agenttesla | 75ef91b36f46cb8875ffaa6af3cb7f38f8689ee9c16e50f9af87966a2648962f

Analysis

max time kernel
150s
max time network
113s
platform
windows10_x64
resource
win10v20201028
submitted
09/11/2020, 20:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RFQ-May Project-6217 CK.exe
Size 421KB
Sample201109-mcceganmqx
SHA256 75ef91b36f46cb8875ffaa6af3cb7f38f8689ee9c16e50f9af87966a2648962f
MD5 73f62e274a1ca83359a980d1fdb5ba01
SHA1 279ddfc2e6e68aec5ca31c3c55af72573aed7632
SHA512 1ed4657024bc153a00729a3abb7050c57bf0d5056aa8a5d673984eb15311e48f6b8d6935f673cba17881e5913610a46127d3b3b00031628d27083fb8e881ad70
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.privateemail.com
Port
587
Username
[email protected]
Password
@kingmezz.xyz

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 13 IoCs

resource	yara_rule
behavioral2/memory/2968-6-0x0000000000400000-0x000000000044E000-memory.dmp	family_agenttesla
behavioral2/memory/2968-7-0x000000000044929E-mapping.dmp	family_agenttesla
behavioral2/memory/2136-21-0x000000000044929E-mapping.dmp	family_agenttesla
behavioral2/memory/748-36-0x000000000044929E-mapping.dmp	family_agenttesla
behavioral2/memory/1248-50-0x000000000044929E-mapping.dmp	family_agenttesla
behavioral2/memory/2456-64-0x000000000044929E-mapping.dmp	family_agenttesla
behavioral2/memory/3952-78-0x000000000044929E-mapping.dmp	family_agenttesla
behavioral2/memory/3460-92-0x000000000044929E-mapping.dmp	family_agenttesla
behavioral2/memory/1796-107-0x000000000044929E-mapping.dmp	family_agenttesla
behavioral2/memory/64-121-0x000000000044929E-mapping.dmp	family_agenttesla
behavioral2/memory/3712-135-0x000000000044929E-mapping.dmp	family_agenttesla
behavioral2/memory/1840-149-0x000000000044929E-mapping.dmp	family_agenttesla
behavioral2/memory/4020-166-0x000000000044929E-mapping.dmp	family_agenttesla

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HJdyTuap.exe	RFQ-May Project-6217 CK.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HJdyTuap.exe	RFQ-May Project-6217 CK.exe

Suspicious use of SetThreadContext 12 IoCs

description	pid	Process	procid_target
PID 428 set thread context of 2968	428	RFQ-May Project-6217 CK.exe	81
PID 504 set thread context of 2136	504	RFQ-May Project-6217 CK.exe	83
PID 4052 set thread context of 748	4052	RFQ-May Project-6217 CK.exe	85
PID 184 set thread context of 1248	184	RFQ-May Project-6217 CK.exe	87
PID 1784 set thread context of 2456	1784	RFQ-May Project-6217 CK.exe	89
PID 3872 set thread context of 3952	3872	RFQ-May Project-6217 CK.exe	91
PID 1156 set thread context of 3460	1156	RFQ-May Project-6217 CK.exe	93
PID 1664 set thread context of 1796	1664	RFQ-May Project-6217 CK.exe	96
PID 2760 set thread context of 64	2760	RFQ-May Project-6217 CK.exe	98
PID 3764 set thread context of 3712	3764	RFQ-May Project-6217 CK.exe	100
PID 2684 set thread context of 1840	2684	RFQ-May Project-6217 CK.exe	102
PID 1432 set thread context of 4020	1432	RFQ-May Project-6217 CK.exe	107

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
428	RFQ-May Project-6217 CK.exe
428	RFQ-May Project-6217 CK.exe
428	RFQ-May Project-6217 CK.exe
428	RFQ-May Project-6217 CK.exe
428	RFQ-May Project-6217 CK.exe
428	RFQ-May Project-6217 CK.exe
428	RFQ-May Project-6217 CK.exe
428	RFQ-May Project-6217 CK.exe
428	RFQ-May Project-6217 CK.exe
428	RFQ-May Project-6217 CK.exe
428	RFQ-May Project-6217 CK.exe
428	RFQ-May Project-6217 CK.exe
428	RFQ-May Project-6217 CK.exe
428	RFQ-May Project-6217 CK.exe
428	RFQ-May Project-6217 CK.exe
428	RFQ-May Project-6217 CK.exe
428	RFQ-May Project-6217 CK.exe
428	RFQ-May Project-6217 CK.exe
428	RFQ-May Project-6217 CK.exe
428	RFQ-May Project-6217 CK.exe
428	RFQ-May Project-6217 CK.exe
428	RFQ-May Project-6217 CK.exe
428	RFQ-May Project-6217 CK.exe
428	RFQ-May Project-6217 CK.exe
428	RFQ-May Project-6217 CK.exe
428	RFQ-May Project-6217 CK.exe
428	RFQ-May Project-6217 CK.exe
428	RFQ-May Project-6217 CK.exe
428	RFQ-May Project-6217 CK.exe
428	RFQ-May Project-6217 CK.exe
428	RFQ-May Project-6217 CK.exe
428	RFQ-May Project-6217 CK.exe
428	RFQ-May Project-6217 CK.exe
428	RFQ-May Project-6217 CK.exe
428	RFQ-May Project-6217 CK.exe
428	RFQ-May Project-6217 CK.exe
428	RFQ-May Project-6217 CK.exe
428	RFQ-May Project-6217 CK.exe
428	RFQ-May Project-6217 CK.exe
428	RFQ-May Project-6217 CK.exe
428	RFQ-May Project-6217 CK.exe
428	RFQ-May Project-6217 CK.exe
428	RFQ-May Project-6217 CK.exe
428	RFQ-May Project-6217 CK.exe
428	RFQ-May Project-6217 CK.exe
428	RFQ-May Project-6217 CK.exe
428	RFQ-May Project-6217 CK.exe
428	RFQ-May Project-6217 CK.exe
428	RFQ-May Project-6217 CK.exe
428	RFQ-May Project-6217 CK.exe
428	RFQ-May Project-6217 CK.exe
428	RFQ-May Project-6217 CK.exe
428	RFQ-May Project-6217 CK.exe
428	RFQ-May Project-6217 CK.exe
428	RFQ-May Project-6217 CK.exe
428	RFQ-May Project-6217 CK.exe
428	RFQ-May Project-6217 CK.exe
428	RFQ-May Project-6217 CK.exe
428	RFQ-May Project-6217 CK.exe
428	RFQ-May Project-6217 CK.exe
428	RFQ-May Project-6217 CK.exe
428	RFQ-May Project-6217 CK.exe
428	RFQ-May Project-6217 CK.exe
428	RFQ-May Project-6217 CK.exe

