agenttesla | 94e1fa2f5b070f90258e2f9b2cdbaa6f71a68d1b39b912bd81c73b270142e7aa

General

Target

QUOTATION_MAYQTRA031244PDF.scr
Size

470KB
MD5

d7f47119b95818996e519dde8edb6966
SHA1

dd2639542a81ffebee5ab324fc67a9ff5a983c41
SHA256

e92379e6ddeb7505921a28d344b676df85848f13b7795362ef0732b456ab0ca7
SHA512

e80cfb790baa9ea3eedf5f4b7ca9ebcac0aa4f7e8d18ace5eeedf66e45fa85b1ab5b47529a6d6174f6920a660519d6a391a22a33c817ae2a2a3da6fc9646bf6e
SSDEEP

3072:hVnfM+ySEWMJ1yNzU5+Sicyjxh4H444lM:h6AzWiTf4H444l

Score

10^/10

agenttesla zgrat keylogger rat spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
gator3220.hostgator.com
Port:
587
Username:
[email protected]
Password:
PDMgpFaraDAY%@@
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Detect ZGRat V1 34 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4772-3-0x0000000008DA0000-0x0000000008FD0000-memory.dmp	family_zgrat_v1
behavioral2/memory/4772-6-0x0000000008DA0000-0x0000000008FCA000-memory.dmp	family_zgrat_v1
behavioral2/memory/4772-15-0x0000000008DA0000-0x0000000008FCA000-memory.dmp	family_zgrat_v1
behavioral2/memory/4772-17-0x0000000008DA0000-0x0000000008FCA000-memory.dmp	family_zgrat_v1
behavioral2/memory/4772-43-0x0000000008DA0000-0x0000000008FCA000-memory.dmp	family_zgrat_v1
behavioral2/memory/4772-41-0x0000000008DA0000-0x0000000008FCA000-memory.dmp	family_zgrat_v1
behavioral2/memory/4772-55-0x0000000008DA0000-0x0000000008FCA000-memory.dmp	family_zgrat_v1
behavioral2/memory/4772-69-0x0000000008DA0000-0x0000000008FCA000-memory.dmp	family_zgrat_v1
behavioral2/memory/4772-67-0x0000000008DA0000-0x0000000008FCA000-memory.dmp	family_zgrat_v1
behavioral2/memory/4772-65-0x0000000008DA0000-0x0000000008FCA000-memory.dmp	family_zgrat_v1
behavioral2/memory/4772-63-0x0000000008DA0000-0x0000000008FCA000-memory.dmp	family_zgrat_v1
behavioral2/memory/4772-61-0x0000000008DA0000-0x0000000008FCA000-memory.dmp	family_zgrat_v1
behavioral2/memory/4772-59-0x0000000008DA0000-0x0000000008FCA000-memory.dmp	family_zgrat_v1
behavioral2/memory/4772-57-0x0000000008DA0000-0x0000000008FCA000-memory.dmp	family_zgrat_v1
behavioral2/memory/4772-53-0x0000000008DA0000-0x0000000008FCA000-memory.dmp	family_zgrat_v1
behavioral2/memory/4772-51-0x0000000008DA0000-0x0000000008FCA000-memory.dmp	family_zgrat_v1
behavioral2/memory/4772-49-0x0000000008DA0000-0x0000000008FCA000-memory.dmp	family_zgrat_v1
behavioral2/memory/4772-47-0x0000000008DA0000-0x0000000008FCA000-memory.dmp	family_zgrat_v1
behavioral2/memory/4772-45-0x0000000008DA0000-0x0000000008FCA000-memory.dmp	family_zgrat_v1
behavioral2/memory/4772-39-0x0000000008DA0000-0x0000000008FCA000-memory.dmp	family_zgrat_v1
behavioral2/memory/4772-37-0x0000000008DA0000-0x0000000008FCA000-memory.dmp	family_zgrat_v1
behavioral2/memory/4772-35-0x0000000008DA0000-0x0000000008FCA000-memory.dmp	family_zgrat_v1
behavioral2/memory/4772-33-0x0000000008DA0000-0x0000000008FCA000-memory.dmp	family_zgrat_v1
behavioral2/memory/4772-31-0x0000000008DA0000-0x0000000008FCA000-memory.dmp	family_zgrat_v1
behavioral2/memory/4772-29-0x0000000008DA0000-0x0000000008FCA000-memory.dmp	family_zgrat_v1
behavioral2/memory/4772-27-0x0000000008DA0000-0x0000000008FCA000-memory.dmp	family_zgrat_v1
behavioral2/memory/4772-25-0x0000000008DA0000-0x0000000008FCA000-memory.dmp	family_zgrat_v1
behavioral2/memory/4772-21-0x0000000008DA0000-0x0000000008FCA000-memory.dmp	family_zgrat_v1
behavioral2/memory/4772-23-0x0000000008DA0000-0x0000000008FCA000-memory.dmp	family_zgrat_v1
behavioral2/memory/4772-19-0x0000000008DA0000-0x0000000008FCA000-memory.dmp	family_zgrat_v1
behavioral2/memory/4772-13-0x0000000008DA0000-0x0000000008FCA000-memory.dmp	family_zgrat_v1
behavioral2/memory/4772-11-0x0000000008DA0000-0x0000000008FCA000-memory.dmp	family_zgrat_v1
behavioral2/memory/4772-9-0x0000000008DA0000-0x0000000008FCA000-memory.dmp	family_zgrat_v1
behavioral2/memory/4772-7-0x0000000008DA0000-0x0000000008FCA000-memory.dmp	family_zgrat_v1

