284d5054b870aa65a74bf61eccb5a26ddac39b7ea74d01b75d3b58511ba5664c

General

Target

284d5054b870aa65a74bf61eccb5a26ddac39b7ea74d01b75d3b58511ba5664c.exe
Size

912KB
MD5

fe53937c6e56a168967d32d99909d8d5
SHA1

a7e0cb24994667ab405c9721ab100083ec7ea063
SHA256

284d5054b870aa65a74bf61eccb5a26ddac39b7ea74d01b75d3b58511ba5664c
SHA512

c858d922032766a723a2185ed2ecaf6d61c631b7efdb7e6ba1bb716cd2c1d05fd8f7736f943732c0ff7fabae178abca2443f8f5c0d60c9e9e1e16d858e9b0551
SSDEEP

12288:lOZMFIoIieG1IA/QbrT5Jmo6stpj58OE4O77JSWMwnOZMSSRHm+yWy0:EeI2eCIA6b7j58OCJBhOZMSSm+Xy

Score

9^/10

collection spyware stealer

Malware Config

Signatures

NirSoft MailPassView 5 IoCs

Password recovery tool for various email clients

Processes:

resource	yara_rule
behavioral1/memory/1964-95-0x0000000000400000-0x000000000041B000-memory.dmp	MailPassView
behavioral1/memory/1964-96-0x0000000000411714-mapping.dmp	MailPassView
behavioral1/memory/1964-100-0x0000000000400000-0x000000000041B000-memory.dmp	MailPassView
behavioral1/memory/1964-101-0x0000000000400000-0x000000000041B000-memory.dmp	MailPassView
behavioral1/memory/1964-102-0x0000000000400000-0x000000000041B000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 4 IoCs

Password recovery tool for various web browsers

Processes:

resource	yara_rule
behavioral1/memory/1928-112-0x0000000000400000-0x0000000000459000-memory.dmp	WebBrowserPassView
behavioral1/memory/1928-113-0x0000000000442F58-mapping.dmp	WebBrowserPassView
behavioral1/memory/1928-116-0x0000000000400000-0x0000000000459000-memory.dmp	WebBrowserPassView
behavioral1/memory/1928-117-0x0000000000400000-0x0000000000459000-memory.dmp	WebBrowserPassView

Nirsoft 9 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1964-95-0x0000000000400000-0x000000000041B000-memory.dmp	Nirsoft
behavioral1/memory/1964-96-0x0000000000411714-mapping.dmp	Nirsoft
behavioral1/memory/1964-100-0x0000000000400000-0x000000000041B000-memory.dmp	Nirsoft
behavioral1/memory/1964-101-0x0000000000400000-0x000000000041B000-memory.dmp	Nirsoft
behavioral1/memory/1964-102-0x0000000000400000-0x000000000041B000-memory.dmp	Nirsoft
behavioral1/memory/1928-112-0x0000000000400000-0x0000000000459000-memory.dmp	Nirsoft
behavioral1/memory/1928-113-0x0000000000442F58-mapping.dmp	Nirsoft
behavioral1/memory/1928-116-0x0000000000400000-0x0000000000459000-memory.dmp	Nirsoft
behavioral1/memory/1928-117-0x0000000000400000-0x0000000000459000-memory.dmp	Nirsoft

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

Processes:

takshost.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	takshost.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

284d5054b870aa65a74bf61eccb5a26ddac39b7ea74d01b75d3b58511ba5664c.exetakshost.exetakshost.exe

description	pid	process	target process
PID 1408 set thread context of 672	1408	284d5054b870aa65a74bf61eccb5a26ddac39b7ea74d01b75d3b58511ba5664c.exe	284d5054b870aa65a74bf61eccb5a26ddac39b7ea74d01b75d3b58511ba5664c.exe
PID 1804 set thread context of 1656	1804	takshost.exe	takshost.exe
PID 1656 set thread context of 1964	1656	takshost.exe	takshost.exe
PID 1656 set thread context of 1928	1656	takshost.exe	takshost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376508256"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f04505f51804d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{19E31B91-700C-11ED-9843-7ADD0904B6AC} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009af231c376948d408962fca1a5dffcdc00000000020000000000106600000001000020000000ce33ddc9a156c0befbf90bc1bcfa771e92b630336856f74e8d5a20633013be99000000000e8000000002000020000000e2386616a74d0001ce18dfb28225887b3248b7a7447051b1640157453c108b3090000000900b8d07f97daa0c6086fdb7703d600923eef42c7cb621b32872517189906616828484c1a928341d0adeb3ec3ad47c254973cba691ef624f42848865b49768c25e6a6d1c1d07e4da12b11ba8cde9e3d58be023b34251bc08cfe30db21442fd040cd87febfc79f7ca529ed4b7feb4b1cde67fa23d02367a0a2a7a31397251a2907695ce50236d736acdee1f3abf88134e400000000ee1fe6ab11422f6afb089c3ad69dcbe2eba418c6bc5cb78b19e91b2c544c9c80510d6d81e43c8c5aaed347cb8fa4328d09321220372af7c8138f1baafdc0aba	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009af231c376948d408962fca1a5dffcdc000000000200000000001066000000010000200000009bbf29d83563f44da280a570d928445c19fc29c3317f5a47edf2e5f1325c8a18000000000e800000000200002000000028a84d59a3ce141fdb50e2e46397e3277edcd94cf1f31a2c90aaf886299a7f2220000000756c909376a2bcdaeb1507cf801c872715742c465378b4e211077c1f0817027740000000026c8293a601d5bcae1566e78f1c6938bebe171d7596fccf26bc86435bb87c3c23e44e03b1d446ffd6b524517d319975b349308e9cb8504df0ffa97cf246f759	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

