Overview

overview

10

Static

static

5

06a3d9d3f6...c8.exe

windows7-x64

10

06a3d9d3f6...c8.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    131s
  • max time network
    132s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/05/2024, 01:04

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    06a3d9d3f6a3bfa1d129412617aaed1275fe2ed602ae0d199e614bdc50085cc8.exe
  • Size 1.1MB
  • Sample240510-bezleach66
  • SHA256 06a3d9d3f6a3bfa1d129412617aaed1275fe2ed602ae0d199e614bdc50085cc8
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
agentteslazgratkeyloggerpersistenceratspywarestealertrojan

Malware Config

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla
  • Detect ZGRat V1 33 IoCs
  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat
  • Detect packed .NET executables. Mostly AgentTeslaV4. 33 IoCs
  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 33 IoCs
  • Detects executables referencing Windows vault credential objects. Observed in infostealers 33 IoCs
  • Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers 33 IoCs
  • Detects executables referencing many email and collaboration clients. Observed in information stealers 33 IoCs
  • Detects executables referencing many file transfer clients. Observed in information stealers 33 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 4 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\06a3d9d3f6a3bfa1d129412617aaed1275fe2ed602ae0d199e614bdc50085cc8.exe
    "C:\Users\Admin\AppData\Local\Temp\06a3d9d3f6a3bfa1d129412617aaed1275fe2ed602ae0d199e614bdc50085cc8.exe"
    1⤵
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4524
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Users\Admin\AppData\Local\Temp\06a3d9d3f6a3bfa1d129412617aaed1275fe2ed602ae0d199e614bdc50085cc8.exe"
      2⤵
        PID:972
      • C:\Users\Admin\AppData\Local\Temp\06a3d9d3f6a3bfa1d129412617aaed1275fe2ed602ae0d199e614bdc50085cc8.exe
        "C:\Users\Admin\AppData\Local\Temp\06a3d9d3f6a3bfa1d129412617aaed1275fe2ed602ae0d199e614bdc50085cc8.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:8
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
          "C:\Users\Admin\AppData\Local\Temp\06a3d9d3f6a3bfa1d129412617aaed1275fe2ed602ae0d199e614bdc50085cc8.exe"
          3⤵
          • Adds Run key to start application
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:4316

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          aut514C.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\aut514C.tmp
          • Size 265KB
          • SHA256 402c6803447338a42349e4a5e1474717a2d7d1b294f71e798a28db7f767fc979
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          miaoued
          • Path C:\Users\Admin\AppData\Local\Temp\miaoued
          • Size 29KB
          • SHA256 a048e76ea341d1acd7d02c6c91ce8f6d1a50b11caf994d0f105e6d1db7e82698
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          memory/4316-27-0x0000000000400000-0x0000000000447000-memory.dmp
          Download

          memory/4316-30-0x0000000000400000-0x0000000000447000-memory.dmp
          Download

          memory/4316-29-0x0000000000400000-0x0000000000447000-memory.dmp
          Download

          memory/4316-28-0x0000000000400000-0x0000000000447000-memory.dmp
          Download

          memory/4316-31-0x000000007368E000-0x000000007368F000-memory.dmp
          Download

          memory/4316-32-0x0000000003420000-0x0000000003476000-memory.dmp
          Download

          memory/4316-33-0x0000000073680000-0x0000000073E30000-memory.dmp
          Download

          memory/4316-34-0x0000000073680000-0x0000000073E30000-memory.dmp
          Download

          memory/4316-35-0x0000000005F70000-0x0000000006514000-memory.dmp
          Download

          memory/4316-36-0x00000000059C0000-0x0000000005A14000-memory.dmp
          Download

          memory/4316-38-0x00000000059C0000-0x0000000005A0F000-memory.dmp
          Download

          memory/4316-42-0x00000000059C0000-0x0000000005A0F000-memory.dmp
          Download

          memory/4316-40-0x00000000059C0000-0x0000000005A0F000-memory.dmp
          Download

