Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
10-05-2024 02:27
General
-
Target
a5e32bcd37ce09665d4e20f9f22b2d471d14c3ec6d38c24013328d14912c1e0b.exe
-
Size
1.2MB
-
MD5
990d7c5089827035267f238afb2347f3
-
SHA1
ceccc360f0a16dd2b4f8f32c0d24c65b203be907
-
SHA256
a5e32bcd37ce09665d4e20f9f22b2d471d14c3ec6d38c24013328d14912c1e0b
-
SHA512
07bd88e0e2abb100732393cc935806a19ce636931703d518eec1131c3156005268f42893b3432dcd63c12b2dbee587a65b112f212b2b401ae0880ae0d3b82732
-
SSDEEP
24576:mqDEvCTbMWu7rQYlBQcBiT6rprG8ayPmAkKteOiNNE:mTvC/MTQYxsWR7ayxFiN
Malware Config
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Detect ZGRat V1 33 IoCs
-
ZGRat
ZGRat is remote access trojan written in C#.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a5e32bcd37ce09665d4e20f9f22b2d471d14c3ec6d38c24013328d14912c1e0b.exe"C:\Users\Admin\AppData\Local\Temp\a5e32bcd37ce09665d4e20f9f22b2d471d14c3ec6d38c24013328d14912c1e0b.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\a5e32bcd37ce09665d4e20f9f22b2d471d14c3ec6d38c24013328d14912c1e0b.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
263KB
MD54a61ba4cf44cd297bae6f8e378a65338
SHA1c778537dad3c658a1a854a2029ab930480111164
SHA256100a87949c751fd3e2de5c58daa689ffec0de812081362015f11e3dac32e9169
SHA51239e00470bca8f65ce0fc538e8ead0a5baaa07fdead6ddf5e88a7574f8cf11f63984a366c970f8b528c9cac24ae51778f6bce03db8d8a792654810fe91b6de121
-
Filesize
16KB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
4KB
-
Filesize
344KB
-
Filesize
336KB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
312KB
-
Filesize
6.9MB
-
Filesize
312KB
-
Filesize
6.9MB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
280KB
-
Filesize
4KB
-
Filesize
6.9MB