Analysis
-
max time kernel
150s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
14-05-2024 15:03
General
-
Target
Factura Proforma Nº 2024000107.exe
-
Size
1.2MB
-
MD5
b1a93c951334dd187af4ab129e2729fc
-
SHA1
031ae853bb236ce49cf2db417e54d6b1cf994c79
-
SHA256
00fd3a2a4eb0b43e1b4c897cd57306ec6d3219d2241972350a211362ae33e5aa
-
SHA512
475eab0dfefb0575ab26b1c8c4ba3abbcc97854df45207f73ed2f4b9a224418afad1cfdccf0d95ef88c69311282516931808b9caccd2e0c6e64d7c3f07acbd7a
-
SSDEEP
24576:1qDEvCTbMWu7rQYlBQcBiT6rprG8aMsYQWACbIXiZy5NlD:1TvC/MTQYxsWR7aMYW8iw5z
Malware Config
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Detect ZGRat V1 33 IoCs
-
ZGRat
ZGRat is remote access trojan written in C#.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Factura Proforma Nº 2024000107.exe"C:\Users\Admin\AppData\Local\Temp\Factura Proforma Nº 2024000107.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\Factura Proforma Nº 2024000107.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
263KB
MD5ff69e5b87fc95975f561a198436ff13d
SHA1c7530be06a74881045428e4d8bf42b05205445d2
SHA256f943793eadc0fb8f6966cc9c1514f3d68ff194f387fb50290ae64d05db9aa423
SHA5122e5ffa05f06a056c138823726822a3c469ccd1aad29906c20e40c85d0194a99f081f4ecfe2ac73d54fdd2282f8b3b95b4b9fa47c950f3045a36fd862e19da723
-
Filesize
16KB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
4KB
-
Filesize
344KB
-
Filesize
7.7MB
-
Filesize
5.6MB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
336KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
408KB
-
Filesize
7.7MB
-
Filesize
320KB
-
Filesize
584KB
-
Filesize
40KB
-
Filesize
280KB
-
Filesize
4KB
-
Filesize
7.7MB