Overview

overview

10

Static

static

5

328e70cca6...aa.exe

windows7-x64

10

328e70cca6...aa.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    144s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/05/2024, 01:13

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    328e70cca6f607ee5e124be316cbd024fa84f61b874c0568366516a8222675aa.exe
  • Size 1.1MB
  • Sample240510-bk4sbadd46
  • SHA256 328e70cca6f607ee5e124be316cbd024fa84f61b874c0568366516a8222675aa
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
agentteslazgratkeyloggerpersistenceratspywarestealertrojan

Malware Config

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla
  • Detect ZGRat V1 34 IoCs
  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat
  • Detect packed .NET executables. Mostly AgentTeslaV4. 34 IoCs
  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 34 IoCs
  • Detects executables referencing Windows vault credential objects. Observed in infostealers 34 IoCs
  • Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers 34 IoCs
  • Detects executables referencing many email and collaboration clients. Observed in information stealers 34 IoCs
  • Detects executables referencing many file transfer clients. Observed in information stealers 34 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: MapViewOfSection 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 9 IoCs
  • Suspicious use of SendNotifyMessage 9 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\328e70cca6f607ee5e124be316cbd024fa84f61b874c0568366516a8222675aa.exe
    "C:\Users\Admin\AppData\Local\Temp\328e70cca6f607ee5e124be316cbd024fa84f61b874c0568366516a8222675aa.exe"
    1⤵
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1072
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Users\Admin\AppData\Local\Temp\328e70cca6f607ee5e124be316cbd024fa84f61b874c0568366516a8222675aa.exe"
      2⤵
        PID:4168
      • C:\Users\Admin\AppData\Local\Temp\328e70cca6f607ee5e124be316cbd024fa84f61b874c0568366516a8222675aa.exe
        "C:\Users\Admin\AppData\Local\Temp\328e70cca6f607ee5e124be316cbd024fa84f61b874c0568366516a8222675aa.exe"
        2⤵
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:1348
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
          "C:\Users\Admin\AppData\Local\Temp\328e70cca6f607ee5e124be316cbd024fa84f61b874c0568366516a8222675aa.exe"
          3⤵
            PID:4492
          • C:\Users\Admin\AppData\Local\Temp\328e70cca6f607ee5e124be316cbd024fa84f61b874c0568366516a8222675aa.exe
            "C:\Users\Admin\AppData\Local\Temp\328e70cca6f607ee5e124be316cbd024fa84f61b874c0568366516a8222675aa.exe"
            3⤵
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of WriteProcessMemory
            PID:5088
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
              "C:\Users\Admin\AppData\Local\Temp\328e70cca6f607ee5e124be316cbd024fa84f61b874c0568366516a8222675aa.exe"
              4⤵
                PID:228
              • C:\Users\Admin\AppData\Local\Temp\328e70cca6f607ee5e124be316cbd024fa84f61b874c0568366516a8222675aa.exe
                "C:\Users\Admin\AppData\Local\Temp\328e70cca6f607ee5e124be316cbd024fa84f61b874c0568366516a8222675aa.exe"
                4⤵
                • Suspicious use of SetThreadContext
                • Suspicious behavior: MapViewOfSection
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                • Suspicious use of WriteProcessMemory
                PID:5052
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
                  "C:\Users\Admin\AppData\Local\Temp\328e70cca6f607ee5e124be316cbd024fa84f61b874c0568366516a8222675aa.exe"
                  5⤵
                  • Adds Run key to start application
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of SetWindowsHookEx
                  PID:2756
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1424 --field-trial-handle=2180,i,12780723798465539942,12010519452607841069,262144 --variations-seed-version /prefetch:8
          1⤵
            PID:4336

          Network

                MITRE ATT&CK Enterprise v15

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                Esher
                • Path C:\Users\Admin\AppData\Local\Temp\Esher
                • Size 262KB
                • SHA256 66e8574b0659e2e43cf6c1958db0abc5c9650b9999d6c287d31dbf00a2042751
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                aut6D9A.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\aut6D9A.tmp
                • Size 257KB
                • SHA256 a8d534f7fb880dcba3a56c9384237c5b286df56dc0a0a8da0b3fb8bc2696321b
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                aut6DBA.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\aut6DBA.tmp
                • Size 9KB
                • SHA256 484827a635f7959666ab32f84f086867584f24b88b820406b247088de45cf88a
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                nonhazardousness
                • Path C:\Users\Admin\AppData\Local\Temp\nonhazardousness
                • Size 28KB
                • SHA256 f6efb701356255d6b13eb6a66d405337a30d1d1b2d1263c382fab079ccc34df9
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                memory/1072-10-0x0000000000A80000-0x0000000000A84000-memory.dmp
                Download

                memory/2756-95-0x0000000005820000-0x000000000586D000-memory.dmp
                Download

                memory/2756-85-0x0000000005820000-0x000000000586D000-memory.dmp
                Download

                memory/2756-49-0x00000000031C0000-0x0000000003214000-memory.dmp
                Download

                memory/2756-50-0x0000000005D90000-0x0000000006334000-memory.dmp
                Download

                memory/2756-51-0x0000000005820000-0x0000000005872000-memory.dmp
                Download

                memory/2756-53-0x0000000005820000-0x000000000586D000-memory.dmp
                Download

                memory/2756-52-0x0000000005820000-0x000000000586D000-memory.dmp
                Download

                memory/2756-59-0x0000000005820000-0x000000000586D000-memory.dmp
                Download

                memory/2756-113-0x0000000005820000-0x000000000586D000-memory.dmp
                Download

                memory/2756-111-0x0000000005820000-0x000000000586D000-memory.dmp
                Download

                memory/2756-109-0x0000000005820000-0x000000000586D000-memory.dmp
                Download

                memory/2756-108-0x0000000005820000-0x000000000586D000-memory.dmp
                Download

                memory/2756-105-0x0000000005820000-0x000000000586D000-memory.dmp
                Download

                memory/2756-103-0x0000000005820000-0x000000000586D000-memory.dmp
                Download

                memory/2756-101-0x0000000005820000-0x000000000586D000-memory.dmp
                Download

                memory/2756-97-0x0000000005820000-0x000000000586D000-memory.dmp
                Download

                memory/2756-47-0x0000000000400000-0x0000000000446000-memory.dmp
                Download

                memory/2756-93-0x0000000005820000-0x000000000586D000-memory.dmp
                Download

                memory/2756-91-0x0000000005820000-0x000000000586D000-memory.dmp
                Download

                memory/2756-89-0x0000000005820000-0x000000000586D000-memory.dmp
                Download

                memory/2756-87-0x0000000005820000-0x000000000586D000-memory.dmp
                Download

                memory/2756-48-0x0000000000400000-0x0000000000446000-memory.dmp
                Download

                memory/2756-81-0x0000000005820000-0x000000000586D000-memory.dmp
                Download

                memory/2756-79-0x0000000005820000-0x000000000586D000-memory.dmp
                Download

                memory/2756-77-0x0000000005820000-0x000000000586D000-memory.dmp
                Download

                memory/2756-75-0x0000000005820000-0x000000000586D000-memory.dmp
                Download

                memory/2756-73-0x0000000005820000-0x000000000586D000-memory.dmp
                Download

                memory/2756-71-0x0000000005820000-0x000000000586D000-memory.dmp
                Download

                memory/2756-69-0x0000000005820000-0x000000000586D000-memory.dmp
                Download

                memory/2756-67-0x0000000005820000-0x000000000586D000-memory.dmp
                Download

                memory/2756-65-0x0000000005820000-0x000000000586D000-memory.dmp
                Download

                memory/2756-57-0x0000000005820000-0x000000000586D000-memory.dmp
                Download

                memory/2756-55-0x0000000005820000-0x000000000586D000-memory.dmp
                Download

                memory/2756-99-0x0000000005820000-0x000000000586D000-memory.dmp
                Download

                memory/2756-83-0x0000000005820000-0x000000000586D000-memory.dmp
                Download

                memory/2756-63-0x0000000005820000-0x000000000586D000-memory.dmp
                Download

                memory/2756-61-0x0000000005820000-0x000000000586D000-memory.dmp
                Download

                memory/2756-1084-0x00000000059F0000-0x0000000005A56000-memory.dmp
                Download

                memory/2756-1086-0x0000000006810000-0x0000000006860000-memory.dmp
                Download

                memory/2756-1087-0x0000000006900000-0x0000000006992000-memory.dmp
                Download

                memory/2756-1088-0x00000000068D0000-0x00000000068DA000-memory.dmp
                Download