Overview

overview

10

Static

static

5

06a3d9d3f6...c8.exe

windows7-x64

10

06a3d9d3f6...c8.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    131s
  • max time network
    132s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-05-2024 01:04

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    06a3d9d3f6a3bfa1d129412617aaed1275fe2ed602ae0d199e614bdc50085cc8.exe

  • Size

    1.1MB

  • MD5

    7ff29697c6340dee69f9028797b75099

  • SHA1

    61dd53508f660a766e1ab154af3769955551c139

  • SHA256

    06a3d9d3f6a3bfa1d129412617aaed1275fe2ed602ae0d199e614bdc50085cc8

  • SHA512

    3b739f2f2871432b2564770a08dd6e44c14b07044144cbf68967a8d29f952cd0cd1b38d5cf4e00b66b5d5d4b46b313d7fbc3a0bda2bfef9f97635b01f5dbdaf7

  • SSDEEP

    24576:MqDEvCTbMWu7rQYlBQcBiT6rprG8aJHr6t8+F9nlc4gqNA:MTvC/MTQYxsWR7aJHr6tJplj

Score
10/10
agentteslazgratkeyloggerpersistenceratspywarestealertrojan

Malware Config

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla
  • Detect ZGRat V1 33 IoCs
  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat
  • Detect packed .NET executables. Mostly AgentTeslaV4. 33 IoCs
  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 33 IoCs
  • Detects executables referencing Windows vault credential objects. Observed in infostealers 33 IoCs
  • Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers 33 IoCs
  • Detects executables referencing many email and collaboration clients. Observed in information stealers 33 IoCs
  • Detects executables referencing many file transfer clients. Observed in information stealers 33 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 4 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\06a3d9d3f6a3bfa1d129412617aaed1275fe2ed602ae0d199e614bdc50085cc8.exe
    "C:\Users\Admin\AppData\Local\Temp\06a3d9d3f6a3bfa1d129412617aaed1275fe2ed602ae0d199e614bdc50085cc8.exe"
    1⤵
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4524
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Users\Admin\AppData\Local\Temp\06a3d9d3f6a3bfa1d129412617aaed1275fe2ed602ae0d199e614bdc50085cc8.exe"
      2⤵
        PID:972
      • C:\Users\Admin\AppData\Local\Temp\06a3d9d3f6a3bfa1d129412617aaed1275fe2ed602ae0d199e614bdc50085cc8.exe
        "C:\Users\Admin\AppData\Local\Temp\06a3d9d3f6a3bfa1d129412617aaed1275fe2ed602ae0d199e614bdc50085cc8.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:8
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
          "C:\Users\Admin\AppData\Local\Temp\06a3d9d3f6a3bfa1d129412617aaed1275fe2ed602ae0d199e614bdc50085cc8.exe"
          3⤵
          • Adds Run key to start application
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:4316

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\aut514C.tmp
      Filesize

      265KB

      MD5

      e89ff9237c86ef826d487a5e74aa43ea

      SHA1

      a4ecb4a1784bf32f761259b8a3ddd46ab828c91b

      SHA256

      402c6803447338a42349e4a5e1474717a2d7d1b294f71e798a28db7f767fc979

      SHA512

      623818ce2be965bfcbf3fbc762e4fe4a3fcd33d5f397bf636a6b0a8c6f3e057b7a440f7b454dd6034658201b3f170620981b8e0daf73aac6789ee638fc5d242d

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\miaoued
      Filesize

      29KB

      MD5

      0abc02469ab76c71984f8f0cdf209c5b

      SHA1

      170a4b1e02c04d7b5d12d19f9d11eca3ae7071ed

      SHA256

      a048e76ea341d1acd7d02c6c91ce8f6d1a50b11caf994d0f105e6d1db7e82698

      SHA512

      d3cff68b20dfbb5155bcdf59c425c843cbc401d8a076850766f2b77001b11994fe548e0dbe2ed1e46f75edef07ea71c0be7e9c6890a106803b479fb4b2f3ce4e

      Download Submit

    • memory/4316-27-0x0000000000400000-0x0000000000447000-memory.dmp

      Filesize

      284KB

      Download

    • memory/4316-30-0x0000000000400000-0x0000000000447000-memory.dmp

      Filesize

      284KB

      Download

    • memory/4316-29-0x0000000000400000-0x0000000000447000-memory.dmp

      Filesize

      284KB

      Download

    • memory/4316-28-0x0000000000400000-0x0000000000447000-memory.dmp

      Filesize

      284KB

      Download

    • memory/4316-31-0x000000007368E000-0x000000007368F000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4316-32-0x0000000003420000-0x0000000003476000-memory.dmp

