agenttesla | ec3fae8f7d132adb356d2edf3d8997e7b22165949a698f74bc79586f5e9e9bd6

Analysis

max time kernel
150s
max time network
135s
platform
windows10_x64
resource
win10v20201028
submitted
09/11/2020, 20:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1adf10dff75f331c15f6a273db0e62c4.exe
Size 667KB
Sample201109-pqbk2ebhex
SHA256 ec3fae8f7d132adb356d2edf3d8997e7b22165949a698f74bc79586f5e9e9bd6
MD5 1adf10dff75f331c15f6a273db0e62c4
SHA1 ecda5aa8aa72077a2adc9d5b355540e2590f5dda
SHA512 55a11ba0e21ed9317e914d672098eef3aa3068957ed7c97a13bbfd6dbc439168ea30f59c2ebd6b8ad1c66e0c7e8b47498df6bcaabbe0b8c0b416c7770fb0508a
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
premium49.web-hosting.com
Port
587
Username
[email protected]
Password
NR*[Q66kH&&@

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 10 IoCs

resource	yara_rule
behavioral2/memory/1424-4-0x0000000000400000-0x0000000000452000-memory.dmp	family_agenttesla
behavioral2/memory/1424-5-0x000000000044CCFE-mapping.dmp	family_agenttesla
behavioral2/memory/3132-19-0x000000000044CCFE-mapping.dmp	family_agenttesla
behavioral2/memory/1520-34-0x000000000044CCFE-mapping.dmp	family_agenttesla
behavioral2/memory/1084-49-0x000000000044CCFE-mapping.dmp	family_agenttesla
behavioral2/memory/1044-63-0x000000000044CCFE-mapping.dmp	family_agenttesla
behavioral2/memory/1796-77-0x000000000044CCFE-mapping.dmp	family_agenttesla
behavioral2/memory/1140-92-0x000000000044CCFE-mapping.dmp	family_agenttesla
behavioral2/memory/1220-107-0x000000000044CCFE-mapping.dmp	family_agenttesla
behavioral2/memory/500-121-0x000000000044CCFE-mapping.dmp	family_agenttesla

Adds Run key to start application 2 TTPs 10 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\ghvd = "C:\\Users\\Admin\\AppData\\Roaming\\xxxx.exe"	1adf10dff75f331c15f6a273db0e62c4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\ghvd = "C:\\Users\\Admin\\AppData\\Roaming\\xxxx.exe"	1adf10dff75f331c15f6a273db0e62c4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\ghvd = "C:\\Users\\Admin\\AppData\\Roaming\\xxxx.exe"	1adf10dff75f331c15f6a273db0e62c4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\ghvd = "C:\\Users\\Admin\\AppData\\Roaming\\xxxx.exe"	1adf10dff75f331c15f6a273db0e62c4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\ghvd = "C:\\Users\\Admin\\AppData\\Roaming\\xxxx.exe"	1adf10dff75f331c15f6a273db0e62c4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\ghvd = "C:\\Users\\Admin\\AppData\\Roaming\\xxxx.exe"	1adf10dff75f331c15f6a273db0e62c4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\ghvd = "C:\\Users\\Admin\\AppData\\Roaming\\xxxx.exe"	1adf10dff75f331c15f6a273db0e62c4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\ghvd = "C:\\Users\\Admin\\AppData\\Roaming\\xxxx.exe"	1adf10dff75f331c15f6a273db0e62c4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\ghvd = "C:\\Users\\Admin\\AppData\\Roaming\\xxxx.exe"	1adf10dff75f331c15f6a273db0e62c4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\ghvd = "C:\\Users\\Admin\\AppData\\Roaming\\xxxx.exe"	1adf10dff75f331c15f6a273db0e62c4.exe

