Analysis
- max time kernel
143s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
14/05/2024, 01:28
General
- Target 30d9436c07bab5fc9b6236526b21a448c7dfd75a08c1a09d8ba9a8753427817c.exe
- Size 686KB
- Sample240514-bvm8baec38
- SHA256 30d9436c07bab5fc9b6236526b21a448c7dfd75a08c1a09d8ba9a8753427817c
Malware Config
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Detect ZGRat V1 32 IoCs
- ZGRat
ZGRat is remote access trojan written in C#.
- UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 3 IoCs
- Suspicious use of SendNotifyMessage 3 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\30d9436c07bab5fc9b6236526b21a448c7dfd75a08c1a09d8ba9a8753427817c.exe"C:\Users\Admin\AppData\Local\Temp\30d9436c07bab5fc9b6236526b21a448c7dfd75a08c1a09d8ba9a8753427817c.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\30d9436c07bab5fc9b6236526b21a448c7dfd75a08c1a09d8ba9a8753427817c.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3920 --field-trial-handle=2692,i,8678872182442199182,12502579059484928042,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
autEC0.tmp
memory/724-56-0x0000000005250000-0x000000000529D000-memory.dmp
memory/724-1058-0x0000000005460000-0x00000000054C6000-memory.dmp
memory/724-16-0x0000000000400000-0x0000000000446000-memory.dmp
memory/724-18-0x0000000000400000-0x0000000000446000-memory.dmp
memory/724-20-0x00000000741EE000-0x00000000741EF000-memory.dmp
memory/724-21-0x0000000002A90000-0x0000000002AE4000-memory.dmp
memory/724-1064-0x00000000741E0000-0x0000000074990000-memory.dmp
memory/724-22-0x00000000741E0000-0x0000000074990000-memory.dmp
memory/724-23-0x00000000741E0000-0x0000000074990000-memory.dmp
memory/724-24-0x00000000741E0000-0x0000000074990000-memory.dmp
memory/724-25-0x0000000005860000-0x0000000005E04000-memory.dmp
memory/724-26-0x0000000005250000-0x00000000052A2000-memory.dmp
memory/724-52-0x0000000005250000-0x000000000529D000-memory.dmp
memory/724-34-0x0000000005250000-0x000000000529D000-memory.dmp
memory/724-85-0x0000000005250000-0x000000000529D000-memory.dmp
memory/724-82-0x0000000005250000-0x000000000529D000-memory.dmp
memory/724-78-0x0000000005250000-0x000000000529D000-memory.dmp
memory/724-74-0x0000000005250000-0x000000000529D000-memory.dmp
memory/724-72-0x0000000005250000-0x000000000529D000-memory.dmp
memory/724-70-0x0000000005250000-0x000000000529D000-memory.dmp
memory/724-68-0x0000000005250000-0x000000000529D000-memory.dmp
memory/724-64-0x0000000005250000-0x000000000529D000-memory.dmp
memory/724-62-0x0000000005250000-0x000000000529D000-memory.dmp
memory/724-61-0x0000000005250000-0x000000000529D000-memory.dmp
memory/724-15-0x0000000000400000-0x0000000000446000-memory.dmp
memory/724-58-0x0000000005250000-0x000000000529D000-memory.dmp
memory/724-30-0x0000000005250000-0x000000000529D000-memory.dmp
memory/724-51-0x0000000005250000-0x000000000529D000-memory.dmp
memory/724-48-0x0000000005250000-0x000000000529D000-memory.dmp
memory/724-44-0x0000000005250000-0x000000000529D000-memory.dmp
memory/724-42-0x0000000005250000-0x000000000529D000-memory.dmp
memory/724-40-0x0000000005250000-0x000000000529D000-memory.dmp
memory/724-38-0x0000000005250000-0x000000000529D000-memory.dmp
memory/724-36-0x0000000005250000-0x000000000529D000-memory.dmp
memory/724-32-0x0000000005250000-0x000000000529D000-memory.dmp
memory/724-80-0x0000000005250000-0x000000000529D000-memory.dmp
memory/724-76-0x0000000005250000-0x000000000529D000-memory.dmp
memory/724-66-0x0000000005250000-0x000000000529D000-memory.dmp
memory/724-54-0x0000000005250000-0x000000000529D000-memory.dmp
memory/724-46-0x0000000005250000-0x000000000529D000-memory.dmp
memory/724-28-0x0000000005250000-0x000000000529D000-memory.dmp
memory/724-27-0x0000000005250000-0x000000000529D000-memory.dmp
memory/724-1057-0x00000000741E0000-0x0000000074990000-memory.dmp
memory/724-14-0x0000000000400000-0x0000000000446000-memory.dmp
memory/724-1059-0x00000000067A0000-0x00000000067F0000-memory.dmp
memory/724-1060-0x0000000006890000-0x0000000006922000-memory.dmp
memory/724-1061-0x0000000006800000-0x000000000680A000-memory.dmp
memory/724-1062-0x0000000000400000-0x0000000000446000-memory.dmp
memory/724-1063-0x00000000741EE000-0x00000000741EF000-memory.dmp
memory/2388-0-0x0000000000DD0000-0x0000000000F54000-memory.dmp
memory/2388-13-0x00000000014D0000-0x00000000014D4000-memory.dmp
memory/2388-17-0x0000000000DD0000-0x0000000000F54000-memory.dmp