agenttesla | e623db7ce7f2a3ddd3e5b4571f75a4b20b4fd69d8680d19a4e6506730ee2c81d

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
15-05-2024 11:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

MT_078410_00_032.exe
Size

2.4MB
MD5

765a94a7bedd69fb57e562b5c6537db9
SHA1

bd62eccc3009b043512aa2e6a1297875c613760e
SHA256

e623db7ce7f2a3ddd3e5b4571f75a4b20b4fd69d8680d19a4e6506730ee2c81d
SHA512

ea2fb18aeebd2038d9db10d75023ed747802ccd2bf20163cce4a89be26113f08a019c9e19088747bc182ca4317390bb2b50ff01cb6fd52361ff2c16219673f91
SSDEEP

49152:rd1ccJyl0yJDpXoYir/atre3KGthcMrXcdLobjrXGGS:rJO0G54+K3KGthVrEL3GS

Score

10^/10

agenttesla zgrat keylogger persistence rat spyware stealer trojan

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
66.29.151.236
Port:
587
Username:
[email protected]
Password:
d9GOyTceXsMT

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
66.29.151.236
Port:
587
Username:
[email protected]
Password:
d9GOyTceXsMT
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Detect ZGRat V1 34 IoCs

Processes:

resource	yara_rule
behavioral2/memory/380-2-0x0000000004FA0000-0x00000000051D0000-memory.dmp	family_zgrat_v1
behavioral2/memory/380-14-0x0000000004FA0000-0x00000000051CB000-memory.dmp	family_zgrat_v1
behavioral2/memory/380-16-0x0000000004FA0000-0x00000000051CB000-memory.dmp	family_zgrat_v1
behavioral2/memory/380-28-0x0000000004FA0000-0x00000000051CB000-memory.dmp	family_zgrat_v1
behavioral2/memory/380-34-0x0000000004FA0000-0x00000000051CB000-memory.dmp	family_zgrat_v1
behavioral2/memory/380-32-0x0000000004FA0000-0x00000000051CB000-memory.dmp	family_zgrat_v1
behavioral2/memory/380-60-0x0000000004FA0000-0x00000000051CB000-memory.dmp	family_zgrat_v1
behavioral2/memory/380-68-0x0000000004FA0000-0x00000000051CB000-memory.dmp	family_zgrat_v1
behavioral2/memory/380-66-0x0000000004FA0000-0x00000000051CB000-memory.dmp	family_zgrat_v1
behavioral2/memory/380-64-0x0000000004FA0000-0x00000000051CB000-memory.dmp	family_zgrat_v1
behavioral2/memory/380-62-0x0000000004FA0000-0x00000000051CB000-memory.dmp	family_zgrat_v1
behavioral2/memory/380-58-0x0000000004FA0000-0x00000000051CB000-memory.dmp	family_zgrat_v1
behavioral2/memory/380-56-0x0000000004FA0000-0x00000000051CB000-memory.dmp	family_zgrat_v1
behavioral2/memory/380-54-0x0000000004FA0000-0x00000000051CB000-memory.dmp	family_zgrat_v1
behavioral2/memory/380-52-0x0000000004FA0000-0x00000000051CB000-memory.dmp	family_zgrat_v1
behavioral2/memory/380-50-0x0000000004FA0000-0x00000000051CB000-memory.dmp	family_zgrat_v1
behavioral2/memory/380-46-0x0000000004FA0000-0x00000000051CB000-memory.dmp	family_zgrat_v1
behavioral2/memory/380-44-0x0000000004FA0000-0x00000000051CB000-memory.dmp	family_zgrat_v1
behavioral2/memory/380-42-0x0000000004FA0000-0x00000000051CB000-memory.dmp	family_zgrat_v1
behavioral2/memory/380-40-0x0000000004FA0000-0x00000000051CB000-memory.dmp	family_zgrat_v1
behavioral2/memory/380-38-0x0000000004FA0000-0x00000000051CB000-memory.dmp	family_zgrat_v1
behavioral2/memory/380-48-0x0000000004FA0000-0x00000000051CB000-memory.dmp	family_zgrat_v1
behavioral2/memory/380-30-0x0000000004FA0000-0x00000000051CB000-memory.dmp	family_zgrat_v1
behavioral2/memory/380-36-0x0000000004FA0000-0x00000000051CB000-memory.dmp	family_zgrat_v1
behavioral2/memory/380-26-0x0000000004FA0000-0x00000000051CB000-memory.dmp	family_zgrat_v1
behavioral2/memory/380-24-0x0000000004FA0000-0x00000000051CB000-memory.dmp	family_zgrat_v1
behavioral2/memory/380-22-0x0000000004FA0000-0x00000000051CB000-memory.dmp	family_zgrat_v1
behavioral2/memory/380-20-0x0000000004FA0000-0x00000000051CB000-memory.dmp	family_zgrat_v1
behavioral2/memory/380-18-0x0000000004FA0000-0x00000000051CB000-memory.dmp	family_zgrat_v1
behavioral2/memory/380-13-0x0000000004FA0000-0x00000000051CB000-memory.dmp	family_zgrat_v1
behavioral2/memory/380-10-0x0000000004FA0000-0x00000000051CB000-memory.dmp	family_zgrat_v1
behavioral2/memory/380-8-0x0000000004FA0000-0x00000000051CB000-memory.dmp	family_zgrat_v1
behavioral2/memory/380-6-0x0000000004FA0000-0x00000000051CB000-memory.dmp	family_zgrat_v1
behavioral2/memory/380-5-0x0000000004FA0000-0x00000000051CB000-memory.dmp	family_zgrat_v1

