Analysis
-
max time kernel
106s -
max time network
108s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
14-05-2024 01:48
General
-
Target
f7c0471a702e24c7de7f214a24905704c6783043eab48c4b5a1eb347d846e952.exe
-
Size
664KB
-
MD5
ab7958eb77b1cb9aadfe366da2092027
-
SHA1
0399ef1e6468abea364ba97fc2ce58a20617b764
-
SHA256
f7c0471a702e24c7de7f214a24905704c6783043eab48c4b5a1eb347d846e952
-
SHA512
aae1bffd4c3652d4800e5939c8a19c02e89335353a6ff891a88e3cbaad7db36a99c5e8d64df0f44857ff464cddda05afe971630ab0c92522d9656f8763b77901
-
SSDEEP
12288:/Xe9PPlowWX0t6mOQwg1Qd15CcYk0We1FTjp7rBHguWJq/GuY4C0qZivK539a5ZP:GhloDX0XOf4X5BxWJq8Cxu9a5Z9WFm
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot6706700909:AAF84XSqJERRA6jKqejEqGMhCkiDguB_-5E/
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Detect ZGRat V1 33 IoCs
-
ZGRat
ZGRat is remote access trojan written in C#.
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f7c0471a702e24c7de7f214a24905704c6783043eab48c4b5a1eb347d846e952.exe"C:\Users\Admin\AppData\Local\Temp\f7c0471a702e24c7de7f214a24905704c6783043eab48c4b5a1eb347d846e952.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\f7c0471a702e24c7de7f214a24905704c6783043eab48c4b5a1eb347d846e952.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
261KB
MD592bf5c932c8e6fb630d70fcd8ce9cb60
SHA1dcf0c7f342c238a2d9f0bd0e8c87c413dd9e85b2
SHA25695cb577726c0f4ce99819e0224a933805ac27b2f02c109d76f8e7999f170ad93
SHA51219739f6f1d564be453975d614e2a7cbf4bfe9ab28666c463e260d93e2372b4a262533a362806770714d4c0a8d02170c55bd4bfa797dd22ae2e362e4a7f19f621
-
Filesize
308KB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
308KB
-
Filesize
280KB
-
Filesize
4KB
-
Filesize
336KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
5.6MB
-
Filesize
328KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
7.7MB
-
Filesize
308KB
-
Filesize
280KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
408KB
-
Filesize
7.7MB
-
Filesize
320KB
-
Filesize
584KB
-
Filesize
40KB
-
Filesize
280KB
-
Filesize
4KB
-
Filesize
1.5MB
-
Filesize
16KB
-
Filesize
1.5MB