BA0000-0x0000000000DE6000-memory.dmp

Filesize
2.3MB

Download
memory/3040-2-0x00000000748A0000-0x0000000074F8E000-memory.dmp

Filesize
6.9MB

Download
memory/3040-3-0x0000000005070000-0x00000000052A2000-memory.dmp

Filesize
2.2MB

Download
memory/3040-4-0x00000000052A0000-0x00000000054D0000-memory.dmp

Filesize
2.2MB

Download
memory/3040-5-0x00000000052A0000-0x00000000054CA000-memory.dmp

Filesize
2.2MB

Download
memory/3040-6-0x00000000052A0000-0x00000000054CA000-memory.dmp

Filesize
2.2MB

Download
memory/3040-10-0x00000000052A0000-0x00000000054CA000-memory.dmp

Filesize
2.2MB

Download
memory/3040-8-0x00000000052A0000-0x00000000054CA000-memory.dmp

Filesize
2.2MB

Download
memory/3040-12-0x00000000052A0000-0x00000000054CA000-memory.dmp

Filesize
2.2MB

Download
memory/3040-14-0x00000000052A0000-0x00000000054CA000-memory.dmp

Filesize
2.2MB

Download
memory/3040-16-0x00000000052A0000-0x00000000054CA000-memory.dmp

Filesize
2.2MB

Download
memory/3040-18-0x00000000052A0000-0x00000000054CA000-memory.dmp

Filesize
2.2MB

Download
memory/3040-20-0x00000000052A0000-0x00000000054CA000-memory.dmp

Filesize
2.2MB

Download
memory/3040-22-0x00000000052A0000-0x00000000054CA000-memory.dmp

Filesize
2.2MB

Download
memory/3040-24-0x00000000052A0000-0x00000000054CA000-memory.dmp

Filesize
2.2MB

Download
memory/3040-26-0x00000000052A0000-0x00000000054CA000-memory.dmp

Filesize
2.2MB

Download
memory/3040-28-0x00000000052A0000-0x00000000054CA000-memory.dmp

Filesize
2.2MB

Download
memory/3040-30-0x00000000052A0000-0x00000000054CA000-memory.dmp

Filesize
2.2MB

Download
memory/3040-32-0x00000000052A0000-0x00000000054CA000-memory.dmp

Filesize
2.2MB

Download
memory/3040-34-0x00000000052A0000-0x00000000054CA000-memory.dmp

Filesize
2.2MB

Download
memory/3040-36-0x00000000052A0000-0x00000000054CA000-memory.dmp

Filesize
2.2MB

Download
memory/3040-38-0x00000000052A0000-0x00000000054CA000-memory.dmp

Filesize
2.2MB

Download
memory/3040-40-0x00000000052A0000-0x00000000054CA000-memory.dmp

Filesize
2.2MB

Download
memory/3040-42-0x00000000052A0000-0x00000000054CA000-memory.dmp

Filesize
2.2MB

Download
memory/3040-44-0x00000000052A0000-0x00000000054CA000-memory.dmp

Filesize
2.2MB

Download
memory/3040-46-0x00000000052A0000-0x00000000054CA000-memory.dmp

Filesize
2.2MB

Download
memory/3040-48-0x00000000052A0000-0x00000000054CA000-memory.dmp

Filesize
2.2MB

Download
memory/3040-50-0x00000000052A0000-0x00000000054CA000-memory.dmp

Filesize
2.2MB

Download
memory/3040-52-0x00000000052A0000-0x00000000054CA000-memory.dmp

Filesize
2.2MB

Download
memory/3040-54-0x00000000052A0000-0x00000000054CA000-memory.dmp

Filesize
2.2MB

Download
memory/3040-56-0x00000000052A0000-0x00000000054CA000-memory.dmp

Filesize
2.2MB

Download
memory/3040-58-0x00000000052A0000-0x00000000054CA000-memory.dmp

Filesize
2.2MB

Download
memory/3040-68-0x00000000052A0000-0x00000000054CA000-memory.dmp

Filesize
2.2MB

Download
memory/3040-66-0x00000000052A0000-0x00000000054CA000-memory.dmp

Filesize
2.2MB

Download
memory/3040-64-0x00000000052A0000-0x00000000054CA000-memory.dmp

Filesize
2.2MB

Download
memory/3040-62-0x00000000052A0000-0x00000000054CA000-memory.dmp

Filesize
2.2MB

Download
memory/3040-4885-0x00000000748A0000-0x0000000074F8E000-memory.dmp

Filesize
6.9MB

Download
memory/3040-60-0x00000000052A0000-0x00000000054CA000-memory.dmp

Filesize
2.2MB

Download
memory/3040-4887-0x0000000002200000-0x000000000224C000-memory.dmp

Filesize
304KB

Download
memory/3040-4886-0x0000000004520000-0x000000000458C000-memory.dmp

Filesize
432KB

Download
memory/3040-4888-0x00000000748AE000-0x00000000748AF000-memory.dmp

Filesize
4KB

Download
memory/3040-4889-0x00000000748A0000-0x0000000074F8E000-memory.dmp

Filesize
6.9MB

Download
memory/3040-4890-0x00000000748A0000-0x0000000074F8E000-memory.dmp

Filesize
6.9MB

Download
memory/3040-4891-0x0000000004F40000-0x0000000004F94000-memory.dmp

Filesize
336KB

Download
memory/3040-4906-0x00000000748A0000-0x0000000074F8E000-memory.dmp

Filesize
6.9MB

Download