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

MT_078410_00_032.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kcsof = "C:\\Users\\Admin\\AppData\\Roaming\\kcsof.exe"	MT_078410_00_032.exe

Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

31 ip-api.com
29 api.ipify.org
30 api.ipify.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

MT_078410_00_032.exe

description pid process target process

PID 380 set thread context of 4772 380 MT_078410_00_032.exe MT_078410_00_032.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

MT_078410_00_032.exe

pid process

4772 MT_078410_00_032.exe
4772 MT_078410_00_032.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

MT_078410_00_032.exeMT_078410_00_032.exe

description pid process

Token: SeDebugPrivilege 380 MT_078410_00_032.exe
Token: SeDebugPrivilege 380 MT_078410_00_032.exe
Token: SeDebugPrivilege 4772 MT_078410_00_032.exe

flow	ioc
31	ip-api.com
29	api.ipify.org
30	api.ipify.org

description	pid	process	target process
PID 380 set thread context of 4772	380	MT_078410_00_032.exe	MT_078410_00_032.exe

pid	process
4772	MT_078410_00_032.exe
4772	MT_078410_00_032.exe

description	pid	process
Token: SeDebugPrivilege	380	MT_078410_00_032.exe
Token: SeDebugPrivilege	380	MT_078410_00_032.exe
Token: SeDebugPrivilege	4772	MT_078410_00_032.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

MT_078410_00_032.exe

description	pid	process	target process
PID 380 wrote to memory of 4772	380	MT_078410_00_032.exe	MT_078410_00_032.exe
PID 380 wrote to memory of 4772	380	MT_078410_00_032.exe	MT_078410_00_032.exe
PID 380 wrote to memory of 4772	380	MT_078410_00_032.exe	MT_078410_00_032.exe
PID 380 wrote to memory of 4772	380	MT_078410_00_032.exe	MT_078410_00_032.exe
PID 380 wrote to memory of 4772	380	MT_078410_00_032.exe	MT_078410_00_032.exe
PID 380 wrote to memory of 4772	380	MT_078410_00_032.exe	MT_078410_00_032.exe
PID 380 wrote to memory of 4772	380	MT_078410_00_032.exe	MT_078410_00_032.exe
PID 380 wrote to memory of 4772	380	MT_078410_00_032.exe	MT_078410_00_032.exe

C:\Users\Admin\AppData\Local\Temp\MT_078410_00_032.exe
"C:\Users\Admin\AppData\Local\Temp\MT_078410_00_032.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:380

C:\Users\Admin\AppData\Local\Temp\MT_078410_00_032.exe
"C:\Users\Admin\AppData\Local\Temp\MT_078410_00_032.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4772

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\MT_078410_00_032.exe.log
Filesize
805B

MD5
58a9108e39c2ea50e65c23be3a9407cf

SHA1
fb21f7b9330aa1a77080a3243b81b49035102d7b

SHA256
6049be83020702896a539b5c8c13270add224d7b91b3ee0bebc328791b74a84b

SHA512
93804ee8a4560503e47c07f5fa4a959e23355a01aba406c103d339debc9b2b1d20a345cdbb8d8069dac97b9151f228cf559ac3dde1500e3484fba1a4126842bf

Download Submit
memory/380-0-0x00000000753BE000-0x00000000753BF000-memory.dmp

Filesize
4KB

Download
memory/380-1-0x0000000000260000-0x00000000004C8000-memory.dmp

Filesize
2.4MB

Download
memory/380-2-0x0000000004FA0000-0x00000000051D0000-memory.dmp

Filesize
2.2MB

Download
memory/380-3-0x0000000005780000-0x0000000005D24000-memory.dmp

Filesize
5.6MB

Download
memory/380-4-0x00000000052C0000-0x0000000005352000-memory.dmp

Filesize
584KB

Download
memory/380-14-0x0000000004FA0000-0x00000000051CB000-memory.dmp

Filesize
2.2MB

Download
memory/380-16-0x0000000004FA0000-0x00000000051CB000-memory.dmp

Filesize
2.2MB

Download
memory/380-28-0x0000000004FA0000-0x00000000051CB000-memory.dmp

Filesize
2.2MB

Download
memory/380-34-0x0000000004FA0000-0x00000000051CB000-memory.dmp

Filesize
2.2MB

Download
memory/380-32-0x0000000004FA0000-0x00000000051CB000-memory.dmp

Filesize
2.2MB

Download
memory/380-60-0x0000000004FA0000-0x00000000051CB000-memory.dmp

Filesize
2.2MB

Download
memory/380-68-0x0000000004FA0000-0x00000000051CB000-memory.dmp

Filesize
2.2MB

Download
memory/380-66-0x0000000004FA0000-0x00000000051CB000-memory.dmp

Filesize
2.2MB

Download
memory/380-64-0x0000000004FA0000-0x00000000051CB000-memory.dmp

Filesize
2.2MB

Download
memory/380-62-0x0000000004FA0000-0x00000000051CB000-memory.dmp

Filesize
2.2MB

Download
memory/380-58-0x0000000004FA0000-0x00000000051CB000-memory.dmp

Filesize
2.2MB

Download
memory/380-56-0x0000000004FA0000-0x00000000051CB000-memory.dmp

Filesize
2.2MB

Download
memory/380-54-0x0000000004FA0000-0x00000000051CB000-memory.dmp

Filesize
2.2MB

Download
memory/380-52-0x0000000004FA0000-0x00000000051CB000-memory.dmp

Filesize
2.2MB

Download
memory/380-50-0x0000000004FA0000-0x00000000051CB000-memory.dmp

Filesize
2.2MB

Download
memory/380-46-0x0000000004FA0000-0x00000000051CB000-memory.dmp

Filesize
2.2MB

Download
memory/380-44-0x0000000004FA0000-0x00000000051CB000-memory.dmp

Filesize
2.2MB

Download
memory/380-42-0x0000000004FA0000-0x00000000051CB000-memory.dmp

Filesize
2.2MB

Download
memory/380-40-0x0000000004FA0000-0x00000000051CB000-memory.dmp

Filesize
2.2MB

Download
memory/380-38-0x0000000004FA0000-0x00000000051CB000-memory.dmp

Filesize
2.2MB

Download
memory/380-48-0x0000000004FA0000-0x00000000051CB000-memory.dmp

Filesize
2.2MB

Download
memory/380-30-0x0000000004FA0000-0x00000000051CB000-memory.dmp

Filesize
2.2MB

Download
memory/380-36-0x0000000004FA0000-0x00000000051CB000-memory.dmp

Filesize
2.2MB

Download
memory/380-26-0x0000000004FA0000-0x00000000051CB000-memory.dmp

Filesize
2.2MB

Download
memory/380-24-0x0000000004FA0000-0x00000000051CB000-memory.dmp

Filesize
2.2MB

Download
memory/380-22-0x0000000004FA0000-0x00000000051CB000-memory.dmp

Filesize
2.2MB

Download
memory/380-20-0x0000000004FA0000-0x00000000051CB000-memory.dmp

Filesize
2.2MB

Download
memory/380-18-0x0000000004FA0000-0x00000000051CB000-memory.dmp

Filesize
2.2MB

Download
memory/380-13-0x0000000004FA0000-0x00000000051CB000-memory.dmp

Filesize
2.2MB

Download
memory/380-10-0x0000000004FA0000-0x00000000051CB000-memory.dmp

Filesize
2.2MB

Download
memory/380-8-0x0000000004FA0000-0x00000000051CB000-memory.dmp

Filesize
2.2MB

Download
memory/380-6-0x0000000004FA0000-0x00000000051CB000-memory.dmp

Filesize
2.2MB

Download
memory/380-5-0x0000000004FA0000-0x00000000051CB000-memory.dmp

Filesize
2.2MB

Download
memory/380-4885-0x00000000753B0000-0x0000000075B60000-memory.dmp

Filesize
7.7MB

Download
memory/380-4886-0x00000000753B0000-0x0000000075B60000-memory.dmp

Filesize
7.7MB

Download
memory/380-4887-0x0000000004EB0000-0x0000000004F1C000-memory.dmp

Filesize
432KB

Download
memory/380-4888-0x0000000004F20000-0x0000000004F6C000-memory.dmp

Filesize
304KB

Download
memory/380-4889-0x00000000753BE000-0x00000000753BF000-memory.dmp

Filesize
4KB

Download
memory/380-4890-0x00000000753B0000-0x0000000075B60000-memory.dmp

Filesize
7.7MB

Download
memory/380-4891-0x0000000005510000-0x0000000005564000-memory.dmp

Filesize
336KB

Download
memory/380-4896-0x00000000753B0000-0x0000000075B60000-memory.dmp

Filesize
7.7MB

Download
memory/4772-4897-0x00000000753B0000-0x0000000075B60000-memory.dmp

Filesize
7.7MB

Download
memory/4772-4898-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4772-4899-0x0000000005190000-0x00000000051F6000-memory.dmp

Filesize
408KB

Download
memory/4772-4900-0x00000000753B0000-0x0000000075B60000-memory.dmp

Filesize
7.7MB

Download
memory/4772-4901-0x0000000006770000-0x00000000067C0000-memory.dmp

Filesize
320KB

Download
memory/4772-4902-0x0000000006860000-0x00000000068FC000-memory.dmp

Filesize
624KB

Download
memory/4772-4903-0x0000000006800000-0x000000000680A000-memory.dmp

Filesize
40KB

Download
memory/4772-4904-0x00000000753B0000-0x0000000075B60000-memory.dmp

Filesize
7.7MB

Download