agenttesla | 7e72fb7f88505149fc397376b4d2a68633c51496d989781e873afd6b8b9c669a

Analysis

max time kernel
136s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
10-05-2024 01:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7e72fb7f88505149fc397376b4d2a68633c51496d989781e873afd6b8b9c669a.exe
Size

1.2MB
MD5

a31a62b117d11bd2799aee8a8c13ff42
SHA1

a7a9223261510d49686c6e1d831b2d6778fa09d8
SHA256

7e72fb7f88505149fc397376b4d2a68633c51496d989781e873afd6b8b9c669a
SHA512

aa0cedb5ccd9e5b52a205e9829edb89938f54b294787f476154d7535369c9ecf26f366cd72d597879eaa2060420d7d3a5d1a394103de509e7d3ba04d5a9263b5
SSDEEP

24576:yqDEvCTbMWu7rQYlBQcBiT6rprG8aF45mMIwtyFN6:yTvC/MTQYxsWR7aF45mMIj

Score

10^/10

agenttesla zgrat keylogger rat spyware stealer trojan

Malware Config

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Detect ZGRat V1 34 IoCs

resource	yara_rule
behavioral2/memory/2936-57-0x0000000002870000-0x00000000028C6000-memory.dmp	family_zgrat_v1
behavioral2/memory/2936-59-0x0000000004F40000-0x0000000004F94000-memory.dmp	family_zgrat_v1
behavioral2/memory/2936-89-0x0000000004F40000-0x0000000004F8E000-memory.dmp	family_zgrat_v1
behavioral2/memory/2936-80-0x0000000004F40000-0x0000000004F8E000-memory.dmp	family_zgrat_v1
behavioral2/memory/2936-87-0x0000000004F40000-0x0000000004F8E000-memory.dmp	family_zgrat_v1
behavioral2/memory/2936-122-0x0000000004F40000-0x0000000004F8E000-memory.dmp	family_zgrat_v1
behavioral2/memory/2936-119-0x0000000004F40000-0x0000000004F8E000-memory.dmp	family_zgrat_v1
behavioral2/memory/2936-117-0x0000000004F40000-0x0000000004F8E000-memory.dmp	family_zgrat_v1
behavioral2/memory/2936-115-0x0000000004F40000-0x0000000004F8E000-memory.dmp	family_zgrat_v1
behavioral2/memory/2936-107-0x0000000004F40000-0x0000000004F8E000-memory.dmp	family_zgrat_v1
behavioral2/memory/2936-105-0x0000000004F40000-0x0000000004F8E000-memory.dmp	family_zgrat_v1
behavioral2/memory/2936-103-0x0000000004F40000-0x0000000004F8E000-memory.dmp	family_zgrat_v1
behavioral2/memory/2936-97-0x0000000004F40000-0x0000000004F8E000-memory.dmp	family_zgrat_v1
behavioral2/memory/2936-95-0x0000000004F40000-0x0000000004F8E000-memory.dmp	family_zgrat_v1
behavioral2/memory/2936-85-0x0000000004F40000-0x0000000004F8E000-memory.dmp	family_zgrat_v1
behavioral2/memory/2936-83-0x0000000004F40000-0x0000000004F8E000-memory.dmp	family_zgrat_v1
behavioral2/memory/2936-81-0x0000000004F40000-0x0000000004F8E000-memory.dmp	family_zgrat_v1
behavioral2/memory/2936-77-0x0000000004F40000-0x0000000004F8E000-memory.dmp	family_zgrat_v1
behavioral2/memory/2936-75-0x0000000004F40000-0x0000000004F8E000-memory.dmp	family_zgrat_v1
behavioral2/memory/2936-73-0x0000000004F40000-0x0000000004F8E000-memory.dmp	family_zgrat_v1
behavioral2/memory/2936-71-0x0000000004F40000-0x0000000004F8E000-memory.dmp	family_zgrat_v1
behavioral2/memory/2936-114-0x0000000004F40000-0x0000000004F8E000-memory.dmp	family_zgrat_v1
behavioral2/memory/2936-111-0x0000000004F40000-0x0000000004F8E000-memory.dmp	family_zgrat_v1
behavioral2/memory/2936-109-0x0000000004F40000-0x0000000004F8E000-memory.dmp	family_zgrat_v1
behavioral2/memory/2936-101-0x0000000004F40000-0x0000000004F8E000-memory.dmp	family_zgrat_v1
behavioral2/memory/2936-99-0x0000000004F40000-0x0000000004F8E000-memory.dmp	family_zgrat_v1
behavioral2/memory/2936-94-0x0000000004F40000-0x0000000004F8E000-memory.dmp	family_zgrat_v1
behavioral2/memory/2936-91-0x0000000004F40000-0x0000000004F8E000-memory.dmp	family_zgrat_v1
behavioral2/memory/2936-69-0x0000000004F40000-0x0000000004F8E000-memory.dmp	family_zgrat_v1
behavioral2/memory/2936-67-0x0000000004F40000-0x0000000004F8E000-memory.dmp	family_zgrat_v1
behavioral2/memory/2936-65-0x0000000004F40000-0x0000000004F8E000-memory.dmp	family_zgrat_v1
behavioral2/memory/2936-63-0x0000000004F40000-0x0000000004F8E000-memory.dmp	family_zgrat_v1
behavioral2/memory/2936-61-0x0000000004F40000-0x0000000004F8E000-memory.dmp	family_zgrat_v1
behavioral2/memory/2936-60-0x0000000004F40000-0x0000000004F8E000-memory.dmp	family_zgrat_v1