Suspicious behavior: MapViewOfSection 18 IoCs

pid	Process
428	RFQ-May Project-6217 CK.exe
428	RFQ-May Project-6217 CK.exe
428	RFQ-May Project-6217 CK.exe
504	RFQ-May Project-6217 CK.exe
4052	RFQ-May Project-6217 CK.exe
184	RFQ-May Project-6217 CK.exe
1784	RFQ-May Project-6217 CK.exe
3872	RFQ-May Project-6217 CK.exe
1156	RFQ-May Project-6217 CK.exe
1664	RFQ-May Project-6217 CK.exe
1664	RFQ-May Project-6217 CK.exe
2760	RFQ-May Project-6217 CK.exe
3764	RFQ-May Project-6217 CK.exe
2684	RFQ-May Project-6217 CK.exe
1432	RFQ-May Project-6217 CK.exe
1432	RFQ-May Project-6217 CK.exe
1432	RFQ-May Project-6217 CK.exe
1432	RFQ-May Project-6217 CK.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeDebugPrivilege	428	RFQ-May Project-6217 CK.exe
Token: SeDebugPrivilege	2968	RegAsm.exe
Token: SeDebugPrivilege	504	RFQ-May Project-6217 CK.exe
Token: SeDebugPrivilege	2136	RegAsm.exe
Token: SeDebugPrivilege	4052	RFQ-May Project-6217 CK.exe
Token: SeDebugPrivilege	748	RegAsm.exe
Token: SeDebugPrivilege	184	RFQ-May Project-6217 CK.exe
Token: SeDebugPrivilege	1248	RegAsm.exe
Token: SeDebugPrivilege	1784	RFQ-May Project-6217 CK.exe
Token: SeDebugPrivilege	2456	RegAsm.exe
Token: SeDebugPrivilege	3872	RFQ-May Project-6217 CK.exe
Token: SeDebugPrivilege	3952	RegAsm.exe
Token: SeDebugPrivilege	1156	RFQ-May Project-6217 CK.exe
Token: SeDebugPrivilege	3460	RegAsm.exe
Token: SeDebugPrivilege	1664	RFQ-May Project-6217 CK.exe
Token: SeDebugPrivilege	1796	RegAsm.exe
Token: SeDebugPrivilege	2760	RFQ-May Project-6217 CK.exe
Token: SeDebugPrivilege	64	RegAsm.exe
Token: SeDebugPrivilege	3764	RFQ-May Project-6217 CK.exe
Token: SeDebugPrivilege	3712	RegAsm.exe
Token: SeDebugPrivilege	2684	RFQ-May Project-6217 CK.exe
Token: SeDebugPrivilege	1840	RegAsm.exe
Token: SeDebugPrivilege	1432	RFQ-May Project-6217 CK.exe
Token: SeDebugPrivilege	4020	RegAsm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 428 wrote to memory of 2076	428	RFQ-May Project-6217 CK.exe	79
PID 428 wrote to memory of 2076	428	RFQ-May Project-6217 CK.exe	79
PID 428 wrote to memory of 2076	428	RFQ-May Project-6217 CK.exe	79
PID 428 wrote to memory of 1380	428	RFQ-May Project-6217 CK.exe	80
PID 428 wrote to memory of 1380	428	RFQ-May Project-6217 CK.exe	80
PID 428 wrote to memory of 1380	428	RFQ-May Project-6217 CK.exe	80
PID 428 wrote to memory of 2968	428	RFQ-May Project-6217 CK.exe	81
PID 428 wrote to memory of 2968	428	RFQ-May Project-6217 CK.exe	81
PID 428 wrote to memory of 2968	428	RFQ-May Project-6217 CK.exe	81
PID 428 wrote to memory of 2968	428	RFQ-May Project-6217 CK.exe	81
PID 428 wrote to memory of 504	428	RFQ-May Project-6217 CK.exe	82
PID 428 wrote to memory of 504	428	RFQ-May Project-6217 CK.exe	82
PID 428 wrote to memory of 504	428	RFQ-May Project-6217 CK.exe	82
PID 504 wrote to memory of 2136	504	RFQ-May Project-6217 CK.exe	83
PID 504 wrote to memory of 2136	504	RFQ-May Project-6217 CK.exe	83
PID 504 wrote to memory of 2136	504	RFQ-May Project-6217 CK.exe	83
PID 504 wrote to memory of 2136	504	RFQ-May Project-6217 CK.exe	83
PID 504 wrote to memory of 4052	504	RFQ-May Project-6217 CK.exe	84
PID 504 wrote to memory of 4052	504	RFQ-May Project-6217 CK.exe	84
PID 504 wrote to memory of 4052	504	RFQ-May Project-6217 CK.exe	84
PID 4052 wrote to memory of 748	4052	RFQ-May Project-6217 CK.exe	85
PID 4052 wrote to memory of 748	4052	RFQ-May Project-6217 CK.exe	85
PID 4052 wrote to memory of 748	4052	RFQ-May Project-6217 CK.exe	85
PID 4052 wrote to memory of 748	4052	RFQ-May Project-6217 CK.exe	85
PID 4052 wrote to memory of 184	4052	RFQ-May Project-6217 CK.exe	86
PID 4052 wrote to memory of 184	4052	RFQ-May Project-6217 CK.exe	86
PID 4052 wrote to memory of 184	4052	RFQ-May Project-6217 CK.exe	86
PID 184 wrote to memory of 1248	184	RFQ-May Project-6217 CK.exe	87
PID 184 wrote to memory of 1248	184	RFQ-May Project-6217 CK.exe	87
PID 184 wrote to memory of 1248	184	RFQ-May Project-6217 CK.exe	87
PID 184 wrote to memory of 1248	184	RFQ-May Project-6217 CK.exe	87
PID 184 wrote to memory of 1784	184	RFQ-May Project-6217 CK.exe	88
PID 184 wrote to memory of 1784	184	RFQ-May Project-6217 CK.exe	88
PID 184 wrote to memory of 1784	184	RFQ-May Project-6217 CK.exe	88
PID 1784 wrote to memory of 2456	1784	RFQ-May Project-6217 CK.exe	89
PID 1784 wrote to memory of 2456	1784	RFQ-May Project-6217 CK.exe	89
PID 1784 wrote to memory of 2456	1784	RFQ-May Project-6217 CK.exe	89
PID 1784 wrote to memory of 2456	1784	RFQ-May Project-6217 CK.exe	89
PID 1784 wrote to memory of 3872	1784	RFQ-May Project-6217 CK.exe	90
PID 1784 wrote to memory of 3872	1784	RFQ-May Project-6217 CK.exe	90
PID 1784 wrote to memory of 3872	1784	RFQ-May Project-6217 CK.exe	90
PID 3872 wrote to memory of 3952	3872	RFQ-May Project-6217 CK.exe	91
PID 3872 wrote to memory of 3952	3872	RFQ-May Project-6217 CK.exe	91
PID 3872 wrote to memory of 3952	3872	RFQ-May Project-6217 CK.exe	91
PID 3872 wrote to memory of 3952	3872	RFQ-May Project-6217 CK.exe	91
PID 3872 wrote to memory of 1156	3872	RFQ-May Project-6217 CK.exe	92
PID 3872 wrote to memory of 1156	3872	RFQ-May Project-6217 CK.exe	92
PID 3872 wrote to memory of 1156	3872	RFQ-May Project-6217 CK.exe	92
PID 1156 wrote to memory of 3460	1156	RFQ-May Project-6217 CK.exe	93
PID 1156 wrote to memory of 3460	1156	RFQ-May Project-6217 CK.exe	93
PID 1156 wrote to memory of 3460	1156	RFQ-May Project-6217 CK.exe	93
PID 1156 wrote to memory of 3460	1156	RFQ-May Project-6217 CK.exe	93
PID 1156 wrote to memory of 1664	1156	RFQ-May Project-6217 CK.exe	94
PID 1156 wrote to memory of 1664	1156	RFQ-May Project-6217 CK.exe	94
PID 1156 wrote to memory of 1664	1156	RFQ-May Project-6217 CK.exe	94
PID 1664 wrote to memory of 1424	1664	RFQ-May Project-6217 CK.exe	95
PID 1664 wrote to memory of 1424	1664	RFQ-May Project-6217 CK.exe	95
PID 1664 wrote to memory of 1424	1664	RFQ-May Project-6217 CK.exe	95
PID 1664 wrote to memory of 1796	1664	RFQ-May Project-6217 CK.exe	96
PID 1664 wrote to memory of 1796	1664	RFQ-May Project-6217 CK.exe	96
PID 1664 wrote to memory of 1796	1664	RFQ-May Project-6217 CK.exe	96
PID 1664 wrote to memory of 1796	1664	RFQ-May Project-6217 CK.exe	96
PID 1664 wrote to memory of 2760	1664	RFQ-May Project-6217 CK.exe	97
PID 1664 wrote to memory of 2760	1664	RFQ-May Project-6217 CK.exe	97

