Analysis
-
max time kernel
118s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
14-05-2024 15:02
General
-
Target
QUOTATION_MAYQTRA031244PDF.scr
-
Size
470KB
-
MD5
d7f47119b95818996e519dde8edb6966
-
SHA1
dd2639542a81ffebee5ab324fc67a9ff5a983c41
-
SHA256
e92379e6ddeb7505921a28d344b676df85848f13b7795362ef0732b456ab0ca7
-
SHA512
e80cfb790baa9ea3eedf5f4b7ca9ebcac0aa4f7e8d18ace5eeedf66e45fa85b1ab5b47529a6d6174f6920a660519d6a391a22a33c817ae2a2a3da6fc9646bf6e
-
SSDEEP
3072:hVnfM+ySEWMJ1yNzU5+Sicyjxh4H444lM:h6AzWiTf4H444l
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
gator3220.hostgator.com - Port:
587 - Username:
[email protected] - Password:
PDMgpFaraDAY%@@ - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Detect ZGRat V1 34 IoCs
-
ZGRat
ZGRat is remote access trojan written in C#.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext 1 IoCs
-
Modifies system certificate store 2 TTPs 6 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\QUOTATION_MAYQTRA031244PDF.scr"C:\Users\Admin\AppData\Local\Temp\QUOTATION_MAYQTRA031244PDF.scr" /S1⤵
- Suspicious use of SetThreadContext
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
Filesize
344B
MD5dd1e694b04783967b9fb393d635cda7b
SHA1ca7b39e19da7c86f160aaca83b46257c2d1dab46
SHA256a9213b45b3977b186b4b14db979c1c0587dbb512754736718c5dc468c5f56132
SHA5125c9410529e621dd89a3f7c1a756a8e2d1ea56f53ffa649639b22a6cb6cd3dcd852ec1a52d90528c9851aa33743ee794a6d987d781280c07f256ae609f85115ce
-
Filesize
242B
MD5eae95f364d61b827eca8c6b268a4e1d5
SHA1d1a2c486331ad3d938092b378a17748ff57d2ae8
SHA256cd6182fc78644ea72be58c22634713dc36030f240daa4a78f5480ca6a422630a
SHA51201c2f6c59033e6b7567584c66415e2c87e611626e7b14aaf34398eed5f2aa6b3e9cd4981386ebca61534e68114fd5092506666980ff33b5f751983f2a69eeedc
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
6.9MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
4KB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
496KB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
6.9MB
-
Filesize
304KB
-
Filesize
432KB
-
Filesize
4KB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
336KB
-
Filesize
6.9MB
-
Filesize
264KB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
6.9MB