Suspicious use of SetThreadContext 9 IoCs

description	pid	Process	procid_target
PID 1304 set thread context of 1424	1304	1adf10dff75f331c15f6a273db0e62c4.exe	78
PID 352 set thread context of 3132	352	1adf10dff75f331c15f6a273db0e62c4.exe	80
PID 2116 set thread context of 1520	2116	1adf10dff75f331c15f6a273db0e62c4.exe	83
PID 1908 set thread context of 1084	1908	1adf10dff75f331c15f6a273db0e62c4.exe	86
PID 1152 set thread context of 1044	1152	1adf10dff75f331c15f6a273db0e62c4.exe	88
PID 372 set thread context of 1796	372	1adf10dff75f331c15f6a273db0e62c4.exe	90
PID 3952 set thread context of 1140	3952	1adf10dff75f331c15f6a273db0e62c4.exe	93
PID 1716 set thread context of 1220	1716	1adf10dff75f331c15f6a273db0e62c4.exe	96
PID 992 set thread context of 500	992	1adf10dff75f331c15f6a273db0e62c4.exe	98

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1304	1adf10dff75f331c15f6a273db0e62c4.exe
1304	1adf10dff75f331c15f6a273db0e62c4.exe
1304	1adf10dff75f331c15f6a273db0e62c4.exe
1304	1adf10dff75f331c15f6a273db0e62c4.exe
1304	1adf10dff75f331c15f6a273db0e62c4.exe
1304	1adf10dff75f331c15f6a273db0e62c4.exe
1304	1adf10dff75f331c15f6a273db0e62c4.exe
1304	1adf10dff75f331c15f6a273db0e62c4.exe
1304	1adf10dff75f331c15f6a273db0e62c4.exe
1304	1adf10dff75f331c15f6a273db0e62c4.exe
1304	1adf10dff75f331c15f6a273db0e62c4.exe
1304	1adf10dff75f331c15f6a273db0e62c4.exe
1304	1adf10dff75f331c15f6a273db0e62c4.exe
1304	1adf10dff75f331c15f6a273db0e62c4.exe
1304	1adf10dff75f331c15f6a273db0e62c4.exe
1304	1adf10dff75f331c15f6a273db0e62c4.exe
1304	1adf10dff75f331c15f6a273db0e62c4.exe
1304	1adf10dff75f331c15f6a273db0e62c4.exe
1304	1adf10dff75f331c15f6a273db0e62c4.exe
1304	1adf10dff75f331c15f6a273db0e62c4.exe
1304	1adf10dff75f331c15f6a273db0e62c4.exe
1304	1adf10dff75f331c15f6a273db0e62c4.exe
1304	1adf10dff75f331c15f6a273db0e62c4.exe
1304	1adf10dff75f331c15f6a273db0e62c4.exe
1304	1adf10dff75f331c15f6a273db0e62c4.exe
1304	1adf10dff75f331c15f6a273db0e62c4.exe
1304	1adf10dff75f331c15f6a273db0e62c4.exe
1304	1adf10dff75f331c15f6a273db0e62c4.exe
1304	1adf10dff75f331c15f6a273db0e62c4.exe
1304	1adf10dff75f331c15f6a273db0e62c4.exe
1304	1adf10dff75f331c15f6a273db0e62c4.exe
1304	1adf10dff75f331c15f6a273db0e62c4.exe
1304	1adf10dff75f331c15f6a273db0e62c4.exe
1304	1adf10dff75f331c15f6a273db0e62c4.exe
1304	1adf10dff75f331c15f6a273db0e62c4.exe
1304	1adf10dff75f331c15f6a273db0e62c4.exe
1304	1adf10dff75f331c15f6a273db0e62c4.exe
1304	1adf10dff75f331c15f6a273db0e62c4.exe
1304	1adf10dff75f331c15f6a273db0e62c4.exe
1304	1adf10dff75f331c15f6a273db0e62c4.exe
1304	1adf10dff75f331c15f6a273db0e62c4.exe
1304	1adf10dff75f331c15f6a273db0e62c4.exe
1304	1adf10dff75f331c15f6a273db0e62c4.exe
1304	1adf10dff75f331c15f6a273db0e62c4.exe
1304	1adf10dff75f331c15f6a273db0e62c4.exe
1304	1adf10dff75f331c15f6a273db0e62c4.exe
1304	1adf10dff75f331c15f6a273db0e62c4.exe
1304	1adf10dff75f331c15f6a273db0e62c4.exe
1304	1adf10dff75f331c15f6a273db0e62c4.exe
1304	1adf10dff75f331c15f6a273db0e62c4.exe
1304	1adf10dff75f331c15f6a273db0e62c4.exe
1304	1adf10dff75f331c15f6a273db0e62c4.exe
1304	1adf10dff75f331c15f6a273db0e62c4.exe
1304	1adf10dff75f331c15f6a273db0e62c4.exe
1304	1adf10dff75f331c15f6a273db0e62c4.exe
1304	1adf10dff75f331c15f6a273db0e62c4.exe
1304	1adf10dff75f331c15f6a273db0e62c4.exe
1304	1adf10dff75f331c15f6a273db0e62c4.exe
1304	1adf10dff75f331c15f6a273db0e62c4.exe
1304	1adf10dff75f331c15f6a273db0e62c4.exe
1304	1adf10dff75f331c15f6a273db0e62c4.exe
1304	1adf10dff75f331c15f6a273db0e62c4.exe
1304	1adf10dff75f331c15f6a273db0e62c4.exe
1304	1adf10dff75f331c15f6a273db0e62c4.exe