C:\Users\Admin\AppData\Local\Temp\RFQ-May Project-6217 CK.exe
"C:\Users\Admin\AppData\Local\Temp\RFQ-May Project-6217 CK.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:428
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:2076
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:1380
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2968
- C:\Users\Admin\AppData\Local\Temp\RFQ-May Project-6217 CK.exe
  "C:\Users\Admin\AppData\Local\Temp\RFQ-May Project-6217 CK.exe"
  2⤵
  - Drops startup file
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:504
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2136
- - C:\Users\Admin\AppData\Local\Temp\RFQ-May Project-6217 CK.exe
    "C:\Users\Admin\AppData\Local\Temp\RFQ-May Project-6217 CK.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4052
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:748
  - - C:\Users\Admin\AppData\Local\Temp\RFQ-May Project-6217 CK.exe
      "C:\Users\Admin\AppData\Local\Temp\RFQ-May Project-6217 CK.exe"
      4⤵
      Suspicious use of SetThreadContext
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:184
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1248
    - - C:\Users\Admin\AppData\Local\Temp\RFQ-May Project-6217 CK.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RFQ-May Project-6217 CK.exe"
        5⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1784
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2456
      - C:\Users\Admin\AppData\Local\Temp\RFQ-May Project-6217 CK.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RFQ-May Project-6217 CK.exe"
        6⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3872
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3952
        
        C:\Users\Admin\AppData\Local\Temp\RFQ-May Project-6217 CK.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RFQ-May Project-6217 CK.exe"
        7⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1156
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3460
        
        C:\Users\Admin\AppData\Local\Temp\RFQ-May Project-6217 CK.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RFQ-May Project-6217 CK.exe"
        8⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1664
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        9⤵
        