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

58 ip-api.com
Suspicious use of SetThreadContext 1 IoCs

Processes:

QUOTATION_MAYQTRA031244PDF.scr

description pid process target process

PID 4772 set thread context of 816 4772 QUOTATION_MAYQTRA031244PDF.scr aspnet_compiler.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

aspnet_compiler.exe

pid process

816 aspnet_compiler.exe
816 aspnet_compiler.exe

flow	ioc
58	ip-api.com

description	pid	process	target process
PID 4772 set thread context of 816	4772	QUOTATION_MAYQTRA031244PDF.scr	aspnet_compiler.exe

pid	process
816	aspnet_compiler.exe
816	aspnet_compiler.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

QUOTATION_MAYQTRA031244PDF.scraspnet_compiler.exe

description	pid	process
Token: SeDebugPrivilege	4772	QUOTATION_MAYQTRA031244PDF.scr
Token: SeDebugPrivilege	4772	QUOTATION_MAYQTRA031244PDF.scr
Token: SeDebugPrivilege	816	aspnet_compiler.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

aspnet_compiler.exe

pid process

816 aspnet_compiler.exe

pid	process
816	aspnet_compiler.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

QUOTATION_MAYQTRA031244PDF.scr

description	pid	process	target process
PID 4772 wrote to memory of 816	4772	QUOTATION_MAYQTRA031244PDF.scr	aspnet_compiler.exe
PID 4772 wrote to memory of 816	4772	QUOTATION_MAYQTRA031244PDF.scr	aspnet_compiler.exe
PID 4772 wrote to memory of 816	4772	QUOTATION_MAYQTRA031244PDF.scr	aspnet_compiler.exe
PID 4772 wrote to memory of 816	4772	QUOTATION_MAYQTRA031244PDF.scr	aspnet_compiler.exe
PID 4772 wrote to memory of 816	4772	QUOTATION_MAYQTRA031244PDF.scr	aspnet_compiler.exe
PID 4772 wrote to memory of 816	4772	QUOTATION_MAYQTRA031244PDF.scr	aspnet_compiler.exe
PID 4772 wrote to memory of 816	4772	QUOTATION_MAYQTRA031244PDF.scr	aspnet_compiler.exe
PID 4772 wrote to memory of 816	4772	QUOTATION_MAYQTRA031244PDF.scr	aspnet_compiler.exe

C:\Users\Admin\AppData\Local\Temp\QUOTATION_MAYQTRA031244PDF.scr
"C:\Users\Admin\AppData\Local\Temp\QUOTATION_MAYQTRA031244PDF.scr" /S
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4772

C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:816

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/816-4896-0x0000000074ED0000-0x0000000075680000-memory.dmp

Filesize
7.7MB

Download
memory/816-4897-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/816-4898-0x0000000074ED0000-0x0000000075680000-memory.dmp

