Overview

overview

10

Static

static

5

02733354b8...53.exe

windows7-x64

10

02733354b8...53.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    136s
  • max time network
    108s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-05-2024 01:01

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    02733354b801cdf3f1770a0e9dee66f4b578241105d9ef15117e7bdb1abcad53.exe

  • Size

    1.1MB

  • MD5

    55f25b3ea6de1642b9aa771002b54c5b

  • SHA1

    929f1c5b44b54293a657f4abb5573746878d3cb8

  • SHA256

    02733354b801cdf3f1770a0e9dee66f4b578241105d9ef15117e7bdb1abcad53

  • SHA512

    6770fb0a25426f3070c018d23e6b1c6e6e77999ac6b8e0d8e233f1285c73d3602268f6b2f276e230be8a29673007cb8e9aad6c3783c6946d5fb4384c4e106441

  • SSDEEP

    24576:yqDEvCTbMWu7rQYlBQcBiT6rprG8aZ3YH1Rckm2bXNT:yTvC/MTQYxsWR7aZ3Y3HT

Score
10/10
agentteslazgratkeyloggerpersistenceratspywarestealertrojan

Malware Config

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla
  • Detect ZGRat V1 33 IoCs
  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat
  • Detect packed .NET executables. Mostly AgentTeslaV4. 33 IoCs
  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 33 IoCs
  • Detects executables referencing Windows vault credential objects. Observed in infostealers 33 IoCs
  • Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers 33 IoCs
  • Detects executables referencing many email and collaboration clients. Observed in information stealers 33 IoCs
  • Detects executables referencing many file transfer clients. Observed in information stealers 33 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 4 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\02733354b801cdf3f1770a0e9dee66f4b578241105d9ef15117e7bdb1abcad53.exe
    "C:\Users\Admin\AppData\Local\Temp\02733354b801cdf3f1770a0e9dee66f4b578241105d9ef15117e7bdb1abcad53.exe"
    1⤵
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:736
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Users\Admin\AppData\Local\Temp\02733354b801cdf3f1770a0e9dee66f4b578241105d9ef15117e7bdb1abcad53.exe"
      2⤵
        PID:1524
      • C:\Users\Admin\AppData\Local\Temp\02733354b801cdf3f1770a0e9dee66f4b578241105d9ef15117e7bdb1abcad53.exe
        "C:\Users\Admin\AppData\Local\Temp\02733354b801cdf3f1770a0e9dee66f4b578241105d9ef15117e7bdb1abcad53.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:3700
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
          "C:\Users\Admin\AppData\Local\Temp\02733354b801cdf3f1770a0e9dee66f4b578241105d9ef15117e7bdb1abcad53.exe"
          3⤵
          • Adds Run key to start application
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:4344

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\aut2E92.tmp
      Filesize

      262KB

      MD5

      ef174ed98bb82afb97d69659931ece7c

      SHA1

      9caa78cad45ed7b2918534e31d48b11cabe03b03

      SHA256

      946a0ccc80707ee58ffa98460cfbe5c93656d35a294c3781db15f8c950dfb216

      SHA512

      9764fefbc33f31c5454b4929a577e9ab7caf00303406e2b7fd6fecebf640ca4140ba47501dd689b99a9c2a03fd1f409435430ef29ef5717f5c0b99a364f055c3

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\lecheries
      Filesize

      29KB

      MD5

      d316c98886a2a632ee4ffe4cd0bbf1f7

      SHA1

      9b31ec01c60bde4b364299cf743c2e21257a9c1c

      SHA256

      bba7b40199d002f20e23b1d880ccafcc8512f32481857c2df635f02366557532

      SHA512

      56930116d190a46fc5bc0960c9b360404600934955f6b38e31b20c298eb6aee6e466e36b42d3cb036ccd91e4ca40379e4c37e4f0cd53e107a885c3f5bac3b6e5

      Download Submit

    • memory/736-12-0x0000000001830000-0x0000000001834000-memory.dmp

      Filesize

      16KB

      Download

    • memory/4344-27-0x0000000000400000-0x0000000000446000-memory.dmp

      Filesize

      280KB

      Download

    • memory/4344-28-0x0000000000400000-0x0000000000446000-memory.dmp

      Filesize

      280KB

      Download

    • memory/4344-29-0x0000000000400000-0x0000000000446000-memory.dmp

      Filesize

      280KB

      Download

    • memory/4344-30-0x0000000000400000-0x0000000000446000-memory.dmp

      Filesize

      280KB

      Download

    • memory/4344-31-0x0000000073F6E000-0x0000000073F6F000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4344-32-0x0000000005780000-0x00000000057D4000-memory.dmp

      Filesize

      336KB

      Download

    • memory/4344-34-0x0000000005DC0000-0x0000000006364000-memory.dmp

      Filesize

      5.6MB

      Download

    • memory/4344-33-0x0000000073F60000-0x0000000074710000-memory.dmp

      Filesize

      7.7MB

      Download

    • memory/4344-35-0x0000000005850000-0x00000000058A2000-memory.dmp

      Filesize

      328KB

      Download

    • memory/4344-36-0x0000000073F60000-0x0000000074710000-memory.dmp

      Filesize

      7.7MB

      Download

    • memory/4344-52-0x0000000005850000-0x000000000589D000-memory.dmp

      Filesize

      308KB

      Download

    • memory/4344-60-0x0000000005850000-0x000000000589D000-memory.dmp

      Filesize

      308KB

      Download

    • memory/4344-129-0x0000000073F60000-0x0000000074710000-memory.dmp

      Filesize

      7.7MB

      Download

    • memory/4344-94-0x0000000005850000-0x000000000589D000-memory.dmp

      Filesize

      308KB

      Download

    • memory/4344-92-0x0000000005850000-0x000000000589D000-memory.dmp

      Filesize

      308KB

      Download

    • memory/4344-88-0x0000000005850000-0x000000000589D000-memory.dmp

      Filesize

      308KB

      Download

    • memory/4344-86-0x0000000005850000-0x000000000589D000-memory.dmp

      Filesize

      308KB

      Download

    • memory/4344-84-0x0000000005850000-0x000000000589D000-memory.dmp

      Filesize

      308KB

      Download

    • memory/4344-82-0x0000000005850000-0x000000000589D000-memory.dmp

      Filesize

      308KB

      Download

    • memory/4344-80-0x0000000005850000-0x000000000589D000-memory.dmp

      Filesize

      308KB

      Download

    • memory/4344-78-0x0000000005850000-0x000000000589D000-memory.dmp

      Filesize

      308KB

      Download

    • memory/4344-76-0x0000000005850000-0x000000000589D000-memory.dmp

      Filesize

      308KB

      Download

    • memory/4344-72-0x0000000005850000-0x000000000589D000-memory.dmp

      Filesize

      308KB

      Download

    • memory/4344-70-0x0000000005850000-0x000000000589D000-memory.dmp

      Filesize

      308KB

      Download

    • memory/4344-68-0x0000000005850000-0x000000000589D000-memory.dmp

      Filesize

      308KB

      Download

    • memory/4344-67-0x0000000005850000-0x000000000589D000-memory.dmp

      Filesize

      308KB

      Download

    • memory/4344-64-0x0000000005850000-0x000000000589D000-memory.dmp

      Filesize

      308KB

      Download

    • memory/4344-62-0x0000000005850000-0x000000000589D000-memory.dmp

      Filesize

      308KB

      Download

    • memory/4344-58-0x0000000005850000-0x000000000589D000-memory.dmp

      Filesize

      308KB

      Download

    • memory/4344-56-0x0000000005850000-0x000000000589D000-memory.dmp

      Filesize

      308KB

      Download

    • memory/4344-54-0x0000000005850000-0x000000000589D000-memory.dmp

      Filesize

      308KB

      Download

    • memory/4344-50-0x0000000005850000-0x000000000589D000-memory.dmp

      Filesize

      308KB

      Download

    • memory/4344-48-0x0000000005850000-0x000000000589D000-memory.dmp

      Filesize

      308KB

      Download

    • memory/4344-46-0x0000000005850000-0x000000000589D000-memory.dmp

      Filesize

      308KB

      Download

    • memory/4344-44-0x0000000005850000-0x000000000589D000-memory.dmp

      Filesize

      308KB

      Download

    • memory/4344-42-0x0000000005850000-0x000000000589D000-memory.dmp

      Filesize

      308KB

      Download

    • memory/4344-40-0x0000000005850000-0x000000000589D000-memory.dmp

      Filesize

      308KB

      Download

    • memory/4344-38-0x0000000005850000-0x000000000589D000-memory.dmp

      Filesize

      308KB

      Download

    • memory/4344-37-0x0000000005850000-0x000000000589D000-memory.dmp

      Filesize

      308KB

      Download

    • memory/4344-96-0x0000000005850000-0x000000000589D000-memory.dmp

      Filesize

      308KB

      Download

    • memory/4344-90-0x0000000005850000-0x000000000589D000-memory.dmp

      Filesize

      308KB

      Download

    • memory/4344-74-0x0000000005850000-0x000000000589D000-memory.dmp

      Filesize

      308KB

      Download

    • memory/4344-1070-0x0000000073F60000-0x0000000074710000-memory.dmp

      Filesize

      7.7MB

      Download

    • memory/4344-1071-0x0000000005A20000-0x0000000005A86000-memory.dmp

      Filesize

      408KB

      Download

    • memory/4344-1073-0x0000000006980000-0x00000000069D0000-memory.dmp

      Filesize

      320KB

      Download

    • memory/4344-1074-0x0000000006A70000-0x0000000006B02000-memory.dmp

      Filesize

      584KB

      Download

    • memory/4344-1075-0x0000000006A40000-0x0000000006A4A000-memory.dmp

      Filesize

      40KB

      Download

    • memory/4344-1076-0x0000000000400000-0x0000000000446000-memory.dmp

      Filesize

      280KB

      Download

    • memory/4344-1077-0x0000000073F6E000-0x0000000073F6F000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4344-1078-0x0000000073F60000-0x0000000074710000-memory.dmp

      Filesize

      7.7MB

      Download