      Filesize

      344KB

      Download

    • memory/4316-33-0x0000000073680000-0x0000000073E30000-memory.dmp

      Filesize

      7.7MB

      Download

    • memory/4316-34-0x0000000073680000-0x0000000073E30000-memory.dmp

      Filesize

      7.7MB

      Download

    • memory/4316-35-0x0000000005F70000-0x0000000006514000-memory.dmp

      Filesize

      5.6MB

      Download

    • memory/4316-36-0x00000000059C0000-0x0000000005A14000-memory.dmp

      Filesize

      336KB

      Download

    • memory/4316-38-0x00000000059C0000-0x0000000005A0F000-memory.dmp

      Filesize

      316KB

      Download

    • memory/4316-42-0x00000000059C0000-0x0000000005A0F000-memory.dmp

      Filesize

      316KB

      Download

    • memory/4316-40-0x00000000059C0000-0x0000000005A0F000-memory.dmp

      Filesize

      316KB

      Download

    • memory/4316-96-0x00000000059C0000-0x0000000005A0F000-memory.dmp

      Filesize

      316KB

      Download

    • memory/4316-84-0x00000000059C0000-0x0000000005A0F000-memory.dmp

      Filesize

      316KB

      Download

    • memory/4316-72-0x00000000059C0000-0x0000000005A0F000-memory.dmp

      Filesize

      316KB

      Download

    • memory/4316-37-0x00000000059C0000-0x0000000005A0F000-memory.dmp

      Filesize

      316KB

      Download

    • memory/4316-94-0x00000000059C0000-0x0000000005A0F000-memory.dmp

      Filesize

      316KB

      Download

    • memory/4316-92-0x00000000059C0000-0x0000000005A0F000-memory.dmp

      Filesize

      316KB

      Download

    • memory/4316-90-0x00000000059C0000-0x0000000005A0F000-memory.dmp

      Filesize

      316KB

      Download

    • memory/4316-88-0x00000000059C0000-0x0000000005A0F000-memory.dmp

      Filesize

      316KB

      Download

    • memory/4316-86-0x00000000059C0000-0x0000000005A0F000-memory.dmp

      Filesize

      316KB

      Download

    • memory/4316-82-0x00000000059C0000-0x0000000005A0F000-memory.dmp

      Filesize

      316KB

      Download

    • memory/4316-80-0x00000000059C0000-0x0000000005A0F000-memory.dmp

      Filesize

      316KB

      Download

    • memory/4316-78-0x00000000059C0000-0x0000000005A0F000-memory.dmp

      Filesize

      316KB

      Download

    • memory/4316-76-0x00000000059C0000-0x0000000005A0F000-memory.dmp

      Filesize

      316KB

      Download

    • memory/4316-74-0x00000000059C0000-0x0000000005A0F000-memory.dmp

      Filesize

      316KB

      Download

    • memory/4316-70-0x00000000059C0000-0x0000000005A0F000-memory.dmp

      Filesize

      316KB

      Download

    • memory/4316-68-0x00000000059C0000-0x0000000005A0F000-memory.dmp

      Filesize

      316KB

      Download

    • memory/4316-66-0x00000000059C0000-0x0000000005A0F000-memory.dmp

      Filesize

      316KB

      Download

    • memory/4316-64-0x00000000059C0000-0x0000000005A0F000-memory.dmp

      Filesize

      316KB

      Download

    • memory/4316-62-0x00000000059C0000-0x0000000005A0F000-memory.dmp

      Filesize

      316KB

      Download

    • memory/4316-60-0x00000000059C0000-0x0000000005A0F000-memory.dmp

      Filesize

      316KB

      Download

    • memory/4316-58-0x00000000059C0000-0x0000000005A0F000-memory.dmp

      Filesize

      316KB

      Download

    • memory/4316-56-0x00000000059C0000-0x0000000005A0F000-memory.dmp

      Filesize

      316KB

      Download

    • memory/4316-54-0x00000000059C0000-0x0000000005A0F000-memory.dmp

      Filesize

      316KB

      Download

    • memory/4316-52-0x00000000059C0000-0x0000000005A0F000-memory.dmp

      Filesize

      316KB

      Download

    • memory/4316-50-0x00000000059C0000-0x0000000005A0F000-memory.dmp

      Filesize

      316KB

      Download

    • memory/4316-48-0x00000000059C0000-0x0000000005A0F000-memory.dmp

      Filesize

      316KB

      Download

    • memory/4316-46-0x00000000059C0000-0x0000000005A0F000-memory.dmp

      Filesize

      316KB

      Download

    • memory/4316-44-0x00000000059C0000-0x0000000005A0F000-memory.dmp

      Filesize

      316KB

      Download

    • memory/4316-1133-0x0000000005B80000-0x0000000005BE6000-memory.dmp

      Filesize

      408KB

      Download

    • memory/4316-1134-0x0000000073680000-0x0000000073E30000-memory.dmp

      Filesize

      7.7MB

      Download

    • memory/4316-1136-0x00000000069A0000-0x00000000069F0000-memory.dmp

      Filesize

      320KB

      Download

    • memory/4316-1137-0x0000000006A90000-0x0000000006B2C000-memory.dmp

      Filesize

      624KB

      Download

    • memory/4316-1138-0x0000000000400000-0x0000000000447000-memory.dmp

      Filesize

      284KB

      Download

    • memory/4316-1139-0x000000007368E000-0x000000007368F000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4316-1140-0x0000000073680000-0x0000000073E30000-memory.dmp

      Filesize

      7.7MB

      Download

    • memory/4316-1141-0x00000000030B0000-0x0000000003142000-memory.dmp

      Filesize

      584KB

      Download

    • memory/4316-1142-0x0000000003190000-0x000000000319A000-memory.dmp

      Filesize

      40KB

      Download

    • memory/4524-12-0x00000000011F0000-0x00000000011F4000-memory.dmp

      Filesize

      16KB

      Download