Suspicious behavior: MapViewOfSection 13 IoCs

pid	Process
1304	1adf10dff75f331c15f6a273db0e62c4.exe
352	1adf10dff75f331c15f6a273db0e62c4.exe
2116	1adf10dff75f331c15f6a273db0e62c4.exe
2116	1adf10dff75f331c15f6a273db0e62c4.exe
1908	1adf10dff75f331c15f6a273db0e62c4.exe
1908	1adf10dff75f331c15f6a273db0e62c4.exe
1152	1adf10dff75f331c15f6a273db0e62c4.exe
372	1adf10dff75f331c15f6a273db0e62c4.exe
3952	1adf10dff75f331c15f6a273db0e62c4.exe
3952	1adf10dff75f331c15f6a273db0e62c4.exe
1716	1adf10dff75f331c15f6a273db0e62c4.exe
1716	1adf10dff75f331c15f6a273db0e62c4.exe
992	1adf10dff75f331c15f6a273db0e62c4.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeDebugPrivilege	1304	1adf10dff75f331c15f6a273db0e62c4.exe
Token: SeDebugPrivilege	1424	RegAsm.exe
Token: SeDebugPrivilege	352	1adf10dff75f331c15f6a273db0e62c4.exe
Token: SeDebugPrivilege	3132	RegAsm.exe
Token: SeDebugPrivilege	2116	1adf10dff75f331c15f6a273db0e62c4.exe
Token: SeDebugPrivilege	1520	RegAsm.exe
Token: SeDebugPrivilege	1908	1adf10dff75f331c15f6a273db0e62c4.exe
Token: SeDebugPrivilege	1084	RegAsm.exe
Token: SeDebugPrivilege	1152	1adf10dff75f331c15f6a273db0e62c4.exe
Token: SeDebugPrivilege	1044	RegAsm.exe
Token: SeDebugPrivilege	372	1adf10dff75f331c15f6a273db0e62c4.exe
Token: SeDebugPrivilege	1796	RegAsm.exe
Token: SeDebugPrivilege	3952	1adf10dff75f331c15f6a273db0e62c4.exe
Token: SeDebugPrivilege	1140	RegAsm.exe
Token: SeDebugPrivilege	1716	1adf10dff75f331c15f6a273db0e62c4.exe
Token: SeDebugPrivilege	1220	RegAsm.exe
Token: SeDebugPrivilege	992	1adf10dff75f331c15f6a273db0e62c4.exe
Token: SeDebugPrivilege	500	RegAsm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1304 wrote to memory of 1424	1304	1adf10dff75f331c15f6a273db0e62c4.exe	78
PID 1304 wrote to memory of 1424	1304	1adf10dff75f331c15f6a273db0e62c4.exe	78
PID 1304 wrote to memory of 1424	1304	1adf10dff75f331c15f6a273db0e62c4.exe	78
PID 1304 wrote to memory of 1424	1304	1adf10dff75f331c15f6a273db0e62c4.exe	78
PID 1304 wrote to memory of 352	1304	1adf10dff75f331c15f6a273db0e62c4.exe	79
PID 1304 wrote to memory of 352	1304	1adf10dff75f331c15f6a273db0e62c4.exe	79
PID 1304 wrote to memory of 352	1304	1adf10dff75f331c15f6a273db0e62c4.exe	79
PID 352 wrote to memory of 3132	352	1adf10dff75f331c15f6a273db0e62c4.exe	80
PID 352 wrote to memory of 3132	352	1adf10dff75f331c15f6a273db0e62c4.exe	80
PID 352 wrote to memory of 3132	352	1adf10dff75f331c15f6a273db0e62c4.exe	80
PID 352 wrote to memory of 3132	352	1adf10dff75f331c15f6a273db0e62c4.exe	80
PID 352 wrote to memory of 2116	352	1adf10dff75f331c15f6a273db0e62c4.exe	81
PID 352 wrote to memory of 2116	352	1adf10dff75f331c15f6a273db0e62c4.exe	81
PID 352 wrote to memory of 2116	352	1adf10dff75f331c15f6a273db0e62c4.exe	81
PID 2116 wrote to memory of 1804	2116	1adf10dff75f331c15f6a273db0e62c4.exe	82
PID 2116 wrote to memory of 1804	2116	1adf10dff75f331c15f6a273db0e62c4.exe	82
PID 2116 wrote to memory of 1804	2116	1adf10dff75f331c15f6a273db0e62c4.exe	82
PID 2116 wrote to memory of 1520	2116	1adf10dff75f331c15f6a273db0e62c4.exe	83
PID 2116 wrote to memory of 1520	2116	1adf10dff75f331c15f6a273db0e62c4.exe	83
PID 2116 wrote to memory of 1520	2116	1adf10dff75f331c15f6a273db0e62c4.exe	83
PID 2116 wrote to memory of 1520	2116	1adf10dff75f331c15f6a273db0e62c4.exe	83
PID 2116 wrote to memory of 1908	2116	1adf10dff75f331c15f6a273db0e62c4.exe	84