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
25	ip-api.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3112 set thread context of 2936	3112	7e72fb7f88505149fc397376b4d2a68633c51496d989781e873afd6b8b9c669a.exe	93

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2936	RegSvcs.exe
2936	RegSvcs.exe

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
1880	7e72fb7f88505149fc397376b4d2a68633c51496d989781e873afd6b8b9c669a.exe
3940	7e72fb7f88505149fc397376b4d2a68633c51496d989781e873afd6b8b9c669a.exe
1200	7e72fb7f88505149fc397376b4d2a68633c51496d989781e873afd6b8b9c669a.exe
3112	7e72fb7f88505149fc397376b4d2a68633c51496d989781e873afd6b8b9c669a.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2936	RegSvcs.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
1880	7e72fb7f88505149fc397376b4d2a68633c51496d989781e873afd6b8b9c669a.exe
1880	7e72fb7f88505149fc397376b4d2a68633c51496d989781e873afd6b8b9c669a.exe
3940	7e72fb7f88505149fc397376b4d2a68633c51496d989781e873afd6b8b9c669a.exe
3940	7e72fb7f88505149fc397376b4d2a68633c51496d989781e873afd6b8b9c669a.exe
1200	7e72fb7f88505149fc397376b4d2a68633c51496d989781e873afd6b8b9c669a.exe
1200	7e72fb7f88505149fc397376b4d2a68633c51496d989781e873afd6b8b9c669a.exe
3112	7e72fb7f88505149fc397376b4d2a68633c51496d989781e873afd6b8b9c669a.exe
3112	7e72fb7f88505149fc397376b4d2a68633c51496d989781e873afd6b8b9c669a.exe

