Overview

overview

10

Static

static

5

PO-20231228003.exe

windows7-x64

10

PO-20231228003.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    144s
  • max time network
    98s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-05-2024 01:01

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    PO-20231228003.exe

  • Size

    1.3MB

  • MD5

    bb078c83338aa40005dcc903e8d00842

  • SHA1

    99516fbbfc72156970db12059d52a9d2f16aff5b

  • SHA256

    0ae05a66eb5e6dd6fc26a59f27d48f3cd28ae6c1454082045a32aff02d87c854

  • SHA512

    5b56402c626a92237d1e0a11e6c9034b1632fda921eb5c6fc0389b44e1f4c6eaa0318d0fa0ec2d5be8221c240d98d754bd275a9097f6bd592d3626af0d199e4e

  • SSDEEP

    24576:y4lavt0LkLL9IMixoEgeadMxjIuN6RimoUayq9MmCS:lkwkn9IMHeadAjCCU1aPCS

Score
10/10
agentteslazgratkeyloggerratspywarestealertrojan

Malware Config

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla
  • Detect ZGRat V1 33 IoCs
  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat
  • Detect packed .NET executables. Mostly AgentTeslaV4. 33 IoCs
  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 33 IoCs
  • Detects executables referencing Windows vault credential objects. Observed in infostealers 33 IoCs
  • Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers 33 IoCs
  • Detects executables referencing many email and collaboration clients. Observed in information stealers 33 IoCs
  • Detects executables referencing many file transfer clients. Observed in information stealers 33 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 6 IoCs
  • Suspicious use of SendNotifyMessage 6 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\PO-20231228003.exe
    "C:\Users\Admin\AppData\Local\Temp\PO-20231228003.exe"
    1⤵
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2356
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Users\Admin\AppData\Local\Temp\PO-20231228003.exe"
      2⤵
        PID:1920
      • C:\Users\Admin\AppData\Local\Temp\PO-20231228003.exe
        "C:\Users\Admin\AppData\Local\Temp\PO-20231228003.exe"
        2⤵
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:2784
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
          "C:\Users\Admin\AppData\Local\Temp\PO-20231228003.exe"
          3⤵
            PID:3180
          • C:\Users\Admin\AppData\Local\Temp\PO-20231228003.exe
            "C:\Users\Admin\AppData\Local\Temp\PO-20231228003.exe"
            3⤵
            • Suspicious use of SetThreadContext
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of WriteProcessMemory
            PID:3848
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
              "C:\Users\Admin\AppData\Local\Temp\PO-20231228003.exe"
              4⤵
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:1472

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\ageless
        Filesize

        262KB

        MD5

        c3a05fabceffe2fc8def9cbdd30cd3d2

        SHA1

        32ef7e0a9d3f2ba30c3573fdd26714a96b12428c

        SHA256

        91fb367c7bff600e4db5b8a96136b0fe500b193f4587d971563baa9d8187b7a9

        SHA512

        2dc0d4b09aabe3a9b931d4f6ec99fecf19e5845a9f4d7765ed858fb4f77ec15824bbc600ccdc6bd30816ed6ff3189e2203f059d6989d33bc48501a0f34310573

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\aut4DB2.tmp
        Filesize

        259KB

        MD5

        620d101fc3ca4048f9a01f26aa7c8962

        SHA1

        262d92881ab6e0a0dc0b8028a1d392954fda77e1

        SHA256

        e6fce92b74e0b6aa310731cc4b8f3157f87666be782dd3a2f4f68945b6fe06ea

        SHA512

        9199d5a32c6ba5eb9c0f941aca13bcdcfa79231ab8e7fe39be14af5dd0a997ad1240f2fe93fe25fcb277805200bd8fa43c1149dbdeba5579a28d9a37d791c9a3

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\aut4DC3.tmp
        Filesize

        9KB

        MD5

        509a6a9ff60c7922a8fb4dfe70b927d4

        SHA1

        6d37d1d9940e4e8542f294247700bf31acc19afd

        SHA256

        378d85f3bc69533db8aea7d813fd63a9192fd4e7de59cb8e81fbcfad2d7d7f14

        SHA512

        5799f1db9780e6cc1ff5f847eb272423fc467a31596b7cb8393a86cbe1b027d8a8e8615d4e931fc7264ce66ffcde76b3553dcfee079e3abf10af6b57e2c4ee57

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\maneuverability
        Filesize

        28KB

        MD5

        0890ddda3c33d9596c0ed994671c138e

        SHA1

        00d5c6a246cb9ad2620feca83d27731b65116eb8

        SHA256

        d9afa70063c694a5c80caee8f4f5f55a66cc1289896d3f0993fd7ed9c97551c9

        SHA512

        d8631f8ec094770c1a369140af157837232e90173b764c73339cac3911efc6559ee9667fde656ffad9e0ba40f79ab8536bf6a55a057101e2770eb74f483b4a2f