PID 2116 wrote to memory of 1908	2116	1adf10dff75f331c15f6a273db0e62c4.exe	84
PID 2116 wrote to memory of 1908	2116	1adf10dff75f331c15f6a273db0e62c4.exe	84
PID 1908 wrote to memory of 3672	1908	1adf10dff75f331c15f6a273db0e62c4.exe	85
PID 1908 wrote to memory of 3672	1908	1adf10dff75f331c15f6a273db0e62c4.exe	85
PID 1908 wrote to memory of 3672	1908	1adf10dff75f331c15f6a273db0e62c4.exe	85
PID 1908 wrote to memory of 1084	1908	1adf10dff75f331c15f6a273db0e62c4.exe	86
PID 1908 wrote to memory of 1084	1908	1adf10dff75f331c15f6a273db0e62c4.exe	86
PID 1908 wrote to memory of 1084	1908	1adf10dff75f331c15f6a273db0e62c4.exe	86
PID 1908 wrote to memory of 1084	1908	1adf10dff75f331c15f6a273db0e62c4.exe	86
PID 1908 wrote to memory of 1152	1908	1adf10dff75f331c15f6a273db0e62c4.exe	87
PID 1908 wrote to memory of 1152	1908	1adf10dff75f331c15f6a273db0e62c4.exe	87
PID 1908 wrote to memory of 1152	1908	1adf10dff75f331c15f6a273db0e62c4.exe	87
PID 1152 wrote to memory of 1044	1152	1adf10dff75f331c15f6a273db0e62c4.exe	88
PID 1152 wrote to memory of 1044	1152	1adf10dff75f331c15f6a273db0e62c4.exe	88
PID 1152 wrote to memory of 1044	1152	1adf10dff75f331c15f6a273db0e62c4.exe	88
PID 1152 wrote to memory of 1044	1152	1adf10dff75f331c15f6a273db0e62c4.exe	88
PID 1152 wrote to memory of 372	1152	1adf10dff75f331c15f6a273db0e62c4.exe	89
PID 1152 wrote to memory of 372	1152	1adf10dff75f331c15f6a273db0e62c4.exe	89
PID 1152 wrote to memory of 372	1152	1adf10dff75f331c15f6a273db0e62c4.exe	89
PID 372 wrote to memory of 1796	372	1adf10dff75f331c15f6a273db0e62c4.exe	90
PID 372 wrote to memory of 1796	372	1adf10dff75f331c15f6a273db0e62c4.exe	90
PID 372 wrote to memory of 1796	372	1adf10dff75f331c15f6a273db0e62c4.exe	90
PID 372 wrote to memory of 1796	372	1adf10dff75f331c15f6a273db0e62c4.exe	90
PID 372 wrote to memory of 3952	372	1adf10dff75f331c15f6a273db0e62c4.exe	91
PID 372 wrote to memory of 3952	372	1adf10dff75f331c15f6a273db0e62c4.exe	91
PID 372 wrote to memory of 3952	372	1adf10dff75f331c15f6a273db0e62c4.exe	91
PID 3952 wrote to memory of 3884	3952	1adf10dff75f331c15f6a273db0e62c4.exe	92
PID 3952 wrote to memory of 3884	3952	1adf10dff75f331c15f6a273db0e62c4.exe	92
PID 3952 wrote to memory of 3884	3952	1adf10dff75f331c15f6a273db0e62c4.exe	92
PID 3952 wrote to memory of 1140	3952	1adf10dff75f331c15f6a273db0e62c4.exe	93
PID 3952 wrote to memory of 1140	3952	1adf10dff75f331c15f6a273db0e62c4.exe	93
PID 3952 wrote to memory of 1140	3952	1adf10dff75f331c15f6a273db0e62c4.exe	93
PID 3952 wrote to memory of 1140	3952	1adf10dff75f331c15f6a273db0e62c4.exe	93
PID 3952 wrote to memory of 1716	3952	1adf10dff75f331c15f6a273db0e62c4.exe	94
PID 3952 wrote to memory of 1716	3952	1adf10dff75f331c15f6a273db0e62c4.exe	94
PID 3952 wrote to memory of 1716	3952	1adf10dff75f331c15f6a273db0e62c4.exe	94
PID 1716 wrote to memory of 3924	1716	1adf10dff75f331c15f6a273db0e62c4.exe	95
PID 1716 wrote to memory of 3924	1716	1adf10dff75f331c15f6a273db0e62c4.exe	95
PID 1716 wrote to memory of 3924	1716	1adf10dff75f331c15f6a273db0e62c4.exe	95
PID 1716 wrote to memory of 1220	1716	1adf10dff75f331c15f6a273db0e62c4.exe	96
PID 1716 wrote to memory of 1220	1716	1adf10dff75f331c15f6a273db0e62c4.exe	96
PID 1716 wrote to memory of 1220	1716	1adf10dff75f331c15f6a273db0e62c4.exe	96

C:\Users\Admin\AppData\Local\Temp\1adf10dff75f331c15f6a273db0e62c4.exe
"C:\Users\Admin\AppData\Local\Temp\1adf10dff75f331c15f6a273db0e62c4.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1304
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1424
- C:\Users\Admin\AppData\Local\Temp\1adf10dff75f331c15f6a273db0e62c4.exe
  "C:\Users\Admin\AppData\Local\Temp\1adf10dff75f331c15f6a273db0e62c4.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:352
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3132
- - C:\Users\Admin\AppData\Local\Temp\1adf10dff75f331c15f6a273db0e62c4.exe
    "C:\Users\Admin\AppData\Local\Temp\1adf10dff75f331c15f6a273db0e62c4.exe"
    3⤵
    - Adds Run key to start application
    - Suspicious use of SetThreadContext
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2116
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      PID:1804
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1520
  - - C:\Users\Admin\AppData\Local\Temp\1adf10dff75f331c15f6a273db0e62c4.exe
      "C:\Users\Admin\AppData\Local\Temp\1adf10dff75f331c15f6a273db0e62c4.exe"
      4⤵
      Adds Run key to start application
      Suspicious use of SetThreadContext
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1908
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        5⤵
        
        PID:3672
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1084
    - - C:\Users\Admin\AppData\Local\Temp\1adf10dff75f331c15f6a273db0e62c4.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1adf10dff75f331c15f6a273db0e62c4.exe"
        5⤵
        Adds Run key to start application
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1152
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1044
      - C:\Users\Admin\AppData\Local\Temp\1adf10dff75f331c15f6a273db0e62c4.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1adf10dff75f331c15f6a273db0e62c4.exe"
        6⤵
        Adds Run key to start application
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:372
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1796
        