Filesize
7.7MB

Download
memory/816-4899-0x0000000006300000-0x0000000006350000-memory.dmp

Filesize
320KB

Download
memory/816-4900-0x0000000006580000-0x000000000658A000-memory.dmp

Filesize
40KB

Download
memory/816-4901-0x0000000074ED0000-0x0000000075680000-memory.dmp

Filesize
7.7MB

Download
memory/4772-49-0x0000000008DA0000-0x0000000008FCA000-memory.dmp

Filesize
2.2MB

Download
memory/4772-39-0x0000000008DA0000-0x0000000008FCA000-memory.dmp

Filesize
2.2MB

Download
memory/4772-3-0x0000000008DA0000-0x0000000008FD0000-memory.dmp

Filesize
2.2MB

Download
memory/4772-4-0x0000000009580000-0x0000000009B24000-memory.dmp

Filesize
5.6MB

Download
memory/4772-5-0x0000000009070000-0x0000000009102000-memory.dmp

Filesize
584KB

Download
memory/4772-6-0x0000000008DA0000-0x0000000008FCA000-memory.dmp

Filesize
2.2MB

Download
memory/4772-15-0x0000000008DA0000-0x0000000008FCA000-memory.dmp

Filesize
2.2MB

Download
memory/4772-17-0x0000000008DA0000-0x0000000008FCA000-memory.dmp

Filesize
2.2MB

Download
memory/4772-43-0x0000000008DA0000-0x0000000008FCA000-memory.dmp

Filesize
2.2MB

Download
memory/4772-41-0x0000000008DA0000-0x0000000008FCA000-memory.dmp

Filesize
2.2MB

Download
memory/4772-55-0x0000000008DA0000-0x0000000008FCA000-memory.dmp

Filesize
2.2MB

Download
memory/4772-69-0x0000000008DA0000-0x0000000008FCA000-memory.dmp

Filesize
2.2MB

Download
memory/4772-67-0x0000000008DA0000-0x0000000008FCA000-memory.dmp

Filesize
2.2MB

Download
memory/4772-65-0x0000000008DA0000-0x0000000008FCA000-memory.dmp

Filesize
2.2MB

Download
memory/4772-63-0x0000000008DA0000-0x0000000008FCA000-memory.dmp

Filesize
2.2MB

Download
memory/4772-61-0x0000000008DA0000-0x0000000008FCA000-memory.dmp

Filesize
2.2MB

Download
memory/4772-59-0x0000000008DA0000-0x0000000008FCA000-memory.dmp

Filesize
2.2MB

Download
memory/4772-57-0x0000000008DA0000-0x0000000008FCA000-memory.dmp

Filesize
2.2MB

Download
memory/4772-53-0x0000000008DA0000-0x0000000008FCA000-memory.dmp

Filesize
2.2MB

Download
memory/4772-51-0x0000000008DA0000-0x0000000008FCA000-memory.dmp

Filesize
2.2MB

Download
memory/4772-1-0x0000000000D20000-0x0000000000D9C000-memory.dmp

Filesize
496KB

Download
memory/4772-47-0x0000000008DA0000-0x0000000008FCA000-memory.dmp

Filesize
2.2MB

Download
memory/4772-45-0x0000000008DA0000-0x0000000008FCA000-memory.dmp

Filesize
2.2MB

Download
memory/4772-2-0x0000000074ED0000-0x0000000075680000-memory.dmp

Filesize
7.7MB

Download
memory/4772-37-0x0000000008DA0000-0x0000000008FCA000-memory.dmp

Filesize
2.2MB

Download
memory/4772-35-0x0000000008DA0000-0x0000000008FCA000-memory.dmp

Filesize
2.2MB

Download
memory/4772-33-0x0000000008DA0000-0x0000000008FCA000-memory.dmp

Filesize
2.2MB

Download
memory/4772-31-0x0000000008DA0000-0x0000000008FCA000-memory.dmp

Filesize
2.2MB

Download
memory/4772-29-0x0000000008DA0000-0x0000000008FCA000-memory.dmp

Filesize
2.2MB

Download
memory/4772-27-0x0000000008DA0000-0x0000000008FCA000-memory.dmp

Filesize
2.2MB

Download
memory/4772-25-0x0000000008DA0000-0x0000000008FCA000-memory.dmp

Filesize
2.2MB

Download
memory/4772-21-0x0000000008DA0000-0x0000000008FCA000-memory.dmp

Filesize
2.2MB

Download
memory/4772-23-0x0000000008DA0000-0x0000000008FCA000-memory.dmp

Filesize
2.2MB

Download
memory/4772-19-0x0000000008DA0000-0x0000000008FCA000-memory.dmp

Filesize
2.2MB

Download
memory/4772-13-0x0000000008DA0000-0x0000000008FCA000-memory.dmp

Filesize
2.2MB

Download
memory/4772-11-0x0000000008DA0000-0x0000000008FCA000-memory.dmp

Filesize
2.2MB

Download
memory/4772-9-0x0000000008DA0000-0x0000000008FCA000-memory.dmp

Filesize
2.2MB

Download
memory/4772-7-0x0000000008DA0000-0x0000000008FCA000-memory.dmp

Filesize
2.2MB

Download
memory/4772-4886-0x0000000074ED0000-0x0000000075680000-memory.dmp

Filesize
7.7MB

Download
memory/4772-4888-0x0000000005E50000-0x0000000005E9C000-memory.dmp

Filesize
304KB

Download
memory/4772-4887-0x0000000005FA0000-0x000000000600C000-memory.dmp

Filesize
432KB

Download
memory/4772-4889-0x0000000006380000-0x00000000063E6000-memory.dmp

Filesize
408KB

Download
memory/4772-0-0x0000000074EDE000-0x0000000074EDF000-memory.dmp

Filesize
4KB

Download
memory/4772-4890-0x0000000074EDE000-0x0000000074EDF000-memory.dmp

Filesize
4KB

Download
memory/4772-4891-0x0000000074ED0000-0x0000000075680000-memory.dmp

Filesize
7.7MB

Download
memory/4772-4892-0x0000000001190000-0x00000000011E4000-memory.dmp

Filesize
336KB

Download
memory/4772-4895-0x0000000074ED0000-0x0000000075680000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads