agenttesla | 9cbd6f353523ae3df7bc1014ceeb7ba74c1805495f1842b921cd0d7797c10a6c

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13/05/2024, 13:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

EKP.exe
Size

1.1MB
MD5

6a8b70dcb35732e43696553050e6c5bd
SHA1

01cf1e4b74abf7a5674740737e075c0e83fde303
SHA256

9cbd6f353523ae3df7bc1014ceeb7ba74c1805495f1842b921cd0d7797c10a6c
SHA512

82b0f0207fd305d1d612c5e145c1f085258b7b910e7adea0d6e49b3c0207e7e1d33ac1e4e6ff6d588f400762794643816141d21a9325e4fed90b33acae54dc88
SSDEEP

24576:NAHnh+eWsN3skA4RV1Hom2KXMmHa1SF8e04fPcFFHLayy5:sh+ZkldoPK8Ya1nj43cFFHLaj

Score

10^/10

agenttesla zgrat keylogger rat spyware stealer trojan

Malware Config

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Detect ZGRat V1 33 IoCs

resource	yara_rule
behavioral1/memory/2940-17-0x0000000000370000-0x00000000003C4000-memory.dmp	family_zgrat_v1
behavioral1/memory/2940-18-0x0000000002050000-0x00000000020A2000-memory.dmp	family_zgrat_v1
behavioral1/memory/2940-72-0x0000000002050000-0x000000000209D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2940-80-0x0000000002050000-0x000000000209D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2940-78-0x0000000002050000-0x000000000209D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2940-76-0x0000000002050000-0x000000000209D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2940-74-0x0000000002050000-0x000000000209D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2940-70-0x0000000002050000-0x000000000209D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2940-68-0x0000000002050000-0x000000000209D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2940-66-0x0000000002050000-0x000000000209D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2940-64-0x0000000002050000-0x000000000209D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2940-62-0x0000000002050000-0x000000000209D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2940-60-0x0000000002050000-0x000000000209D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2940-58-0x0000000002050000-0x000000000209D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2940-56-0x0000000002050000-0x000000000209D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2940-54-0x0000000002050000-0x000000000209D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2940-52-0x0000000002050000-0x000000000209D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2940-48-0x0000000002050000-0x000000000209D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2940-46-0x0000000002050000-0x000000000209D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2940-44-0x0000000002050000-0x000000000209D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2940-42-0x0000000002050000-0x000000000209D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2940-40-0x0000000002050000-0x000000000209D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2940-38-0x0000000002050000-0x000000000209D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2940-36-0x0000000002050000-0x000000000209D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2940-34-0x0000000002050000-0x000000000209D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2940-32-0x0000000002050000-0x000000000209D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2940-30-0x0000000002050000-0x000000000209D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2940-28-0x0000000002050000-0x000000000209D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2940-26-0x0000000002050000-0x000000000209D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2940-24-0x0000000002050000-0x000000000209D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2940-22-0x0000000002050000-0x000000000209D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2940-21-0x0000000002050000-0x000000000209D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2940-50-0x0000000002050000-0x000000000209D000-memory.dmp	family_zgrat_v1

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	api.ipify.org
5	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2864 set thread context of 2940	2864	EKP.exe	28

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2940	RegSvcs.exe
2940	RegSvcs.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2864	EKP.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2940	RegSvcs.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2864	EKP.exe
2864	EKP.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
2864	EKP.exe
2864	EKP.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2864 wrote to memory of 2940	2864	EKP.exe	28
PID 2864 wrote to memory of 2940	2864	EKP.exe	28
PID 2864 wrote to memory of 2940	2864	EKP.exe	28
PID 2864 wrote to memory of 2940	2864	EKP.exe	28
PID 2864 wrote to memory of 2940	2864	EKP.exe	28
PID 2864 wrote to memory of 2940	2864	EKP.exe	28
PID 2864 wrote to memory of 2940	2864	EKP.exe	28
PID 2864 wrote to memory of 2940	2864	EKP.exe	28

C:\Users\Admin\AppData\Local\Temp\EKP.exe
"C:\Users\Admin\AppData\Local\Temp\EKP.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2864
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Users\Admin\AppData\Local\Temp\EKP.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2940

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\bothsidedness

Filesize
261KB

MD5
de7f6c4be49379d0fe2e01f425780f4a

SHA1
8b7047a5dafc710b998e0507f86f0a6f8b8b4cb9

SHA256
209b87ab0299da89a9aed54fa8d8d97ba474033c99c7ee2a518ed953a6d0440c

SHA512
62e2ca24e69a6d5e983285247d986ff0f04092dd49e5d4305a31166be6c1aa46f9b1006ec4e153845056d2da89ad4883214164fbc6cb1d8383e764f396ad8084

Download Submit
memory/2864-11-0x00000000001A0000-0x00000000001A4000-memory.dmp

Filesize
16KB

Download
memory/2940-12-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2940-14-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2940-15-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2940-16-0x00000000743DE000-0x00000000743DF000-memory.dmp

Filesize
4KB

Download
memory/2940-17-0x0000000000370000-0x00000000003C4000-memory.dmp

Filesize
336KB

Download
memory/2940-19-0x00000000743D0000-0x0000000074ABE000-memory.dmp

Filesize
6.9MB

Download
memory/2940-18-0x0000000002050000-0x00000000020A2000-memory.dmp

Filesize
328KB

Download
memory/2940-20-0x00000000743D0000-0x0000000074ABE000-memory.dmp

Filesize
6.9MB

Download
memory/2940-72-0x0000000002050000-0x000000000209D000-memory.dmp

Filesize
308KB

Download
memory/2940-80-0x0000000002050000-0x000000000209D000-memory.dmp

Filesize
308KB

Download
memory/2940-117-0x00000000743D0000-0x0000000074ABE000-memory.dmp

Filesize
6.9MB

Download
memory/2940-78-0x0000000002050000-0x000000000209D000-memory.dmp

Filesize
308KB

Download
memory/2940-76-0x0000000002050000-0x000000000209D000-memory.dmp

Filesize
308KB

Download
memory/2940-74-0x0000000002050000-0x000000000209D000-memory.dmp

Filesize
308KB

Download
memory/2940-70-0x0000000002050000-0x000000000209D000-memory.dmp

Filesize
308KB

Download
memory/2940-68-0x0000000002050000-0x000000000209D000-memory.dmp

Filesize
308KB

Download
memory/2940-66-0x0000000002050000-0x000000000209D000-memory.dmp

Filesize
308KB

Download
memory/2940-64-0x0000000002050000-0x000000000209D000-memory.dmp

Filesize
308KB

Download
memory/2940-62-0x0000000002050000-0x000000000209D000-memory.dmp

Filesize
308KB

Download
memory/2940-60-0x0000000002050000-0x000000000209D000-memory.dmp

Filesize
308KB

Download
memory/2940-58-0x0000000002050000-0x000000000209D000-memory.dmp

Filesize
308KB

Download
memory/2940-56-0x0000000002050000-0x000000000209D000-memory.dmp

Filesize
308KB

Download
memory/2940-54-0x0000000002050000-0x000000000209D000-memory.dmp

Filesize
308KB

Download
memory/2940-52-0x0000000002050000-0x000000000209D000-memory.dmp

Filesize
308KB

Download
memory/2940-48-0x0000000002050000-0x000000000209D000-memory.dmp

Filesize
308KB

Download
memory/2940-46-0x0000000002050000-0x000000000209D000-memory.dmp

Filesize
308KB

Download
memory/2940-44-0x0000000002050000-0x000000000209D000-memory.dmp

Filesize
308KB

Download
memory/2940-42-0x0000000002050000-0x000000000209D000-memory.dmp

Filesize
308KB

Download
memory/2940-40-0x0000000002050000-0x000000000209D000-memory.dmp

Filesize
308KB

Download
memory/2940-38-0x0000000002050000-0x000000000209D000-memory.dmp

Filesize
308KB

Download
memory/2940-36-0x0000000002050000-0x000000000209D000-memory.dmp

Filesize
308KB

Download
memory/2940-34-0x0000000002050000-0x000000000209D000-memory.dmp

Filesize
308KB

Download
memory/2940-32-0x0000000002050000-0x000000000209D000-memory.dmp

Filesize
308KB

Download
memory/2940-30-0x0000000002050000-0x000000000209D000-memory.dmp

Filesize
308KB

Download
memory/2940-28-0x0000000002050000-0x000000000209D000-memory.dmp

Filesize
308KB

Download
memory/2940-26-0x0000000002050000-0x000000000209D000-memory.dmp

Filesize
308KB

Download
memory/2940-24-0x0000000002050000-0x000000000209D000-memory.dmp

Filesize
308KB

Download
memory/2940-22-0x0000000002050000-0x000000000209D000-memory.dmp

Filesize
308KB

Download
memory/2940-21-0x0000000002050000-0x000000000209D000-memory.dmp

Filesize
308KB

Download
memory/2940-50-0x0000000002050000-0x000000000209D000-memory.dmp

Filesize
308KB

Download
memory/2940-1052-0x00000000743D0000-0x0000000074ABE000-memory.dmp

Filesize
6.9MB

Download
memory/2940-1053-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2940-1054-0x00000000743DE000-0x00000000743DF000-memory.dmp

Filesize
4KB

Download
memory/2940-1055-0x00000000743D0000-0x0000000074ABE000-memory.dmp

Filesize
6.9MB

Download