        C:\Users\Admin\AppData\Local\Temp\1adf10dff75f331c15f6a273db0e62c4.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1adf10dff75f331c15f6a273db0e62c4.exe"
        7⤵
        Adds Run key to start application
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3952
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        8⤵
        
        PID:3884
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1140
        
        C:\Users\Admin\AppData\Local\Temp\1adf10dff75f331c15f6a273db0e62c4.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1adf10dff75f331c15f6a273db0e62c4.exe"
        8⤵
        Adds Run key to start application
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1716
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        9⤵
        
        PID:3924
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        9⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1220
        
        C:\Users\Admin\AppData\Local\Temp\1adf10dff75f331c15f6a273db0e62c4.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1adf10dff75f331c15f6a273db0e62c4.exe"
        9⤵
        Adds Run key to start application
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        Suspicious use of AdjustPrivilegeToken
        
        PID:992
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        10⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:500
        
        C:\Users\Admin\AppData\Local\Temp\1adf10dff75f331c15f6a273db0e62c4.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1adf10dff75f331c15f6a273db0e62c4.exe"
        10⤵
        Adds Run key to start application
        
        PID:1360

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/352-12-0x0000000073C50000-0x000000007433E000-memory.dmp

Download

memory/372-70-0x0000000073C50000-0x000000007433E000-memory.dmp

Download

memory/500-122-0x0000000073C50000-0x000000007433E000-memory.dmp

Download

memory/992-115-0x0000000073C50000-0x000000007433E000-memory.dmp

Download

memory/1044-64-0x0000000073C50000-0x000000007433E000-memory.dmp

Download

memory/1084-50-0x0000000073C50000-0x000000007433E000-memory.dmp

Download

memory/1140-93-0x0000000073C50000-0x000000007433E000-memory.dmp

Download

memory/1152-56-0x0000000073C50000-0x000000007433E000-memory.dmp

Download

memory/1220-108-0x0000000073C50000-0x000000007433E000-memory.dmp

Download

memory/1220-114-0x0000000005330000-0x0000000005331000-memory.dmp

Download

memory/1304-1-0x0000000000D80000-0x0000000000D81000-memory.dmp

Download

memory/1304-3-0x00000000055B0000-0x0000000005604000-memory.dmp

Download

memory/1304-0-0x0000000073C50000-0x000000007433E000-memory.dmp

Download

memory/1360-128-0x0000000073C50000-0x000000007433E000-memory.dmp

Download

memory/1424-4-0x0000000000400000-0x0000000000452000-memory.dmp

Download

memory/1424-17-0x0000000006450000-0x0000000006451000-memory.dmp

Download

memory/1424-15-0x0000000005930000-0x0000000005931000-memory.dmp

Download

memory/1424-10-0x0000000005880000-0x0000000005881000-memory.dmp

Download

memory/1424-9-0x0000000005EE0000-0x0000000005EE1000-memory.dmp

Download

memory/1424-6-0x0000000073C50000-0x000000007433E000-memory.dmp

Download

memory/1520-35-0x0000000073C50000-0x000000007433E000-memory.dmp

Download

memory/1716-100-0x0000000073C50000-0x000000007433E000-memory.dmp

Download

memory/1796-78-0x0000000073C50000-0x000000007433E000-memory.dmp

Download

memory/1796-84-0x0000000005300000-0x0000000005301000-memory.dmp

Download

memory/1908-41-0x0000000073C50000-0x000000007433E000-memory.dmp

Download

memory/2116-32-0x0000000005070000-0x00000000050C2000-memory.dmp

Download

memory/2116-27-0x0000000073C50000-0x000000007433E000-memory.dmp

Download

memory/3132-26-0x0000000004FF0000-0x0000000004FF1000-memory.dmp

Download

memory/3132-20-0x0000000073C50000-0x000000007433E000-memory.dmp

Download

memory/3952-85-0x0000000073C50000-0x000000007433E000-memory.dmp

Download