284d5054b870aa65a74bf61eccb5a26ddac39b7ea74d01b75d3b58511ba5664c.exetakshost.exetakshost.exetakshost.exe

pid process

1408 284d5054b870aa65a74bf61eccb5a26ddac39b7ea74d01b75d3b58511ba5664c.exe
1804 takshost.exe
1804 takshost.exe
1928 takshost.exe
1656 takshost.exe
Suspicious behavior: RenamesItself 2 IoCs

Processes:

284d5054b870aa65a74bf61eccb5a26ddac39b7ea74d01b75d3b58511ba5664c.exetakshost.exe

pid process

1408 284d5054b870aa65a74bf61eccb5a26ddac39b7ea74d01b75d3b58511ba5664c.exe
1656 takshost.exe

pid	process
1408	284d5054b870aa65a74bf61eccb5a26ddac39b7ea74d01b75d3b58511ba5664c.exe
1804	takshost.exe
1804	takshost.exe
1928	takshost.exe
1656	takshost.exe

pid	process
1408	284d5054b870aa65a74bf61eccb5a26ddac39b7ea74d01b75d3b58511ba5664c.exe
1656	takshost.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

284d5054b870aa65a74bf61eccb5a26ddac39b7ea74d01b75d3b58511ba5664c.exetakshost.exetakshost.exe

description	pid	process
Token: SeDebugPrivilege	1408	284d5054b870aa65a74bf61eccb5a26ddac39b7ea74d01b75d3b58511ba5664c.exe
Token: SeDebugPrivilege	1804	takshost.exe
Token: SeDebugPrivilege	1656	takshost.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1652 iexplore.exe
Suspicious use of SetWindowsHookEx 7 IoCs

Processes:

iexplore.exeIEXPLORE.EXEtakshost.exe

pid process

1652 iexplore.exe
1652 iexplore.exe
564 IEXPLORE.EXE
564 IEXPLORE.EXE
564 IEXPLORE.EXE
564 IEXPLORE.EXE
1656 takshost.exe

pid	process
1652	iexplore.exe

pid	process
1652	iexplore.exe
1652	iexplore.exe
564	IEXPLORE.EXE
564	IEXPLORE.EXE
564	IEXPLORE.EXE
564	IEXPLORE.EXE
1656	takshost.exe

Suspicious use of WriteProcessMemory 50 IoCs

Processes:

284d5054b870aa65a74bf61eccb5a26ddac39b7ea74d01b75d3b58511ba5664c.exe284d5054b870aa65a74bf61eccb5a26ddac39b7ea74d01b75d3b58511ba5664c.exeiexplore.exetakshost.exetakshost.exe