Suspicious use of SendNotifyMessage 8 IoCs

pid	Process
1880	7e72fb7f88505149fc397376b4d2a68633c51496d989781e873afd6b8b9c669a.exe
1880	7e72fb7f88505149fc397376b4d2a68633c51496d989781e873afd6b8b9c669a.exe
3940	7e72fb7f88505149fc397376b4d2a68633c51496d989781e873afd6b8b9c669a.exe
3940	7e72fb7f88505149fc397376b4d2a68633c51496d989781e873afd6b8b9c669a.exe
1200	7e72fb7f88505149fc397376b4d2a68633c51496d989781e873afd6b8b9c669a.exe
1200	7e72fb7f88505149fc397376b4d2a68633c51496d989781e873afd6b8b9c669a.exe
3112	7e72fb7f88505149fc397376b4d2a68633c51496d989781e873afd6b8b9c669a.exe
3112	7e72fb7f88505149fc397376b4d2a68633c51496d989781e873afd6b8b9c669a.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 1880 wrote to memory of 3420	1880	7e72fb7f88505149fc397376b4d2a68633c51496d989781e873afd6b8b9c669a.exe	83
PID 1880 wrote to memory of 3420	1880	7e72fb7f88505149fc397376b4d2a68633c51496d989781e873afd6b8b9c669a.exe	83
PID 1880 wrote to memory of 3420	1880	7e72fb7f88505149fc397376b4d2a68633c51496d989781e873afd6b8b9c669a.exe	83
PID 1880 wrote to memory of 3940	1880	7e72fb7f88505149fc397376b4d2a68633c51496d989781e873afd6b8b9c669a.exe	84
PID 1880 wrote to memory of 3940	1880	7e72fb7f88505149fc397376b4d2a68633c51496d989781e873afd6b8b9c669a.exe	84
PID 1880 wrote to memory of 3940	1880	7e72fb7f88505149fc397376b4d2a68633c51496d989781e873afd6b8b9c669a.exe	84
PID 3940 wrote to memory of 3560	3940	7e72fb7f88505149fc397376b4d2a68633c51496d989781e873afd6b8b9c669a.exe	89
PID 3940 wrote to memory of 3560	3940	7e72fb7f88505149fc397376b4d2a68633c51496d989781e873afd6b8b9c669a.exe	89
PID 3940 wrote to memory of 3560	3940	7e72fb7f88505149fc397376b4d2a68633c51496d989781e873afd6b8b9c669a.exe	89
PID 3940 wrote to memory of 1200	3940	7e72fb7f88505149fc397376b4d2a68633c51496d989781e873afd6b8b9c669a.exe	90
PID 3940 wrote to memory of 1200	3940	7e72fb7f88505149fc397376b4d2a68633c51496d989781e873afd6b8b9c669a.exe	90
PID 3940 wrote to memory of 1200	3940	7e72fb7f88505149fc397376b4d2a68633c51496d989781e873afd6b8b9c669a.exe	90
PID 1200 wrote to memory of 4568	1200	7e72fb7f88505149fc397376b4d2a68633c51496d989781e873afd6b8b9c669a.exe	91
PID 1200 wrote to memory of 4568	1200	7e72fb7f88505149fc397376b4d2a68633c51496d989781e873afd6b8b9c669a.exe	91
PID 1200 wrote to memory of 4568	1200	7e72fb7f88505149fc397376b4d2a68633c51496d989781e873afd6b8b9c669a.exe	91
PID 1200 wrote to memory of 3112	1200	7e72fb7f88505149fc397376b4d2a68633c51496d989781e873afd6b8b9c669a.exe	92
PID 1200 wrote to memory of 3112	1200	7e72fb7f88505149fc397376b4d2a68633c51496d989781e873afd6b8b9c669a.exe	92
PID 1200 wrote to memory of 3112	1200	7e72fb7f88505149fc397376b4d2a68633c51496d989781e873afd6b8b9c669a.exe	92
PID 3112 wrote to memory of 2936	3112	7e72fb7f88505149fc397376b4d2a68633c51496d989781e873afd6b8b9c669a.exe	93
PID 3112 wrote to memory of 2936	3112	7e72fb7f88505149fc397376b4d2a68633c51496d989781e873afd6b8b9c669a.exe	93
PID 3112 wrote to memory of 2936	3112	7e72fb7f88505149fc397376b4d2a68633c51496d989781e873afd6b8b9c669a.exe	93
PID 3112 wrote to memory of 2936	3112	7e72fb7f88505149fc397376b4d2a68633c51496d989781e873afd6b8b9c669a.exe	93

C:\Users\Admin\AppData\Local\Temp\7e72fb7f88505149fc397376b4d2a68633c51496d989781e873afd6b8b9c669a.exe
"C:\Users\Admin\AppData\Local\Temp\7e72fb7f88505149fc397376b4d2a68633c51496d989781e873afd6b8b9c669a.exe"
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1880
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Users\Admin\AppData\Local\Temp\7e72fb7f88505149fc397376b4d2a68633c51496d989781e873afd6b8b9c669a.exe"
  2⤵
  PID:3420
- C:\Users\Admin\AppData\Local\Temp\7e72fb7f88505149fc397376b4d2a68633c51496d989781e873afd6b8b9c669a.exe
  "C:\Users\Admin\AppData\Local\Temp\7e72fb7f88505149fc397376b4d2a68633c51496d989781e873afd6b8b9c669a.exe"
  2⤵
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3940
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "C:\Users\Admin\AppData\Local\Temp\7e72fb7f88505149fc397376b4d2a68633c51496d989781e873afd6b8b9c669a.exe"
    3⤵
    PID:3560
- - C:\Users\Admin\AppData\Local\Temp\7e72fb7f88505149fc397376b4d2a68633c51496d989781e873afd6b8b9c669a.exe
    "C:\Users\Admin\AppData\Local\Temp\7e72fb7f88505149fc397376b4d2a68633c51496d989781e873afd6b8b9c669a.exe"
    3⤵
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:1200
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Users\Admin\AppData\Local\Temp\7e72fb7f88505149fc397376b4d2a68633c51496d989781e873afd6b8b9c669a.exe"
      4⤵
      PID:4568
  - - C:\Users\Admin\AppData\Local\Temp\7e72fb7f88505149fc397376b4d2a68633c51496d989781e873afd6b8b9c669a.exe
      "C:\Users\Admin\AppData\Local\Temp\7e72fb7f88505149fc397376b4d2a68633c51496d989781e873afd6b8b9c669a.exe"
      4⤵
      Suspicious use of SetThreadContext
      Suspicious behavior: MapViewOfSection
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:3112
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7e72fb7f88505149fc397376b4d2a68633c51496d989781e873afd6b8b9c669a.exe"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2936

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\aut3CBB.tmp

Filesize
263KB

MD5
39def1f6fd13a577df97f8345de0cbd3

SHA1
3a203ad04dbb10d9afb2f2a4015e6d23f7339b92

SHA256
7cf9ea69a7c672acee7d4f24854bb6edac94c77adda2e77437f49d331619071f

SHA512
ec6a67e3cf2a99c5a4fcbc55d2900cf5ca0ff523e61bfa97a980a7ae1ff7d1289b6ba6d354a49f99934029dca5c17e8159598f6b51613255967ea3821aab4850

Download Submit
C:\Users\Admin\AppData\Local\Temp\aut417E.tmp

Filesize
9KB

MD5
3a4c9e2fe3f60df151deb69ab2f71670

SHA1
b2dc4a22965388e536f633bd2a68b235f37836dc

SHA256
816951e8097cd9f407872fda452734b59957bfe6d1c25216e6d5fec9cd100416

SHA512
4db6b8de90e131c4f829937d5d792df43a4a825b01baba7306aad66a32bb5471dc6db7b64d56f13e3929c508ae0fcee3b77d05edf82cf0ee4efee7d46b49cd25

Download Submit
C:\Users\Admin\AppData\Local\Temp\poufs

Filesize
29KB

MD5
e1867297336bc3289387b7ba5081d94e

SHA1
1bd184db7aca06a9e80dcba65021a78dbbda997b

SHA256
70d33ad98043da59a4bef719203be888cdf4fca8873a11e27ab2579d77053939

SHA512
d003a771eda9d494c94f603c457549f924a69532089d72f668babdb4204549713d0f587567d721a2dea1b7655b1e783bc075c4051a3c2754296ee4f7649c8c48

Download Submit
memory/1880-12-0x00000000024C0000-0x00000000024C4000-memory.dmp

Filesize
16KB

Download
memory/2936-85-0x0000000004F40000-0x0000000004F8E000-memory.dmp

Filesize
312KB

Download
memory/2936-75-0x0000000004F40000-0x0000000004F8E000-memory.dmp

Filesize
312KB

Download
memory/2936-57-0x0000000002870000-0x00000000028C6000-memory.dmp

Filesize
344KB

Download
memory/2936-58-0x00000000055A0000-0x0000000005B44000-memory.dmp

Filesize
5.6MB

Download
memory/2936-59-0x0000000004F40000-0x0000000004F94000-memory.dmp

Filesize
336KB

Download
memory/2936-89-0x0000000004F40000-0x0000000004F8E000-memory.dmp

Filesize
312KB

Download
memory/2936-80-0x0000000004F40000-0x0000000004F8E000-memory.dmp

Filesize
312KB

Download
memory/2936-87-0x0000000004F40000-0x0000000004F8E000-memory.dmp

Filesize
312KB

Download
memory/2936-122-0x0000000004F40000-0x0000000004F8E000-memory.dmp

Filesize
312KB

Download
memory/2936-119-0x0000000004F40000-0x0000000004F8E000-memory.dmp

Filesize
312KB

Download
memory/2936-117-0x0000000004F40000-0x0000000004F8E000-memory.dmp

Filesize
312KB

Download
memory/2936-115-0x0000000004F40000-0x0000000004F8E000-memory.dmp

Filesize
312KB

Download
memory/2936-107-0x0000000004F40000-0x0000000004F8E000-memory.dmp

Filesize
312KB

Download
memory/2936-105-0x0000000004F40000-0x0000000004F8E000-memory.dmp

Filesize
312KB

Download
memory/2936-103-0x0000000004F40000-0x0000000004F8E000-memory.dmp

Filesize
312KB

Download
memory/2936-97-0x0000000004F40000-0x0000000004F8E000-memory.dmp

Filesize
312KB

Download
memory/2936-95-0x0000000004F40000-0x0000000004F8E000-memory.dmp

Filesize
312KB

Download
memory/2936-55-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2936-83-0x0000000004F40000-0x0000000004F8E000-memory.dmp

Filesize
312KB

Download
memory/2936-81-0x0000000004F40000-0x0000000004F8E000-memory.dmp

Filesize
312KB

Download
memory/2936-77-0x0000000004F40000-0x0000000004F8E000-memory.dmp

Filesize
312KB

Download
memory/2936-56-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2936-73-0x0000000004F40000-0x0000000004F8E000-memory.dmp

Filesize
312KB

Download
memory/2936-71-0x0000000004F40000-0x0000000004F8E000-memory.dmp

Filesize
312KB

Download
memory/2936-114-0x0000000004F40000-0x0000000004F8E000-memory.dmp

Filesize
312KB

Download
memory/2936-111-0x0000000004F40000-0x0000000004F8E000-memory.dmp

Filesize
312KB

Download
memory/2936-109-0x0000000004F40000-0x0000000004F8E000-memory.dmp

Filesize
312KB

Download
memory/2936-101-0x0000000004F40000-0x0000000004F8E000-memory.dmp

Filesize
312KB

Download
memory/2936-99-0x0000000004F40000-0x0000000004F8E000-memory.dmp

Filesize
312KB

Download
memory/2936-94-0x0000000004F40000-0x0000000004F8E000-memory.dmp

Filesize
312KB

Download
memory/2936-91-0x0000000004F40000-0x0000000004F8E000-memory.dmp

Filesize
312KB

Download
memory/2936-69-0x0000000004F40000-0x0000000004F8E000-memory.dmp

Filesize
312KB

Download
memory/2936-67-0x0000000004F40000-0x0000000004F8E000-memory.dmp

Filesize
312KB

Download
memory/2936-65-0x0000000004F40000-0x0000000004F8E000-memory.dmp

Filesize
312KB

Download
memory/2936-63-0x0000000004F40000-0x0000000004F8E000-memory.dmp

Filesize
312KB

Download
memory/2936-61-0x0000000004F40000-0x0000000004F8E000-memory.dmp

Filesize
312KB

Download
memory/2936-60-0x0000000004F40000-0x0000000004F8E000-memory.dmp

Filesize
312KB

Download
memory/2936-1104-0x0000000005160000-0x00000000051C6000-memory.dmp

Filesize
408KB

Download
memory/2936-1105-0x0000000006440000-0x0000000006490000-memory.dmp

Filesize
320KB

Download
memory/2936-1106-0x0000000006530000-0x00000000065C2000-memory.dmp

Filesize
584KB

Download
memory/2936-1107-0x00000000064C0000-0x00000000064CA000-memory.dmp

Filesize
40KB

Download