Analysis
-
max time kernel
95s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
12-05-2024 01:33
General
-
Target
514433b53820eeae8c05a3e2c370b68cd9dfbaebd74faf1cb7a0c5f5eb12b2e9.exe
-
Size
1.1MB
-
MD5
58e6e98b5e2f780b7f58d300f9db695f
-
SHA1
12afe23b1327c8c32067e6e10524cea1343f5492
-
SHA256
514433b53820eeae8c05a3e2c370b68cd9dfbaebd74faf1cb7a0c5f5eb12b2e9
-
SHA512
d363f0e70dd1423fbc59c974f631ea531275f439ea5c040cf9b49fc764ccd554c32cf17bba86e31946a5ef184663aa6fd32a3aed42591c5337a29b30d31518fc
-
SSDEEP
24576:q4lavt0LkLL9IMixoEgeanWYqAOl8+vblnNhq9MmCS:9kwkn9IMHeanWRq+jVbaPCS
Malware Config
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Detect ZGRat V1 33 IoCs
-
ZGRat
ZGRat is remote access trojan written in C#.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\514433b53820eeae8c05a3e2c370b68cd9dfbaebd74faf1cb7a0c5f5eb12b2e9.exe"C:\Users\Admin\AppData\Local\Temp\514433b53820eeae8c05a3e2c370b68cd9dfbaebd74faf1cb7a0c5f5eb12b2e9.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\514433b53820eeae8c05a3e2c370b68cd9dfbaebd74faf1cb7a0c5f5eb12b2e9.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
264KB
MD5f8afccf7e997955c3b5bea9f03c39e2c
SHA1dc5664b5bf5791a9a6005c8a3d54b488fbc29a35
SHA256ccf16a658c8d26004a76624b0628e680760a473808e11111f26825b78e1fb06d
SHA512cf290dd4bfc23be54ca850edd9190bb91076962e29f1e7cc86175f3068ad17d71d55383d0bd9b7b7253c1a4089278b82e7debbdd2be790ba4278ee1637a3d7fe
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
4KB
-
Filesize
344KB
-
Filesize
7.7MB
-
Filesize
5.6MB
-
Filesize
336KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
7.7MB
-
Filesize
408KB
-
Filesize
320KB
-
Filesize
584KB
-
Filesize
40KB
-
Filesize
280KB
-
Filesize
4KB
-
Filesize
7.7MB
-
Filesize
16KB