description	pid	process	target process
PID 1408 wrote to memory of 672	1408	284d5054b870aa65a74bf61eccb5a26ddac39b7ea74d01b75d3b58511ba5664c.exe	284d5054b870aa65a74bf61eccb5a26ddac39b7ea74d01b75d3b58511ba5664c.exe
PID 1408 wrote to memory of 672	1408	284d5054b870aa65a74bf61eccb5a26ddac39b7ea74d01b75d3b58511ba5664c.exe	284d5054b870aa65a74bf61eccb5a26ddac39b7ea74d01b75d3b58511ba5664c.exe
PID 1408 wrote to memory of 672	1408	284d5054b870aa65a74bf61eccb5a26ddac39b7ea74d01b75d3b58511ba5664c.exe	284d5054b870aa65a74bf61eccb5a26ddac39b7ea74d01b75d3b58511ba5664c.exe
PID 1408 wrote to memory of 672	1408	284d5054b870aa65a74bf61eccb5a26ddac39b7ea74d01b75d3b58511ba5664c.exe	284d5054b870aa65a74bf61eccb5a26ddac39b7ea74d01b75d3b58511ba5664c.exe
PID 1408 wrote to memory of 672	1408	284d5054b870aa65a74bf61eccb5a26ddac39b7ea74d01b75d3b58511ba5664c.exe	284d5054b870aa65a74bf61eccb5a26ddac39b7ea74d01b75d3b58511ba5664c.exe
PID 1408 wrote to memory of 672	1408	284d5054b870aa65a74bf61eccb5a26ddac39b7ea74d01b75d3b58511ba5664c.exe	284d5054b870aa65a74bf61eccb5a26ddac39b7ea74d01b75d3b58511ba5664c.exe
PID 1408 wrote to memory of 672	1408	284d5054b870aa65a74bf61eccb5a26ddac39b7ea74d01b75d3b58511ba5664c.exe	284d5054b870aa65a74bf61eccb5a26ddac39b7ea74d01b75d3b58511ba5664c.exe
PID 1408 wrote to memory of 672	1408	284d5054b870aa65a74bf61eccb5a26ddac39b7ea74d01b75d3b58511ba5664c.exe	284d5054b870aa65a74bf61eccb5a26ddac39b7ea74d01b75d3b58511ba5664c.exe
PID 1408 wrote to memory of 672	1408	284d5054b870aa65a74bf61eccb5a26ddac39b7ea74d01b75d3b58511ba5664c.exe	284d5054b870aa65a74bf61eccb5a26ddac39b7ea74d01b75d3b58511ba5664c.exe
PID 1408 wrote to memory of 1804	1408	284d5054b870aa65a74bf61eccb5a26ddac39b7ea74d01b75d3b58511ba5664c.exe	takshost.exe
PID 1408 wrote to memory of 1804	1408	284d5054b870aa65a74bf61eccb5a26ddac39b7ea74d01b75d3b58511ba5664c.exe	takshost.exe
PID 1408 wrote to memory of 1804	1408	284d5054b870aa65a74bf61eccb5a26ddac39b7ea74d01b75d3b58511ba5664c.exe	takshost.exe
PID 1408 wrote to memory of 1804	1408	284d5054b870aa65a74bf61eccb5a26ddac39b7ea74d01b75d3b58511ba5664c.exe	takshost.exe
PID 672 wrote to memory of 1652	672	284d5054b870aa65a74bf61eccb5a26ddac39b7ea74d01b75d3b58511ba5664c.exe	iexplore.exe
PID 672 wrote to memory of 1652	672	284d5054b870aa65a74bf61eccb5a26ddac39b7ea74d01b75d3b58511ba5664c.exe	iexplore.exe
PID 672 wrote to memory of 1652	672	284d5054b870aa65a74bf61eccb5a26ddac39b7ea74d01b75d3b58511ba5664c.exe	iexplore.exe
PID 672 wrote to memory of 1652	672	284d5054b870aa65a74bf61eccb5a26ddac39b7ea74d01b75d3b58511ba5664c.exe	iexplore.exe
PID 1652 wrote to memory of 564	1652	iexplore.exe	IEXPLORE.EXE
PID 1652 wrote to memory of 564	1652	iexplore.exe	IEXPLORE.EXE
PID 1652 wrote to memory of 564	1652	iexplore.exe	IEXPLORE.EXE
PID 1652 wrote to memory of 564	1652	iexplore.exe	IEXPLORE.EXE
PID 1804 wrote to memory of 1656	1804	takshost.exe	takshost.exe
PID 1804 wrote to memory of 1656	1804	takshost.exe	takshost.exe
PID 1804 wrote to memory of 1656	1804	takshost.exe	takshost.exe
PID 1804 wrote to memory of 1656	1804	takshost.exe	takshost.exe
PID 1804 wrote to memory of 1656	1804	takshost.exe	takshost.exe
PID 1804 wrote to memory of 1656	1804	takshost.exe	takshost.exe
PID 1804 wrote to memory of 1656	1804	takshost.exe	takshost.exe
PID 1804 wrote to memory of 1656	1804	takshost.exe	takshost.exe
PID 1804 wrote to memory of 1656	1804	takshost.exe	takshost.exe
PID 1656 wrote to memory of 1964	1656	takshost.exe	takshost.exe
PID 1656 wrote to memory of 1964	1656	takshost.exe	takshost.exe
PID 1656 wrote to memory of 1964	1656	takshost.exe	takshost.exe
PID 1656 wrote to memory of 1964	1656	takshost.exe	takshost.exe
PID 1656 wrote to memory of 1964	1656	takshost.exe	takshost.exe
PID 1656 wrote to memory of 1964	1656	takshost.exe	takshost.exe
PID 1656 wrote to memory of 1964	1656	takshost.exe	takshost.exe
PID 1656 wrote to memory of 1964	1656	takshost.exe	takshost.exe
PID 1656 wrote to memory of 1964	1656	takshost.exe	takshost.exe
PID 1656 wrote to memory of 1964	1656	takshost.exe	takshost.exe
PID 1656 wrote to memory of 1928	1656	takshost.exe	takshost.exe
PID 1656 wrote to memory of 1928	1656	takshost.exe	takshost.exe
PID 1656 wrote to memory of 1928	1656	takshost.exe	takshost.exe
PID 1656 wrote to memory of 1928	1656	takshost.exe	takshost.exe
PID 1656 wrote to memory of 1928	1656	takshost.exe	takshost.exe
PID 1656 wrote to memory of 1928	1656	takshost.exe	takshost.exe
PID 1656 wrote to memory of 1928	1656	takshost.exe	takshost.exe
PID 1656 wrote to memory of 1928	1656	takshost.exe	takshost.exe
PID 1656 wrote to memory of 1928	1656	takshost.exe	takshost.exe
PID 1656 wrote to memory of 1928	1656	takshost.exe	takshost.exe

C:\Users\Admin\AppData\Local\Temp\284d5054b870aa65a74bf61eccb5a26ddac39b7ea74d01b75d3b58511ba5664c.exe
"C:\Users\Admin\AppData\Local\Temp\284d5054b870aa65a74bf61eccb5a26ddac39b7ea74d01b75d3b58511ba5664c.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1408

C:\Users\Admin\AppData\Local\Temp\284d5054b870aa65a74bf61eccb5a26ddac39b7ea74d01b75d3b58511ba5664c.exe
"C:\Users\Admin\AppData\Local\Temp\284d5054b870aa65a74bf61eccb5a26ddac39b7ea74d01b75d3b58511ba5664c.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:672

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=284d5054b870aa65a74bf61eccb5a26ddac39b7ea74d01b75d3b58511ba5664c.exe&platform=0009&osver=5&isServer=0&shimver=4.0.30319.0
3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1652

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1652 CREDAT:275457 /prefetch:2
4⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:564

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\takshost.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\takshost.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1804

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\takshost.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\takshost.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1656

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\takshost.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\takshost.exe" /stext C:\ProgramData\Mails.txt
4⤵
- Accesses Microsoft Outlook accounts
PID:1964

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\takshost.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\takshost.exe" /stext C:\ProgramData\Browsers.txt
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:1928

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Browsers.txt
Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\9G68GAZY.txt
Filesize
595B

MD5
25bf79774ac46a1c93e1584f652e4260

SHA1
765344ddc6ec410e8f8d15a7c8a1ab09a16215c5

SHA256
8acb8cfefa6c8954d3dd5ccc678f0f6eab894caec3f549e5be2817cf508b34f0

SHA512
60fd15eb4e1aecf871c17d03e5f1fe9243620907d683c6cea14c870530598b7df4646aa4a67b22006279240738636752d0de5df04a9fba723bac72d633e809b5

Download Submit
memory/672-67-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/672-57-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/672-58-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/672-60-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/672-61-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/672-62-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/672-63-0x00000000004784FE-mapping.dmp

Download
memory/672-65-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/1408-54-0x00000000750A1000-0x00000000750A3000-memory.dmp

Filesize
8KB

Download
memory/1408-55-0x0000000074290000-0x000000007483B000-memory.dmp

Filesize
5.7MB

Download
memory/1408-70-0x0000000074290000-0x000000007483B000-memory.dmp

Filesize
5.7MB

Download
memory/1408-56-0x0000000074290000-0x000000007483B000-memory.dmp

Filesize
5.7MB

Download
memory/1656-80-0x00000000004784FE-mapping.dmp

Download
memory/1656-119-0x0000000074290000-0x000000007483B000-memory.dmp

Filesize
5.7MB

Download
memory/1656-97-0x0000000074290000-0x000000007483B000-memory.dmp

Filesize
5.7MB

Download
memory/1804-73-0x0000000074290000-0x000000007483B000-memory.dmp

Filesize
5.7MB

Download
memory/1804-84-0x0000000074290000-0x000000007483B000-memory.dmp

Filesize
5.7MB

Download
memory/1804-71-0x0000000074290000-0x000000007483B000-memory.dmp

Filesize
5.7MB

Download
memory/1804-68-0x0000000000000000-mapping.dmp

Download
memory/1928-106-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/1928-108-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/1928-117-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/1928-116-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/1928-113-0x0000000000442F58-mapping.dmp

Download
memory/1928-112-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/1928-110-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/1928-103-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/1928-104-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/1964-101-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1964-90-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1964-102-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1964-93-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1964-100-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1964-95-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1964-96-0x0000000000411714-mapping.dmp

Download
memory/1964-92-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1964-88-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1964-87-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads