Analysis

  • max time kernel
    157s
  • max time network
    164s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/05/2024, 03:03

General

  • Target

    328e70cca6f607ee5e124be316cbd024fa84f61b874c0568366516a8222675aa.exe

  • Size

    1.1MB

  • MD5

    63d74b4d5b18373ba3230ed473922c70

  • SHA1

    96dd293df1e4d4f7972d3c2d647195b81a1699d8

  • SHA256

    328e70cca6f607ee5e124be316cbd024fa84f61b874c0568366516a8222675aa

  • SHA512

    c43d222acef5f5581ad1923431aa66a39161da2e69a02afc64aeb901e3c7465c392d11bad5d14662b66f79e90adc3ef843e78887591a4794486350aa0ba6f512

  • SSDEEP

    24576:0qDEvCTbMWu7rQYlBQcBiT6rprG8amzNiCDJjKJ7ypNh1:0TvC/MTQYxsWR7amgUJI2

Malware Config

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Detect ZGRat V1 2 IoCs
  • ZGRat

    ZGRat is remote access trojan written in C#.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 5 IoCs
  • Suspicious use of SendNotifyMessage 5 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\328e70cca6f607ee5e124be316cbd024fa84f61b874c0568366516a8222675aa.exe
    "C:\Users\Admin\AppData\Local\Temp\328e70cca6f607ee5e124be316cbd024fa84f61b874c0568366516a8222675aa.exe"
    1⤵
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2548
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Users\Admin\AppData\Local\Temp\328e70cca6f607ee5e124be316cbd024fa84f61b874c0568366516a8222675aa.exe"
      2⤵
        PID:4324
      • C:\Users\Admin\AppData\Local\Temp\328e70cca6f607ee5e124be316cbd024fa84f61b874c0568366516a8222675aa.exe
        "C:\Users\Admin\AppData\Local\Temp\328e70cca6f607ee5e124be316cbd024fa84f61b874c0568366516a8222675aa.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:4300
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
          "C:\Users\Admin\AppData\Local\Temp\328e70cca6f607ee5e124be316cbd024fa84f61b874c0568366516a8222675aa.exe"
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:2276
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3940 --field-trial-handle=2284,i,9807419199535700662,2319175108930815708,262144 --variations-seed-version /prefetch:8
      1⤵
        PID:1604

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\nonhazardousness

        Filesize

        28KB

        MD5

        eafe8751898e0b3c1ea7f59f88dbb724

        SHA1

        3e94472d4b13544dccf63cae2b695b486458f40c

        SHA256

        f6efb701356255d6b13eb6a66d405337a30d1d1b2d1263c382fab079ccc34df9

        SHA512

        575e8c115202394c75910021ffbd7d7c0519f9ffb3777bcf5107179267c02ba3b3aa59a0116d839a3a5aea73e152bd053fccd5b83a421f2a3dc0332c39a1bd28

      • memory/2276-27-0x0000000000400000-0x0000000000446000-memory.dmp

        Filesize

        280KB

      • memory/2276-31-0x0000000005590000-0x00000000055E4000-memory.dmp

        Filesize

        336KB

      • memory/2276-24-0x0000000000400000-0x0000000000446000-memory.dmp

        Filesize

        280KB

      • memory/2276-25-0x0000000000400000-0x0000000000446000-memory.dmp

        Filesize

        280KB

      • memory/2276-26-0x0000000000400000-0x0000000000446000-memory.dmp

        Filesize

        280KB

      • memory/2276-28-0x0000000073CFE000-0x0000000073CFF000-memory.dmp

        Filesize

        4KB

      • memory/2276-38-0x0000000073CF0000-0x00000000744A0000-memory.dmp

        Filesize

        7.7MB

      • memory/2276-29-0x0000000073CFE000-0x0000000073CFF000-memory.dmp

        Filesize

        4KB

      • memory/2276-30-0x0000000073CF0000-0x00000000744A0000-memory.dmp

        Filesize

        7.7MB

      • memory/2276-23-0x0000000000400000-0x0000000000446000-memory.dmp

        Filesize

        280KB

      • memory/2276-32-0x0000000073CF0000-0x00000000744A0000-memory.dmp

        Filesize

        7.7MB

      • memory/2276-33-0x0000000073CF0000-0x00000000744A0000-memory.dmp

        Filesize

        7.7MB

      • memory/2276-34-0x0000000073CF0000-0x00000000744A0000-memory.dmp

        Filesize

        7.7MB

      • memory/2276-35-0x0000000005D10000-0x00000000062B4000-memory.dmp

        Filesize

        5.6MB

      • memory/2276-36-0x0000000000F90000-0x0000000000FE2000-memory.dmp

        Filesize

        328KB

      • memory/2276-37-0x0000000073CF0000-0x00000000744A0000-memory.dmp

        Filesize

        7.7MB

      • memory/2548-10-0x00000000017F0000-0x00000000017F4000-memory.dmp

        Filesize

        16KB