agenttesla | 30d9436c07bab5fc9b6236526b21a448c7dfd75a08c1a09d8ba9a8753427817c

General

Target

30d9436c07bab5fc9b6236526b21a448c7dfd75a08c1a09d8ba9a8753427817c.exe
Size

686KB
MD5

2237c68e4b9576839ecbe1591aa31612
SHA1

77e06b3b4bfc72fa26aa433ff34cbdf464fd7e8f
SHA256

30d9436c07bab5fc9b6236526b21a448c7dfd75a08c1a09d8ba9a8753427817c
SHA512

1ae5a65cc682375ef441e71df64aa1f4d42aeeaf6bc1bada7d4c34af6051cf105b6228e477fa770372f50162e32b5d083eedd50289f1bcc827a69a017c1b50d0
SSDEEP

12288:xYV6MorX7qzuC3QHO9FQVHPF51jgc4jY9ssfmFoVynnV2aXGNTiZB1QkM5:GBXu9HGaVH4USsf5QnUaSijDM5

Score

10^/10

agenttesla zgrat keylogger rat spyware stealer trojan upx

Malware Config

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Detect ZGRat V1 33 IoCs

Processes:

resource	yara_rule
behavioral1/memory/316-19-0x0000000001E10000-0x0000000001E64000-memory.dmp	family_zgrat_v1
behavioral1/memory/316-20-0x0000000001F30000-0x0000000001F82000-memory.dmp	family_zgrat_v1
behavioral1/memory/316-83-0x0000000001F30000-0x0000000001F7D000-memory.dmp	family_zgrat_v1
behavioral1/memory/316-81-0x0000000001F30000-0x0000000001F7D000-memory.dmp	family_zgrat_v1
behavioral1/memory/316-79-0x0000000001F30000-0x0000000001F7D000-memory.dmp	family_zgrat_v1
behavioral1/memory/316-77-0x0000000001F30000-0x0000000001F7D000-memory.dmp	family_zgrat_v1
behavioral1/memory/316-75-0x0000000001F30000-0x0000000001F7D000-memory.dmp	family_zgrat_v1
behavioral1/memory/316-73-0x0000000001F30000-0x0000000001F7D000-memory.dmp	family_zgrat_v1
behavioral1/memory/316-71-0x0000000001F30000-0x0000000001F7D000-memory.dmp	family_zgrat_v1
behavioral1/memory/316-69-0x0000000001F30000-0x0000000001F7D000-memory.dmp	family_zgrat_v1
behavioral1/memory/316-67-0x0000000001F30000-0x0000000001F7D000-memory.dmp	family_zgrat_v1
behavioral1/memory/316-65-0x0000000001F30000-0x0000000001F7D000-memory.dmp	family_zgrat_v1
behavioral1/memory/316-63-0x0000000001F30000-0x0000000001F7D000-memory.dmp	family_zgrat_v1
behavioral1/memory/316-61-0x0000000001F30000-0x0000000001F7D000-memory.dmp	family_zgrat_v1
behavioral1/memory/316-59-0x0000000001F30000-0x0000000001F7D000-memory.dmp	family_zgrat_v1
behavioral1/memory/316-57-0x0000000001F30000-0x0000000001F7D000-memory.dmp	family_zgrat_v1
behavioral1/memory/316-55-0x0000000001F30000-0x0000000001F7D000-memory.dmp	family_zgrat_v1
behavioral1/memory/316-53-0x0000000001F30000-0x0000000001F7D000-memory.dmp	family_zgrat_v1
behavioral1/memory/316-51-0x0000000001F30000-0x0000000001F7D000-memory.dmp	family_zgrat_v1
behavioral1/memory/316-49-0x0000000001F30000-0x0000000001F7D000-memory.dmp	family_zgrat_v1
behavioral1/memory/316-47-0x0000000001F30000-0x0000000001F7D000-memory.dmp	family_zgrat_v1
behavioral1/memory/316-45-0x0000000001F30000-0x0000000001F7D000-memory.dmp	family_zgrat_v1
behavioral1/memory/316-43-0x0000000001F30000-0x0000000001F7D000-memory.dmp	family_zgrat_v1
behavioral1/memory/316-41-0x0000000001F30000-0x0000000001F7D000-memory.dmp	family_zgrat_v1
behavioral1/memory/316-39-0x0000000001F30000-0x0000000001F7D000-memory.dmp	family_zgrat_v1
behavioral1/memory/316-37-0x0000000001F30000-0x0000000001F7D000-memory.dmp	family_zgrat_v1
behavioral1/memory/316-35-0x0000000001F30000-0x0000000001F7D000-memory.dmp	family_zgrat_v1
behavioral1/memory/316-33-0x0000000001F30000-0x0000000001F7D000-memory.dmp	family_zgrat_v1
behavioral1/memory/316-31-0x0000000001F30000-0x0000000001F7D000-memory.dmp	family_zgrat_v1
behavioral1/memory/316-29-0x0000000001F30000-0x0000000001F7D000-memory.dmp	family_zgrat_v1
behavioral1/memory/316-27-0x0000000001F30000-0x0000000001F7D000-memory.dmp	family_zgrat_v1
behavioral1/memory/316-25-0x0000000001F30000-0x0000000001F7D000-memory.dmp	family_zgrat_v1
behavioral1/memory/316-24-0x0000000001F30000-0x0000000001F7D000-memory.dmp	family_zgrat_v1