        PID:1424
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        9⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1796
        
        C:\Users\Admin\AppData\Local\Temp\RFQ-May Project-6217 CK.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RFQ-May Project-6217 CK.exe"
        9⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        Suspicious use of AdjustPrivilegeToken
        
        PID:2760
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        10⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:64
        
        C:\Users\Admin\AppData\Local\Temp\RFQ-May Project-6217 CK.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RFQ-May Project-6217 CK.exe"
        10⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        Suspicious use of AdjustPrivilegeToken
        
        PID:3764
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        11⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3712
        
        C:\Users\Admin\AppData\Local\Temp\RFQ-May Project-6217 CK.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RFQ-May Project-6217 CK.exe"
        11⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        Suspicious use of AdjustPrivilegeToken
        
        PID:2684
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        12⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1840
        
        C:\Users\Admin\AppData\Local\Temp\RFQ-May Project-6217 CK.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RFQ-May Project-6217 CK.exe"
        12⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        Suspicious use of AdjustPrivilegeToken
        
        PID:1432
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        13⤵
        
        PID:2092
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        13⤵
        
        PID:2876
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        13⤵
        
        PID:4060
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        13⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4020
        
        C:\Users\Admin\AppData\Local\Temp\RFQ-May Project-6217 CK.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RFQ-May Project-6217 CK.exe"
        13⤵
        
        PID:500

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/64-122-0x0000000073160000-0x000000007384E000-memory.dmp

Download

memory/184-44-0x0000000073160000-0x000000007384E000-memory.dmp

Download

memory/428-3-0x00000000051E0000-0x0000000005230000-memory.dmp

Download

memory/428-4-0x0000000005CE0000-0x0000000005D2E000-memory.dmp

Download

memory/428-1-0x0000000000A00000-0x0000000000A01000-memory.dmp

Download

memory/428-0-0x0000000073160000-0x000000007384E000-memory.dmp

Download

memory/500-174-0x0000000073160000-0x000000007384E000-memory.dmp

Download

memory/504-15-0x0000000073160000-0x000000007384E000-memory.dmp

Download

memory/748-37-0x0000000073160000-0x000000007384E000-memory.dmp

Download

memory/1156-85-0x0000000073160000-0x000000007384E000-memory.dmp

Download

memory/1248-51-0x0000000073160000-0x000000007384E000-memory.dmp

Download

memory/1432-156-0x0000000073160000-0x000000007384E000-memory.dmp

Download

memory/1664-99-0x0000000073160000-0x000000007384E000-memory.dmp

Download

memory/1784-58-0x0000000073160000-0x000000007384E000-memory.dmp

Download

memory/1796-108-0x0000000073160000-0x000000007384E000-memory.dmp

Download

memory/1840-150-0x0000000073160000-0x000000007384E000-memory.dmp

Download

memory/2136-28-0x0000000005190000-0x0000000005191000-memory.dmp

Download

memory/2136-22-0x0000000073160000-0x000000007384E000-memory.dmp

Download

memory/2456-65-0x0000000073160000-0x000000007384E000-memory.dmp

Download

memory/2684-143-0x0000000073160000-0x000000007384E000-memory.dmp

Download

memory/2760-114-0x0000000073160000-0x000000007384E000-memory.dmp

Download

memory/2968-13-0x00000000050E0000-0x00000000050E1000-memory.dmp

Download

memory/2968-8-0x0000000073160000-0x000000007384E000-memory.dmp

Download

memory/2968-6-0x0000000000400000-0x000000000044E000-memory.dmp

Download

memory/2968-11-0x0000000005660000-0x0000000005661000-memory.dmp

Download

memory/2968-12-0x0000000005030000-0x0000000005031000-memory.dmp

Download

memory/2968-18-0x0000000005BD0000-0x0000000005BD1000-memory.dmp

Download

memory/3460-93-0x0000000073160000-0x000000007384E000-memory.dmp

Download

memory/3712-136-0x0000000073160000-0x000000007384E000-memory.dmp

Download

memory/3764-128-0x0000000073160000-0x000000007384E000-memory.dmp

Download

memory/3872-72-0x0000000073160000-0x000000007384E000-memory.dmp

Download

memory/3952-79-0x0000000073160000-0x000000007384E000-memory.dmp

Download

memory/4020-167-0x0000000073160000-0x000000007384E000-memory.dmp

Download

memory/4052-29-0x0000000073160000-0x000000007384E000-memory.dmp

Download