agenttesla | f571d9cbaf9c5b082c8b4865472c7207ba89907beae9151efdb6a257bc6d2b86

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
10-05-2024 10:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c79733ad7eefa61a1e3f5f6db5c04ee0_NeikiAnalytics.exe
Size

1.3MB
MD5

c79733ad7eefa61a1e3f5f6db5c04ee0
SHA1

f7cf4b7fdf20f5fc9889e1a1995bcbfa4c9b755c
SHA256

f571d9cbaf9c5b082c8b4865472c7207ba89907beae9151efdb6a257bc6d2b86
SHA512

2b4482f9c5ad88d25cd5bd3911137762703ac842a832a1b729ef8fbe5969463289747a8768c229e5f1be8b97403bce03c059900020ed375a42555ffa33bb8905
SSDEEP

24576:kAHnh+eWsN3skA4RV1Hom2KXMmHaqbLYqnzkIojMekzv5:zh+ZkldoPK8YaqbUkzvN

Score

10^/10

agenttesla zgrat keylogger rat spyware stealer trojan

Malware Config

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Detect ZGRat V1 33 IoCs

resource	yara_rule
behavioral1/memory/2296-28-0x0000000000360000-0x00000000003B4000-memory.dmp	family_zgrat_v1
behavioral1/memory/2296-29-0x0000000000AF0000-0x0000000000B42000-memory.dmp	family_zgrat_v1
behavioral1/memory/2296-76-0x0000000000AF0000-0x0000000000B3D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2296-91-0x0000000000AF0000-0x0000000000B3D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2296-89-0x0000000000AF0000-0x0000000000B3D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2296-87-0x0000000000AF0000-0x0000000000B3D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2296-85-0x0000000000AF0000-0x0000000000B3D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2296-83-0x0000000000AF0000-0x0000000000B3D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2296-81-0x0000000000AF0000-0x0000000000B3D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2296-78-0x0000000000AF0000-0x0000000000B3D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2296-74-0x0000000000AF0000-0x0000000000B3D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2296-72-0x0000000000AF0000-0x0000000000B3D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2296-70-0x0000000000AF0000-0x0000000000B3D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2296-68-0x0000000000AF0000-0x0000000000B3D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2296-66-0x0000000000AF0000-0x0000000000B3D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2296-64-0x0000000000AF0000-0x0000000000B3D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2296-62-0x0000000000AF0000-0x0000000000B3D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2296-60-0x0000000000AF0000-0x0000000000B3D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2296-58-0x0000000000AF0000-0x0000000000B3D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2296-54-0x0000000000AF0000-0x0000000000B3D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2296-52-0x0000000000AF0000-0x0000000000B3D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2296-50-0x0000000000AF0000-0x0000000000B3D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2296-48-0x0000000000AF0000-0x0000000000B3D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2296-46-0x0000000000AF0000-0x0000000000B3D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2296-44-0x0000000000AF0000-0x0000000000B3D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2296-42-0x0000000000AF0000-0x0000000000B3D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2296-40-0x0000000000AF0000-0x0000000000B3D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2296-38-0x0000000000AF0000-0x0000000000B3D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2296-36-0x0000000000AF0000-0x0000000000B3D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2296-34-0x0000000000AF0000-0x0000000000B3D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2296-32-0x0000000000AF0000-0x0000000000B3D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2296-31-0x0000000000AF0000-0x0000000000B3D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2296-56-0x0000000000AF0000-0x0000000000B3D000-memory.dmp	family_zgrat_v1

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2396 set thread context of 2296	2396	c79733ad7eefa61a1e3f5f6db5c04ee0_NeikiAnalytics.exe	30

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2296	RegSvcs.exe
2296	RegSvcs.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
2080	c79733ad7eefa61a1e3f5f6db5c04ee0_NeikiAnalytics.exe
2396	c79733ad7eefa61a1e3f5f6db5c04ee0_NeikiAnalytics.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2296	RegSvcs.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
2080	c79733ad7eefa61a1e3f5f6db5c04ee0_NeikiAnalytics.exe
2080	c79733ad7eefa61a1e3f5f6db5c04ee0_NeikiAnalytics.exe
2396	c79733ad7eefa61a1e3f5f6db5c04ee0_NeikiAnalytics.exe
2396	c79733ad7eefa61a1e3f5f6db5c04ee0_NeikiAnalytics.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
2080	c79733ad7eefa61a1e3f5f6db5c04ee0_NeikiAnalytics.exe
2080	c79733ad7eefa61a1e3f5f6db5c04ee0_NeikiAnalytics.exe
2396	c79733ad7eefa61a1e3f5f6db5c04ee0_NeikiAnalytics.exe
2396	c79733ad7eefa61a1e3f5f6db5c04ee0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 1792	2080	c79733ad7eefa61a1e3f5f6db5c04ee0_NeikiAnalytics.exe	28
PID 2080 wrote to memory of 1792	2080	c79733ad7eefa61a1e3f5f6db5c04ee0_NeikiAnalytics.exe	28
PID 2080 wrote to memory of 1792	2080	c79733ad7eefa61a1e3f5f6db5c04ee0_NeikiAnalytics.exe	28
PID 2080 wrote to memory of 1792	2080	c79733ad7eefa61a1e3f5f6db5c04ee0_NeikiAnalytics.exe	28
PID 2080 wrote to memory of 1792	2080	c79733ad7eefa61a1e3f5f6db5c04ee0_NeikiAnalytics.exe	28
PID 2080 wrote to memory of 1792	2080	c79733ad7eefa61a1e3f5f6db5c04ee0_NeikiAnalytics.exe	28
PID 2080 wrote to memory of 1792	2080	c79733ad7eefa61a1e3f5f6db5c04ee0_NeikiAnalytics.exe	28
PID 2080 wrote to memory of 2396	2080	c79733ad7eefa61a1e3f5f6db5c04ee0_NeikiAnalytics.exe	29
PID 2080 wrote to memory of 2396	2080	c79733ad7eefa61a1e3f5f6db5c04ee0_NeikiAnalytics.exe	29
PID 2080 wrote to memory of 2396	2080	c79733ad7eefa61a1e3f5f6db5c04ee0_NeikiAnalytics.exe	29
PID 2080 wrote to memory of 2396	2080	c79733ad7eefa61a1e3f5f6db5c04ee0_NeikiAnalytics.exe	29
PID 2396 wrote to memory of 2296	2396	c79733ad7eefa61a1e3f5f6db5c04ee0_NeikiAnalytics.exe	30
PID 2396 wrote to memory of 2296	2396	c79733ad7eefa61a1e3f5f6db5c04ee0_NeikiAnalytics.exe	30
PID 2396 wrote to memory of 2296	2396	c79733ad7eefa61a1e3f5f6db5c04ee0_NeikiAnalytics.exe	30
PID 2396 wrote to memory of 2296	2396	c79733ad7eefa61a1e3f5f6db5c04ee0_NeikiAnalytics.exe	30
PID 2396 wrote to memory of 2296	2396	c79733ad7eefa61a1e3f5f6db5c04ee0_NeikiAnalytics.exe	30
PID 2396 wrote to memory of 2296	2396	c79733ad7eefa61a1e3f5f6db5c04ee0_NeikiAnalytics.exe	30
PID 2396 wrote to memory of 2296	2396	c79733ad7eefa61a1e3f5f6db5c04ee0_NeikiAnalytics.exe	30
PID 2396 wrote to memory of 2296	2396	c79733ad7eefa61a1e3f5f6db5c04ee0_NeikiAnalytics.exe	30

C:\Users\Admin\AppData\Local\Temp\c79733ad7eefa61a1e3f5f6db5c04ee0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\c79733ad7eefa61a1e3f5f6db5c04ee0_NeikiAnalytics.exe"
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Users\Admin\AppData\Local\Temp\c79733ad7eefa61a1e3f5f6db5c04ee0_NeikiAnalytics.exe"
  2⤵
  PID:1792
- C:\Users\Admin\AppData\Local\Temp\c79733ad7eefa61a1e3f5f6db5c04ee0_NeikiAnalytics.exe
  "C:\Users\Admin\AppData\Local\Temp\c79733ad7eefa61a1e3f5f6db5c04ee0_NeikiAnalytics.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2396
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "C:\Users\Admin\AppData\Local\Temp\c79733ad7eefa61a1e3f5f6db5c04ee0_NeikiAnalytics.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2296

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2080-10-0x0000000000120000-0x0000000000124000-memory.dmp

Filesize
16KB

Download
memory/2296-68-0x0000000000AF0000-0x0000000000B3D000-memory.dmp

Filesize
308KB

Download
memory/2296-27-0x000000007422E000-0x000000007422F000-memory.dmp

Filesize
4KB

Download
memory/2296-26-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2296-66-0x0000000000AF0000-0x0000000000B3D000-memory.dmp