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2896-0-0x0000000000CD0000-0x0000000000E54000-memory.dmp	upx
behavioral1/memory/2896-17-0x0000000000CD0000-0x0000000000E54000-memory.dmp	upx

Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

2 api.ipify.org
3 api.ipify.org

flow	ioc
2	api.ipify.org
3	api.ipify.org

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
behavioral1/memory/2896-17-0x0000000000CD0000-0x0000000000E54000-memory.dmp	autoit_exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

30d9436c07bab5fc9b6236526b21a448c7dfd75a08c1a09d8ba9a8753427817c.exe

description	pid	process	target process
PID 2896 set thread context of 316	2896	30d9436c07bab5fc9b6236526b21a448c7dfd75a08c1a09d8ba9a8753427817c.exe	RegSvcs.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

RegSvcs.exe

pid process

316 RegSvcs.exe
316 RegSvcs.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

30d9436c07bab5fc9b6236526b21a448c7dfd75a08c1a09d8ba9a8753427817c.exe

pid process

2896 30d9436c07bab5fc9b6236526b21a448c7dfd75a08c1a09d8ba9a8753427817c.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RegSvcs.exe

description pid process

Token: SeDebugPrivilege 316 RegSvcs.exe

pid	process
316	RegSvcs.exe
316	RegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	316	RegSvcs.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

30d9436c07bab5fc9b6236526b21a448c7dfd75a08c1a09d8ba9a8753427817c.exe

pid	process
2896	30d9436c07bab5fc9b6236526b21a448c7dfd75a08c1a09d8ba9a8753427817c.exe
2896	30d9436c07bab5fc9b6236526b21a448c7dfd75a08c1a09d8ba9a8753427817c.exe

Suspicious use of SendNotifyMessage 2 IoCs

Processes:

30d9436c07bab5fc9b6236526b21a448c7dfd75a08c1a09d8ba9a8753427817c.exe

pid	process
2896	30d9436c07bab5fc9b6236526b21a448c7dfd75a08c1a09d8ba9a8753427817c.exe
2896	30d9436c07bab5fc9b6236526b21a448c7dfd75a08c1a09d8ba9a8753427817c.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

30d9436c07bab5fc9b6236526b21a448c7dfd75a08c1a09d8ba9a8753427817c.exe

description	pid	process	target process
PID 2896 wrote to memory of 316	2896	30d9436c07bab5fc9b6236526b21a448c7dfd75a08c1a09d8ba9a8753427817c.exe	RegSvcs.exe
PID 2896 wrote to memory of 316	2896	30d9436c07bab5fc9b6236526b21a448c7dfd75a08c1a09d8ba9a8753427817c.exe	RegSvcs.exe
PID 2896 wrote to memory of 316	2896	30d9436c07bab5fc9b6236526b21a448c7dfd75a08c1a09d8ba9a8753427817c.exe	RegSvcs.exe
PID 2896 wrote to memory of 316	2896	30d9436c07bab5fc9b6236526b21a448c7dfd75a08c1a09d8ba9a8753427817c.exe	RegSvcs.exe
PID 2896 wrote to memory of 316	2896	30d9436c07bab5fc9b6236526b21a448c7dfd75a08c1a09d8ba9a8753427817c.exe	RegSvcs.exe
PID 2896 wrote to memory of 316	2896	30d9436c07bab5fc9b6236526b21a448c7dfd75a08c1a09d8ba9a8753427817c.exe	RegSvcs.exe
PID 2896 wrote to memory of 316	2896	30d9436c07bab5fc9b6236526b21a448c7dfd75a08c1a09d8ba9a8753427817c.exe	RegSvcs.exe
PID 2896 wrote to memory of 316	2896	30d9436c07bab5fc9b6236526b21a448c7dfd75a08c1a09d8ba9a8753427817c.exe	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\30d9436c07bab5fc9b6236526b21a448c7dfd75a08c1a09d8ba9a8753427817c.exe
"C:\Users\Admin\AppData\Local\Temp\30d9436c07bab5fc9b6236526b21a448c7dfd75a08c1a09d8ba9a8753427817c.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2896

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Users\Admin\AppData\Local\Temp\30d9436c07bab5fc9b6236526b21a448c7dfd75a08c1a09d8ba9a8753427817c.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:316

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Anglophile
Filesize
261KB

MD5
bcfd59c3fa5a1f81cb2a6e3ac5e362a5

SHA1
05e762186d56b75693c1cf3fd6d91501a6bf04ac

SHA256
7d966cf0b4ac3d0090a03c10cacad959e3546ee846ffede62a57c020b88f8ce6

SHA512
f97f457b17971d43628631faf04b7162458bcec271e767d57da54e13e73dadbedbe2c9cdc4521211e1f7dc34f300fc4f5f3ab5c2ee27ac5df342aea5782e412a

Download Submit
memory/316-61-0x0000000001F30000-0x0000000001F7D000-memory.dmp

Filesize
308KB

Download
memory/316-25-0x0000000001F30000-0x0000000001F7D000-memory.dmp

Filesize
308KB

Download
memory/316-15-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/316-16-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/316-14-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/316-1057-0x00000000741E0000-0x00000000748CE000-memory.dmp

Filesize
6.9MB

Download
memory/316-18-0x00000000741EE000-0x00000000741EF000-memory.dmp

Filesize
4KB

Download
memory/316-19-0x0000000001E10000-0x0000000001E64000-memory.dmp

Filesize
336KB

Download
memory/316-20-0x0000000001F30000-0x0000000001F82000-memory.dmp

Filesize
328KB

Download
memory/316-21-0x00000000741E0000-0x00000000748CE000-memory.dmp

Filesize
6.9MB

Download
memory/316-22-0x00000000741E0000-0x00000000748CE000-memory.dmp

Filesize
6.9MB

Download
memory/316-23-0x00000000741E0000-0x00000000748CE000-memory.dmp

Filesize
6.9MB

Download
memory/316-83-0x0000000001F30000-0x0000000001F7D000-memory.dmp

Filesize
308KB

Download
memory/316-81-0x0000000001F30000-0x0000000001F7D000-memory.dmp

Filesize
308KB

Download
memory/316-79-0x0000000001F30000-0x0000000001F7D000-memory.dmp

Filesize
308KB

Download
memory/316-77-0x0000000001F30000-0x0000000001F7D000-memory.dmp

Filesize
308KB

Download
memory/316-75-0x0000000001F30000-0x0000000001F7D000-memory.dmp

Filesize
308KB

Download
memory/316-73-0x0000000001F30000-0x0000000001F7D000-memory.dmp

Filesize
308KB

Download
memory/316-71-0x0000000001F30000-0x0000000001F7D000-memory.dmp

Filesize
308KB

Download
memory/316-69-0x0000000001F30000-0x0000000001F7D000-memory.dmp

Filesize
308KB

Download
memory/316-67-0x0000000001F30000-0x0000000001F7D000-memory.dmp

Filesize
308KB

Download
memory/316-65-0x0000000001F30000-0x0000000001F7D000-memory.dmp

Filesize
308KB

Download
memory/316-1056-0x00000000741EE000-0x00000000741EF000-memory.dmp

Filesize
4KB

Download
memory/316-63-0x0000000001F30000-0x0000000001F7D000-memory.dmp

Filesize
308KB

Download
memory/316-53-0x0000000001F30000-0x0000000001F7D000-memory.dmp

Filesize
308KB

Download
memory/316-57-0x0000000001F30000-0x0000000001F7D000-memory.dmp

Filesize
308KB

Download
memory/316-55-0x0000000001F30000-0x0000000001F7D000-memory.dmp

Filesize
308KB

Download
memory/316-59-0x0000000001F30000-0x0000000001F7D000-memory.dmp

Filesize
308KB

Download
memory/316-51-0x0000000001F30000-0x0000000001F7D000-memory.dmp

Filesize
308KB

Download
memory/316-49-0x0000000001F30000-0x0000000001F7D000-memory.dmp

Filesize
308KB

Download
memory/316-47-0x0000000001F30000-0x0000000001F7D000-memory.dmp

Filesize
308KB

Download
memory/316-45-0x0000000001F30000-0x0000000001F7D000-memory.dmp

Filesize
308KB

Download
memory/316-43-0x0000000001F30000-0x0000000001F7D000-memory.dmp

Filesize
308KB

Download
memory/316-41-0x0000000001F30000-0x0000000001F7D000-memory.dmp

Filesize
308KB

Download
memory/316-39-0x0000000001F30000-0x0000000001F7D000-memory.dmp

Filesize
308KB

Download
memory/316-37-0x0000000001F30000-0x0000000001F7D000-memory.dmp

Filesize
308KB

Download
memory/316-35-0x0000000001F30000-0x0000000001F7D000-memory.dmp

Filesize
308KB

Download
memory/316-33-0x0000000001F30000-0x0000000001F7D000-memory.dmp

Filesize
308KB

Download
memory/316-31-0x0000000001F30000-0x0000000001F7D000-memory.dmp

Filesize
308KB

Download
memory/316-29-0x0000000001F30000-0x0000000001F7D000-memory.dmp

Filesize
308KB

Download
memory/316-27-0x0000000001F30000-0x0000000001F7D000-memory.dmp

Filesize
308KB

Download
memory/316-1055-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/316-24-0x0000000001F30000-0x0000000001F7D000-memory.dmp

Filesize
308KB

Download
memory/316-1054-0x00000000741E0000-0x00000000748CE000-memory.dmp

Filesize
6.9MB

Download
memory/2896-0-0x0000000000CD0000-0x0000000000E54000-memory.dmp

Filesize
1.5MB

Download
memory/2896-12-0x0000000000240000-0x0000000000244000-memory.dmp

Filesize
16KB

Download
memory/2896-17-0x0000000000CD0000-0x0000000000E54000-memory.dmp

Filesize
1.5MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads