agenttesla | d61fdb59b0176c8e329052c1b577dd366f17f206b79769bf3ae56ed6d52575de

Analysis

max time kernel
147s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20231130-en
resource tags

arch:x64arch:x86image:win10v2004-20231130-enlocale:en-usos:windows10-2004-x64system
submitted
12-12-2023 14:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Bank_Confirmation.exe
Size

882KB
MD5

f82b121e447bb312a0c383d78a90490f
SHA1

a2570c68231136bb0d7b260f906d1e5a78c25f48
SHA256

d61fdb59b0176c8e329052c1b577dd366f17f206b79769bf3ae56ed6d52575de
SHA512

cfcf833f59f3f47aea75ea62b79d5ca57fcad8e56943bb60cd4af0212baf3c6720d9f991a3dd8964a9e272b2b82f0416fa5d06988e90dc9fda2a0e56d649dc31
SSDEEP

12288:r6zcyAwHWZJOLMZ7vgg24T4xT0Wm6y7+uSm0POeB83mAQuaPc19LW1lVmt1XS/2E:r6TH2gK0xxm64+ut1F2fuaG35Cy

Score

10^/10

agenttesla zgrat keylogger persistence rat spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.bezzleauto.com
Port:
587
Username:
[email protected]
Password:
kex#-rHjHM4qKk52
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Detect ZGRat V1 34 IoCs

Processes:

resource	yara_rule
behavioral2/memory/760-2-0x0000000004EF0000-0x0000000004F98000-memory.dmp	family_zgrat_v1
behavioral2/memory/760-4-0x0000000004EF0000-0x0000000004F93000-memory.dmp	family_zgrat_v1
behavioral2/memory/760-5-0x0000000004EF0000-0x0000000004F93000-memory.dmp	family_zgrat_v1
behavioral2/memory/760-7-0x0000000004EF0000-0x0000000004F93000-memory.dmp	family_zgrat_v1
behavioral2/memory/760-9-0x0000000004EF0000-0x0000000004F93000-memory.dmp	family_zgrat_v1
behavioral2/memory/760-15-0x0000000004EF0000-0x0000000004F93000-memory.dmp	family_zgrat_v1
behavioral2/memory/760-13-0x0000000004EF0000-0x0000000004F93000-memory.dmp	family_zgrat_v1
behavioral2/memory/760-11-0x0000000004EF0000-0x0000000004F93000-memory.dmp	family_zgrat_v1
behavioral2/memory/760-17-0x0000000004EF0000-0x0000000004F93000-memory.dmp	family_zgrat_v1
behavioral2/memory/760-25-0x0000000004EF0000-0x0000000004F93000-memory.dmp	family_zgrat_v1
behavioral2/memory/760-29-0x0000000004EF0000-0x0000000004F93000-memory.dmp	family_zgrat_v1
behavioral2/memory/760-35-0x0000000004EF0000-0x0000000004F93000-memory.dmp	family_zgrat_v1
behavioral2/memory/760-33-0x0000000004EF0000-0x0000000004F93000-memory.dmp	family_zgrat_v1
behavioral2/memory/760-45-0x0000000004EF0000-0x0000000004F93000-memory.dmp	family_zgrat_v1
behavioral2/memory/760-47-0x0000000004EF0000-0x0000000004F93000-memory.dmp	family_zgrat_v1
behavioral2/memory/760-43-0x0000000004EF0000-0x0000000004F93000-memory.dmp	family_zgrat_v1
behavioral2/memory/760-61-0x0000000004EF0000-0x0000000004F93000-memory.dmp	family_zgrat_v1
behavioral2/memory/760-63-0x0000000004EF0000-0x0000000004F93000-memory.dmp	family_zgrat_v1
behavioral2/memory/760-59-0x0000000004EF0000-0x0000000004F93000-memory.dmp	family_zgrat_v1
behavioral2/memory/760-57-0x0000000004EF0000-0x0000000004F93000-memory.dmp	family_zgrat_v1
behavioral2/memory/760-65-0x0000000004EF0000-0x0000000004F93000-memory.dmp	family_zgrat_v1
behavioral2/memory/760-67-0x0000000004EF0000-0x0000000004F93000-memory.dmp	family_zgrat_v1
behavioral2/memory/760-55-0x0000000004EF0000-0x0000000004F93000-memory.dmp	family_zgrat_v1
behavioral2/memory/760-53-0x0000000004EF0000-0x0000000004F93000-memory.dmp	family_zgrat_v1
behavioral2/memory/760-51-0x0000000004EF0000-0x0000000004F93000-memory.dmp	family_zgrat_v1
behavioral2/memory/760-49-0x0000000004EF0000-0x0000000004F93000-memory.dmp	family_zgrat_v1
behavioral2/memory/760-41-0x0000000004EF0000-0x0000000004F93000-memory.dmp	family_zgrat_v1
behavioral2/memory/760-39-0x0000000004EF0000-0x0000000004F93000-memory.dmp	family_zgrat_v1
behavioral2/memory/760-37-0x0000000004EF0000-0x0000000004F93000-memory.dmp	family_zgrat_v1
behavioral2/memory/760-31-0x0000000004EF0000-0x0000000004F93000-memory.dmp	family_zgrat_v1
behavioral2/memory/760-27-0x0000000004EF0000-0x0000000004F93000-memory.dmp	family_zgrat_v1
behavioral2/memory/760-23-0x0000000004EF0000-0x0000000004F93000-memory.dmp	family_zgrat_v1
behavioral2/memory/760-21-0x0000000004EF0000-0x0000000004F93000-memory.dmp	family_zgrat_v1
behavioral2/memory/760-19-0x0000000004EF0000-0x0000000004F93000-memory.dmp	family_zgrat_v1

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Bank_Confirmation.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1791582586-1997866593-3795608343-1000\Control Panel\International\Geo\Nation	Bank_Confirmation.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

Bank_Confirmation.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1791582586-1997866593-3795608343-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pdf = "C:\\Users\\Admin\\AppData\\Roaming\\pdf.exe"	Bank_Confirmation.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

Bank_Confirmation.exe

description pid process target process

PID 760 set thread context of 5088 760 Bank_Confirmation.exe Bank_Confirmation.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	pid	process	target process
PID 760 set thread context of 5088	760	Bank_Confirmation.exe	Bank_Confirmation.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.

System Information Discovery
T1082

Command and Scripting Interpreter
T1059

Processes:

ipconfig.exeipconfig.exe

pid process

960 ipconfig.exe
1356 ipconfig.exe

pid	process
960	ipconfig.exe
1356	ipconfig.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

Bank_Confirmation.exepowershell.exemsedge.exemsedge.exeBank_Confirmation.exeidentity_helper.exe

pid	process
760	Bank_Confirmation.exe
4388	powershell.exe
4388	powershell.exe
4724	msedge.exe
4724	msedge.exe
1916	msedge.exe
1916	msedge.exe
5088	Bank_Confirmation.exe
5088	Bank_Confirmation.exe
5088	Bank_Confirmation.exe
464	identity_helper.exe
464	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

Processes:

msedge.exe

pid process

1916 msedge.exe
1916 msedge.exe
1916 msedge.exe
1916 msedge.exe
1916 msedge.exe
1916 msedge.exe
1916 msedge.exe
1916 msedge.exe
1916 msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

Bank_Confirmation.exepowershell.exeBank_Confirmation.exe

description	pid	process
Token: SeDebugPrivilege	760	Bank_Confirmation.exe
Token: SeDebugPrivilege	4388	powershell.exe
Token: SeDebugPrivilege	5088	Bank_Confirmation.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Bank_Confirmation.execmd.execmd.exepowershell.exemsedge.exe

description	pid	process	target process
PID 760 wrote to memory of 1732	760	Bank_Confirmation.exe	cmd.exe
PID 760 wrote to memory of 1732	760	Bank_Confirmation.exe	cmd.exe
PID 760 wrote to memory of 1732	760	Bank_Confirmation.exe	cmd.exe
PID 1732 wrote to memory of 960	1732	cmd.exe	ipconfig.exe
PID 1732 wrote to memory of 960	1732	cmd.exe	ipconfig.exe
PID 1732 wrote to memory of 960	1732	cmd.exe	ipconfig.exe
PID 760 wrote to memory of 4388	760	Bank_Confirmation.exe	powershell.exe
PID 760 wrote to memory of 4388	760	Bank_Confirmation.exe	powershell.exe
PID 760 wrote to memory of 4388	760	Bank_Confirmation.exe	powershell.exe
PID 760 wrote to memory of 2944	760	Bank_Confirmation.exe	cmd.exe
PID 760 wrote to memory of 2944	760	Bank_Confirmation.exe	cmd.exe
PID 760 wrote to memory of 2944	760	Bank_Confirmation.exe	cmd.exe
PID 2944 wrote to memory of 1356	2944	cmd.exe	ipconfig.exe
PID 2944 wrote to memory of 1356	2944	cmd.exe	ipconfig.exe
PID 2944 wrote to memory of 1356	2944	cmd.exe	ipconfig.exe
PID 4388 wrote to memory of 1916	4388	powershell.exe	msedge.exe
PID 4388 wrote to memory of 1916	4388	powershell.exe	msedge.exe
PID 1916 wrote to memory of 1844	1916	msedge.exe	msedge.exe
PID 1916 wrote to memory of 1844	1916	msedge.exe	msedge.exe
PID 1916 wrote to memory of 3876	1916	msedge.exe	msedge.exe
PID 1916 wrote to memory of 3876	1916	msedge.exe	msedge.exe
PID 1916 wrote to memory of 3876	1916	msedge.exe	msedge.exe
PID 1916 wrote to memory of 3876	1916	msedge.exe	msedge.exe
PID 1916 wrote to memory of 3876	1916	msedge.exe	msedge.exe
PID 1916 wrote to memory of 3876	1916	msedge.exe	msedge.exe
PID 1916 wrote to memory of 3876	1916	msedge.exe	msedge.exe
PID 1916 wrote to memory of 3876	1916	msedge.exe	msedge.exe
PID 1916 wrote to memory of 3876	1916	msedge.exe	msedge.exe
PID 1916 wrote to memory of 3876	1916	msedge.exe	msedge.exe
PID 1916 wrote to memory of 3876	1916	msedge.exe	msedge.exe
PID 1916 wrote to memory of 3876	1916	msedge.exe	msedge.exe
PID 1916 wrote to memory of 3876	1916	msedge.exe	msedge.exe
PID 1916 wrote to memory of 3876	1916	msedge.exe	msedge.exe
PID 1916 wrote to memory of 3876	1916	msedge.exe	msedge.exe
PID 1916 wrote to memory of 3876	1916	msedge.exe	msedge.exe
PID 1916 wrote to memory of 3876	1916	msedge.exe	msedge.exe
PID 1916 wrote to memory of 3876	1916	msedge.exe	msedge.exe
PID 1916 wrote to memory of 3876	1916	msedge.exe	msedge.exe
PID 1916 wrote to memory of 3876	1916	msedge.exe	msedge.exe
PID 1916 wrote to memory of 3876	1916	msedge.exe	msedge.exe
PID 1916 wrote to memory of 3876	1916	msedge.exe	msedge.exe
PID 1916 wrote to memory of 3876	1916	msedge.exe	msedge.exe
PID 1916 wrote to memory of 3876	1916	msedge.exe	msedge.exe
PID 1916 wrote to memory of 3876	1916	msedge.exe	msedge.exe
PID 1916 wrote to memory of 3876	1916	msedge.exe	msedge.exe
PID 1916 wrote to memory of 3876	1916	msedge.exe	msedge.exe
PID 1916 wrote to memory of 3876	1916	msedge.exe	msedge.exe
PID 1916 wrote to memory of 3876	1916	msedge.exe	msedge.exe
PID 1916 wrote to memory of 3876	1916	msedge.exe	msedge.exe
PID 1916 wrote to memory of 3876	1916	msedge.exe	msedge.exe
PID 1916 wrote to memory of 3876	1916	msedge.exe	msedge.exe
PID 1916 wrote to memory of 3876	1916	msedge.exe	msedge.exe
PID 1916 wrote to memory of 3876	1916	msedge.exe	msedge.exe
PID 1916 wrote to memory of 3876	1916	msedge.exe	msedge.exe
PID 1916 wrote to memory of 3876	1916	msedge.exe	msedge.exe
PID 1916 wrote to memory of 3876	1916	msedge.exe	msedge.exe
PID 1916 wrote to memory of 3876	1916	msedge.exe	msedge.exe
PID 1916 wrote to memory of 3876	1916	msedge.exe	msedge.exe
PID 1916 wrote to memory of 3876	1916	msedge.exe	msedge.exe
PID 1916 wrote to memory of 4724	1916	msedge.exe	msedge.exe
PID 1916 wrote to memory of 4724	1916	msedge.exe	msedge.exe
PID 1916 wrote to memory of 548	1916	msedge.exe	msedge.exe
PID 1916 wrote to memory of 548	1916	msedge.exe	msedge.exe
PID 1916 wrote to memory of 548	1916	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\Bank_Confirmation.exe
"C:\Users\Admin\AppData\Local\Temp\Bank_Confirmation.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:760

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ipconfig /release
2⤵
- Suspicious use of WriteProcessMemory
PID:1732

C:\Windows\SysWOW64\ipconfig.exe
ipconfig /release
3⤵
- Gathers network information
PID:960

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACcAaAB0AHQAcABzADoALwAvAGcAbwBvAGcAbABlAC4AYwBvAG0AJwA=
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4388

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.com/
3⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1916

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc51f846f8,0x7ffc51f84708,0x7ffc51f84718
4⤵
PID:1844

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,16229389780834997757,11313888320733814189,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:4724

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,16229389780834997757,11313888320733814189,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
4⤵
PID:3876

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,16229389780834997757,11313888320733814189,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2764 /prefetch:8
4⤵
PID:548

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16229389780834997757,11313888320733814189,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
4⤵
PID:4792

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16229389780834997757,11313888320733814189,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
4⤵
PID:940

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,16229389780834997757,11313888320733814189,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4800 /prefetch:8
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:464

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,16229389780834997757,11313888320733814189,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4800 /prefetch:8
4⤵
PID:3644

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16229389780834997757,11313888320733814189,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5016 /prefetch:1
4⤵
PID:3720

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16229389780834997757,11313888320733814189,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:1
4⤵
PID:3848

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16229389780834997757,11313888320733814189,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3484 /prefetch:1
4⤵
PID:3516

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16229389780834997757,11313888320733814189,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3932 /prefetch:1
4⤵
PID:2012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16229389780834997757,11313888320733814189,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5432 /prefetch:1
4⤵
PID:4320

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16229389780834997757,11313888320733814189,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3468 /prefetch:1
4⤵
PID:4656

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16229389780834997757,11313888320733814189,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1852 /prefetch:1
4⤵
PID:4680

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ipconfig /renew
2⤵
- Suspicious use of WriteProcessMemory
PID:2944

C:\Windows\SysWOW64\ipconfig.exe
ipconfig /renew
3⤵
- Gathers network information
PID:1356

C:\Users\Admin\AppData\Local\Temp\Bank_Confirmation.exe
C:\Users\Admin\AppData\Local\Temp\Bank_Confirmation.exe
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5088

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4836

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Bank_Confirmation.exe.log

Filesize
927B

MD5
ef1b4e3bfd6facbbb8d6a12f5f5e32de

SHA1
8f3ef66bf86f1697c520303c78b11d58165d146f

SHA256
c652040e1a2f251b1b9e69419d6a53a91e850ea48491b3c54c2ff4a4a2907cd1

SHA512
b6329c2a18217008c5e3544313cd1c7135468c5fb45e5104b9fa2f55a1f14804e66b6b9afcaa8e813cb522f536c06dba32f3afd469c4958a7c57d7df4c0e7315

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
330c53ed8d8829bd4caf2c392a894f6b

SHA1
dc4f3eea00d78949be4aded712fcbfe85e6b06a5

SHA256
bbca8b0343812fb9db9b3c59655a18772c7c40bc77f497b89067a82d5e4ce8a5

SHA512
37674d84e4ea2079e8fe9bc45b0ea8fd93ffc8d206547835e4211046ad310ba3e5a397cf444b17a4322f9513cbd91bd92c0b106776b879cb0388ca9386ebd44d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8cbdc670e69c7f6a9f225c94d31911a2

SHA1
db1d571174402a6dcc3a0401f20486d479d79a62

SHA256
15759aa41f6adbe7722cd121c0d6d6f55d2cfb99d4870d36aba7054978081bc9

SHA512
b37ea9d1ae875d5290c4a0138a279b222cc2ab53a9aa61748ac4e5b7531834f279d5d7f57d55031476633c44d82d16260466994ea8dbb0ed2aed70022caeb680

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3605f480fedfcd9c0249185d98ac8e0f

SHA1
bc0e43069a8511afecae91a881be8ff94c59ed15

SHA256
2946136c31c9af971a4eab290c24e3fdd1246dbb8f51ff8f54688391cbb60530

SHA512
1816444ec57865a3ccc7f0226abd6b791be9f511261080394de85b27093775f2b8103d4839d0681ff312eaba1aff6d6e20bebc2c87750c64f88f2da5eb866015

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
4KB

MD5
dd07366f0a5f8745466a48ad90b7b53c

SHA1
ae8fab5f3c822832fb4d2e4ec8634e4f0419259b

SHA256
28d1782162b377b93471d958c29f6c60e7cc452ac3a22533af0916deaa33e898

SHA512
9ff2aeeccab7df766f6acdace5669e00ca8653977338ebeb7b0f22236113287d266ea03cee8acfa0929cef681adf0711745607b2fd21a21233cd50ef70c03d29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
4KB

MD5
d1f2a7797b04a8b110699dd4dc8e84bc

SHA1
b126dae24d0db0e2a81d42828c78b39bd221ee97

SHA256
e9a4412b90279ddab529a2ac61d1f66386d8a79593af79b53f1b12af6aa87985

SHA512
482da15e60c4aa25a03ed1f5bb76eea2f6d9a8823d66a1ef996c3a8de00db01a44923cb792cb65d7c9ea1d15b5c1cb9c1232c9a3cc9a2cbf0cb0eb86810142ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
4KB

MD5
1af42f20dbad17daeee589e85b58a9d3

SHA1
f4d83dacb0665273f20184bc807367bf39d223e1

SHA256
d3e38b290f4a540b7453c45444846594377fd3d54a4e9b030cdb08d301cc043d

SHA512
a07d28ab8360cbc8725754b411f6902ea5c5dcc720fc59fc40ffdd5ac202ff9071982508178d897526b7c2bbfc9700d342420c6b4cd13d8598e09adc0a0f18bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
4KB

MD5
feb2096107783dec34fee841215f4669

SHA1
26fe72adb4adb204228e286b1d76d6746e4c7b30

SHA256
d98ac430d1e7643b0ab2e1c062cec5a222d6db7c4e614ac5c86c1825418eb9f4

SHA512
5fee274cd7bd483f45d0eca4318aa01e84b7bef55e195c0359faa080bf0a40df24709f495418f9ad3739dd46c5fa9256c6134aaffc4b28fc2e734a2f49dadcde

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kyrhy401.xog.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
\??\pipe\LOCAL\crashpad_1916_PPIAXLSSJLVKOLZX

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/760-61-0x0000000004EF0000-0x0000000004F93000-memory.dmp

Filesize
652KB

Download
memory/760-993-0x0000000074C20000-0x00000000753D0000-memory.dmp

Filesize
7.7MB

Download
memory/760-35-0x0000000004EF0000-0x0000000004F93000-memory.dmp

Filesize
652KB

Download
memory/760-33-0x0000000004EF0000-0x0000000004F93000-memory.dmp

Filesize
652KB

Download
memory/760-45-0x0000000004EF0000-0x0000000004F93000-memory.dmp

Filesize
652KB

Download
memory/760-47-0x0000000004EF0000-0x0000000004F93000-memory.dmp

Filesize
652KB

Download
memory/760-43-0x0000000004EF0000-0x0000000004F93000-memory.dmp

Filesize
652KB

Download
memory/760-0-0x00000000004E0000-0x00000000005C2000-memory.dmp

Filesize
904KB

Download
memory/760-63-0x0000000004EF0000-0x0000000004F93000-memory.dmp

Filesize
652KB

Download
memory/760-59-0x0000000004EF0000-0x0000000004F93000-memory.dmp

Filesize
652KB

Download
memory/760-57-0x0000000004EF0000-0x0000000004F93000-memory.dmp

Filesize
652KB

Download
memory/760-65-0x0000000004EF0000-0x0000000004F93000-memory.dmp

Filesize
652KB

Download
memory/760-67-0x0000000004EF0000-0x0000000004F93000-memory.dmp

Filesize
652KB

Download
memory/760-55-0x0000000004EF0000-0x0000000004F93000-memory.dmp

Filesize
652KB

Download
memory/760-53-0x0000000004EF0000-0x0000000004F93000-memory.dmp

Filesize
652KB

Download
memory/760-51-0x0000000004EF0000-0x0000000004F93000-memory.dmp

Filesize
652KB

Download
memory/760-49-0x0000000004EF0000-0x0000000004F93000-memory.dmp

Filesize
652KB

Download
memory/760-41-0x0000000004EF0000-0x0000000004F93000-memory.dmp

Filesize
652KB

Download
memory/760-39-0x0000000004EF0000-0x0000000004F93000-memory.dmp

Filesize
652KB

Download
memory/760-37-0x0000000004EF0000-0x0000000004F93000-memory.dmp

Filesize
652KB

Download
memory/760-31-0x0000000004EF0000-0x0000000004F93000-memory.dmp

Filesize
652KB

Download
memory/760-27-0x0000000004EF0000-0x0000000004F93000-memory.dmp

Filesize
652KB

Download
memory/760-23-0x0000000004EF0000-0x0000000004F93000-memory.dmp

Filesize
652KB

Download
memory/760-21-0x0000000004EF0000-0x0000000004F93000-memory.dmp

Filesize
652KB

Download
memory/760-19-0x0000000004EF0000-0x0000000004F93000-memory.dmp

Filesize
652KB

Download
memory/760-926-0x0000000004FE0000-0x0000000004FE1000-memory.dmp

Filesize
4KB

Download
memory/760-928-0x00000000050A0000-0x00000000050EC000-memory.dmp

Filesize
304KB

Download
memory/760-927-0x0000000005060000-0x00000000050A2000-memory.dmp

Filesize
264KB

Download
memory/760-929-0x0000000074C20000-0x00000000753D0000-memory.dmp

Filesize
7.7MB

Download
memory/760-1-0x0000000074C20000-0x00000000753D0000-memory.dmp

Filesize
7.7MB

Download
memory/760-2-0x0000000004EF0000-0x0000000004F98000-memory.dmp

Filesize
672KB

Download
memory/760-3-0x0000000004FA0000-0x0000000004FB0000-memory.dmp

Filesize
64KB

Download
memory/760-931-0x0000000006390000-0x0000000006934000-memory.dmp

Filesize
5.6MB

Download
memory/760-4-0x0000000004EF0000-0x0000000004F93000-memory.dmp

Filesize
652KB

Download
memory/760-5-0x0000000004EF0000-0x0000000004F93000-memory.dmp

Filesize
652KB

Download
memory/760-7-0x0000000004EF0000-0x0000000004F93000-memory.dmp

Filesize
652KB

Download
memory/760-9-0x0000000004EF0000-0x0000000004F93000-memory.dmp

Filesize
652KB

Download
memory/760-25-0x0000000004EF0000-0x0000000004F93000-memory.dmp

Filesize
652KB

Download
memory/760-29-0x0000000004EF0000-0x0000000004F93000-memory.dmp

Filesize
652KB

Download
memory/760-15-0x0000000004EF0000-0x0000000004F93000-memory.dmp

Filesize
652KB

Download
memory/760-13-0x0000000004EF0000-0x0000000004F93000-memory.dmp

Filesize
652KB

Download
memory/760-11-0x0000000004EF0000-0x0000000004F93000-memory.dmp

Filesize
652KB

Download
memory/760-17-0x0000000004EF0000-0x0000000004F93000-memory.dmp

Filesize
652KB

Download
memory/4388-943-0x0000000006340000-0x00000000063A6000-memory.dmp

Filesize
408KB

Download
memory/4388-948-0x00000000064B0000-0x0000000006804000-memory.dmp

Filesize
3.3MB

Download
memory/4388-953-0x0000000006E70000-0x0000000006E92000-memory.dmp

Filesize
136KB

Download
memory/4388-952-0x0000000006E20000-0x0000000006E3A000-memory.dmp

Filesize
104KB

Download
memory/4388-950-0x0000000006990000-0x00000000069DC000-memory.dmp

Filesize
304KB

Download
memory/4388-949-0x0000000006950000-0x000000000696E000-memory.dmp

Filesize
120KB

Download
memory/4388-957-0x0000000074C20000-0x00000000753D0000-memory.dmp

Filesize
7.7MB

Download
memory/4388-936-0x00000000060C0000-0x00000000060E2000-memory.dmp

Filesize
136KB

Download
memory/4388-933-0x0000000003350000-0x0000000003360000-memory.dmp

Filesize
64KB

Download
memory/4388-932-0x0000000074C20000-0x00000000753D0000-memory.dmp

Filesize
7.7MB

Download
memory/4388-951-0x0000000007920000-0x00000000079B6000-memory.dmp

Filesize
600KB

Download
memory/4388-930-0x00000000033A0000-0x00000000033D6000-memory.dmp

Filesize
216KB

Download
memory/4388-935-0x0000000005A40000-0x0000000006068000-memory.dmp

Filesize
6.2MB

Download
memory/4388-937-0x0000000006260000-0x00000000062C6000-memory.dmp

Filesize
408KB

Download
memory/5088-994-0x0000000074C20000-0x00000000753D0000-memory.dmp

Filesize
7.7MB

Download
memory/5088-996-0x00000000055C0000-0x00000000055D0000-memory.dmp

Filesize
64KB

Download
memory/5088-1034-0x0000000006690000-0x0000000006722000-memory.dmp

Filesize
584KB

Download
memory/5088-1035-0x0000000006640000-0x000000000664A000-memory.dmp

Filesize
40KB

Download
memory/5088-1004-0x0000000006450000-0x00000000064EC000-memory.dmp

Filesize
624KB

Download
memory/5088-1045-0x0000000074C20000-0x00000000753D0000-memory.dmp

Filesize
7.7MB

Download
memory/5088-1046-0x00000000055C0000-0x00000000055D0000-memory.dmp

Filesize
64KB

Download
memory/5088-995-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/5088-1003-0x0000000006360000-0x00000000063B0000-memory.dmp

Filesize
320KB

Download