        Download Submit

      • memory/1472-81-0x0000000005AF0000-0x0000000005B3D000-memory.dmp

        Filesize

        308KB

        Download

      • memory/1472-38-0x0000000000400000-0x0000000000446000-memory.dmp

        Filesize

        280KB

        Download

      • memory/1472-37-0x0000000000400000-0x0000000000446000-memory.dmp

        Filesize

        280KB

        Download

      • memory/1472-77-0x0000000005AF0000-0x0000000005B3D000-memory.dmp

        Filesize

        308KB

        Download

      • memory/1472-36-0x0000000000400000-0x0000000000446000-memory.dmp

        Filesize

        280KB

        Download

      • memory/1472-39-0x00000000031B0000-0x0000000003204000-memory.dmp

        Filesize

        336KB

        Download

      • memory/1472-40-0x00000000060A0000-0x0000000006644000-memory.dmp

        Filesize

        5.6MB

        Download

      • memory/1472-41-0x0000000005AF0000-0x0000000005B42000-memory.dmp

        Filesize

        328KB

        Download

      • memory/1472-49-0x0000000005AF0000-0x0000000005B3D000-memory.dmp

        Filesize

        308KB

        Download

      • memory/1472-53-0x0000000005AF0000-0x0000000005B3D000-memory.dmp

        Filesize

        308KB

        Download

      • memory/1472-79-0x0000000005AF0000-0x0000000005B3D000-memory.dmp

        Filesize

        308KB

        Download

      • memory/1472-99-0x0000000005AF0000-0x0000000005B3D000-memory.dmp

        Filesize

        308KB

        Download

      • memory/1472-75-0x0000000005AF0000-0x0000000005B3D000-memory.dmp

        Filesize

        308KB

        Download

      • memory/1472-95-0x0000000005AF0000-0x0000000005B3D000-memory.dmp

        Filesize

        308KB

        Download

      • memory/1472-91-0x0000000005AF0000-0x0000000005B3D000-memory.dmp

        Filesize

        308KB

        Download

      • memory/1472-89-0x0000000005AF0000-0x0000000005B3D000-memory.dmp

        Filesize

        308KB

        Download

      • memory/1472-87-0x0000000005AF0000-0x0000000005B3D000-memory.dmp

        Filesize

        308KB

        Download

      • memory/1472-86-0x0000000005AF0000-0x0000000005B3D000-memory.dmp

        Filesize

        308KB

        Download

      • memory/1472-83-0x0000000005AF0000-0x0000000005B3D000-memory.dmp

        Filesize

        308KB

        Download

      • memory/1472-1076-0x0000000000400000-0x0000000000446000-memory.dmp

        Filesize

        280KB

        Download

      • memory/1472-101-0x0000000005AF0000-0x0000000005B3D000-memory.dmp

        Filesize

        308KB

        Download

      • memory/1472-35-0x0000000000400000-0x0000000000446000-memory.dmp

        Filesize

        280KB

        Download

      • memory/1472-97-0x0000000005AF0000-0x0000000005B3D000-memory.dmp

        Filesize

        308KB

        Download

      • memory/1472-73-0x0000000005AF0000-0x0000000005B3D000-memory.dmp

        Filesize

        308KB

        Download

      • memory/1472-71-0x0000000005AF0000-0x0000000005B3D000-memory.dmp

        Filesize

        308KB

        Download

      • memory/1472-67-0x0000000005AF0000-0x0000000005B3D000-memory.dmp

        Filesize

        308KB

        Download

      • memory/1472-65-0x0000000005AF0000-0x0000000005B3D000-memory.dmp

        Filesize

        308KB

        Download

      • memory/1472-63-0x0000000005AF0000-0x0000000005B3D000-memory.dmp

        Filesize

        308KB

        Download

      • memory/1472-61-0x0000000005AF0000-0x0000000005B3D000-memory.dmp

        Filesize

        308KB

        Download

      • memory/1472-59-0x0000000005AF0000-0x0000000005B3D000-memory.dmp

        Filesize

        308KB

        Download

      • memory/1472-57-0x0000000005AF0000-0x0000000005B3D000-memory.dmp

        Filesize

        308KB

        Download

      • memory/1472-55-0x0000000005AF0000-0x0000000005B3D000-memory.dmp

        Filesize

        308KB

        Download

      • memory/1472-51-0x0000000005AF0000-0x0000000005B3D000-memory.dmp

        Filesize

        308KB

        Download

      • memory/1472-45-0x0000000005AF0000-0x0000000005B3D000-memory.dmp

        Filesize

        308KB

        Download

      • memory/1472-93-0x0000000005AF0000-0x0000000005B3D000-memory.dmp

        Filesize

        308KB

        Download

      • memory/1472-69-0x0000000005AF0000-0x0000000005B3D000-memory.dmp

        Filesize

        308KB

        Download

      • memory/1472-47-0x0000000005AF0000-0x0000000005B3D000-memory.dmp

        Filesize

        308KB

        Download

      • memory/1472-43-0x0000000005AF0000-0x0000000005B3D000-memory.dmp

        Filesize

        308KB

        Download

      • memory/1472-42-0x0000000005AF0000-0x0000000005B3D000-memory.dmp

        Filesize

        308KB

        Download

      • memory/1472-1072-0x0000000005CB0000-0x0000000005D16000-memory.dmp

        Filesize

        408KB

        Download

      • memory/1472-1073-0x0000000006AD0000-0x0000000006B20000-memory.dmp

        Filesize

        320KB

        Download

      • memory/1472-1074-0x0000000006BC0000-0x0000000006C52000-memory.dmp

        Filesize

        584KB

        Download

      • memory/1472-1075-0x0000000006B20000-0x0000000006B2A000-memory.dmp

        Filesize

        40KB

        Download

      • memory/2356-10-0x0000000004CC0000-0x0000000004CC4000-memory.dmp

        Filesize

        16KB

        Download