Filesize
308KB

Download
memory/2296-28-0x0000000000360000-0x00000000003B4000-memory.dmp

Filesize
336KB

Download
memory/2296-29-0x0000000000AF0000-0x0000000000B42000-memory.dmp

Filesize
328KB

Download
memory/2296-30-0x0000000074220000-0x000000007490E000-memory.dmp

Filesize
6.9MB

Download
memory/2296-76-0x0000000000AF0000-0x0000000000B3D000-memory.dmp

Filesize
308KB

Download
memory/2296-91-0x0000000000AF0000-0x0000000000B3D000-memory.dmp

Filesize
308KB

Download
memory/2296-230-0x0000000074220000-0x000000007490E000-memory.dmp

Filesize
6.9MB

Download
memory/2296-23-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2296-87-0x0000000000AF0000-0x0000000000B3D000-memory.dmp

Filesize
308KB

Download
memory/2296-64-0x0000000000AF0000-0x0000000000B3D000-memory.dmp

Filesize
308KB

Download
memory/2296-83-0x0000000000AF0000-0x0000000000B3D000-memory.dmp

Filesize
308KB

Download
memory/2296-81-0x0000000000AF0000-0x0000000000B3D000-memory.dmp

Filesize
308KB

Download
memory/2296-80-0x0000000074220000-0x000000007490E000-memory.dmp

Filesize
6.9MB

Download
memory/2296-78-0x0000000000AF0000-0x0000000000B3D000-memory.dmp

Filesize
308KB

Download
memory/2296-74-0x0000000000AF0000-0x0000000000B3D000-memory.dmp

Filesize
308KB

Download
memory/2296-72-0x0000000000AF0000-0x0000000000B3D000-memory.dmp

Filesize
308KB

Download
memory/2296-70-0x0000000000AF0000-0x0000000000B3D000-memory.dmp

Filesize
308KB

Download
memory/2296-89-0x0000000000AF0000-0x0000000000B3D000-memory.dmp

Filesize
308KB

Download
memory/2296-25-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2296-85-0x0000000000AF0000-0x0000000000B3D000-memory.dmp

Filesize
308KB

Download
memory/2296-62-0x0000000000AF0000-0x0000000000B3D000-memory.dmp

Filesize
308KB

Download
memory/2296-60-0x0000000000AF0000-0x0000000000B3D000-memory.dmp

Filesize
308KB

Download
memory/2296-58-0x0000000000AF0000-0x0000000000B3D000-memory.dmp

Filesize
308KB

Download
memory/2296-54-0x0000000000AF0000-0x0000000000B3D000-memory.dmp

Filesize
308KB

Download
memory/2296-52-0x0000000000AF0000-0x0000000000B3D000-memory.dmp

Filesize
308KB

Download
memory/2296-50-0x0000000000AF0000-0x0000000000B3D000-memory.dmp

Filesize
308KB

Download
memory/2296-48-0x0000000000AF0000-0x0000000000B3D000-memory.dmp

Filesize
308KB

Download
memory/2296-46-0x0000000000AF0000-0x0000000000B3D000-memory.dmp

Filesize
308KB

Download
memory/2296-44-0x0000000000AF0000-0x0000000000B3D000-memory.dmp

Filesize
308KB

Download
memory/2296-42-0x0000000000AF0000-0x0000000000B3D000-memory.dmp

Filesize
308KB

Download
memory/2296-40-0x0000000000AF0000-0x0000000000B3D000-memory.dmp

Filesize
308KB

Download
memory/2296-38-0x0000000000AF0000-0x0000000000B3D000-memory.dmp

Filesize
308KB

Download
memory/2296-36-0x0000000000AF0000-0x0000000000B3D000-memory.dmp

Filesize
308KB

Download
memory/2296-34-0x0000000000AF0000-0x0000000000B3D000-memory.dmp

Filesize
308KB

Download
memory/2296-32-0x0000000000AF0000-0x0000000000B3D000-memory.dmp

Filesize
308KB

Download
memory/2296-31-0x0000000000AF0000-0x0000000000B3D000-memory.dmp

Filesize
308KB

Download
memory/2296-56-0x0000000000AF0000-0x0000000000B3D000-memory.dmp

Filesize
308KB

Download
memory/2296-1063-0x0000000074220000-0x000000007490E000-memory.dmp

Filesize
6.9MB

Download
memory/2296-1064-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2296-1065-0x000000007422E000-0x000000007422F000-memory.dmp

Filesize
4KB

Download
memory/2296-1066-0x0000000074220000-0x000000007490E000-memory.dmp

Filesize
6.9MB

Download