          memory/4316-96-0x00000000059C0000-0x0000000005A0F000-memory.dmp
          Download

          memory/4316-84-0x00000000059C0000-0x0000000005A0F000-memory.dmp
          Download

          memory/4316-72-0x00000000059C0000-0x0000000005A0F000-memory.dmp
          Download

          memory/4316-37-0x00000000059C0000-0x0000000005A0F000-memory.dmp
          Download

          memory/4316-94-0x00000000059C0000-0x0000000005A0F000-memory.dmp
          Download

          memory/4316-92-0x00000000059C0000-0x0000000005A0F000-memory.dmp
          Download

          memory/4316-90-0x00000000059C0000-0x0000000005A0F000-memory.dmp
          Download

          memory/4316-88-0x00000000059C0000-0x0000000005A0F000-memory.dmp
          Download

          memory/4316-86-0x00000000059C0000-0x0000000005A0F000-memory.dmp
          Download

          memory/4316-82-0x00000000059C0000-0x0000000005A0F000-memory.dmp
          Download

          memory/4316-80-0x00000000059C0000-0x0000000005A0F000-memory.dmp
          Download

          memory/4316-78-0x00000000059C0000-0x0000000005A0F000-memory.dmp
          Download

          memory/4316-76-0x00000000059C0000-0x0000000005A0F000-memory.dmp
          Download

          memory/4316-74-0x00000000059C0000-0x0000000005A0F000-memory.dmp
          Download

          memory/4316-70-0x00000000059C0000-0x0000000005A0F000-memory.dmp
          Download

          memory/4316-68-0x00000000059C0000-0x0000000005A0F000-memory.dmp
          Download

          memory/4316-66-0x00000000059C0000-0x0000000005A0F000-memory.dmp
          Download

          memory/4316-64-0x00000000059C0000-0x0000000005A0F000-memory.dmp
          Download

          memory/4316-62-0x00000000059C0000-0x0000000005A0F000-memory.dmp
          Download

          memory/4316-60-0x00000000059C0000-0x0000000005A0F000-memory.dmp
          Download

          memory/4316-58-0x00000000059C0000-0x0000000005A0F000-memory.dmp
          Download

          memory/4316-56-0x00000000059C0000-0x0000000005A0F000-memory.dmp
          Download

          memory/4316-54-0x00000000059C0000-0x0000000005A0F000-memory.dmp
          Download

          memory/4316-52-0x00000000059C0000-0x0000000005A0F000-memory.dmp
          Download

          memory/4316-50-0x00000000059C0000-0x0000000005A0F000-memory.dmp
          Download

          memory/4316-48-0x00000000059C0000-0x0000000005A0F000-memory.dmp
          Download

          memory/4316-46-0x00000000059C0000-0x0000000005A0F000-memory.dmp
          Download

          memory/4316-44-0x00000000059C0000-0x0000000005A0F000-memory.dmp
          Download

          memory/4316-1133-0x0000000005B80000-0x0000000005BE6000-memory.dmp
          Download

          memory/4316-1134-0x0000000073680000-0x0000000073E30000-memory.dmp
          Download

          memory/4316-1136-0x00000000069A0000-0x00000000069F0000-memory.dmp
          Download

          memory/4316-1137-0x0000000006A90000-0x0000000006B2C000-memory.dmp
          Download

          memory/4316-1138-0x0000000000400000-0x0000000000447000-memory.dmp
          Download

          memory/4316-1139-0x000000007368E000-0x000000007368F000-memory.dmp
          Download

          memory/4316-1140-0x0000000073680000-0x0000000073E30000-memory.dmp
          Download

          memory/4316-1141-0x00000000030B0000-0x0000000003142000-memory.dmp
          Download

          memory/4316-1142-0x0000000003190000-0x000000000319A000-memory.dmp
          Download

          memory/4524-12-0x00000000011F0000-0x00000000011F4000-memory.dmp
          Download