agenttesla | d61fdb59b0176c8e329052c1b577dd366f17f206b79769bf3ae56ed6d52575de

Analysis

max time kernel
147s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231127-en
resource tags

arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system
submitted
12-12-2023 14:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Bank_Confirmation.exe
Size

882KB
MD5

f82b121e447bb312a0c383d78a90490f
SHA1

a2570c68231136bb0d7b260f906d1e5a78c25f48
SHA256

d61fdb59b0176c8e329052c1b577dd366f17f206b79769bf3ae56ed6d52575de
SHA512

cfcf833f59f3f47aea75ea62b79d5ca57fcad8e56943bb60cd4af0212baf3c6720d9f991a3dd8964a9e272b2b82f0416fa5d06988e90dc9fda2a0e56d649dc31
SSDEEP

12288:r6zcyAwHWZJOLMZ7vgg24T4xT0Wm6y7+uSm0POeB83mAQuaPc19LW1lVmt1XS/2E:r6TH2gK0xxm64+ut1F2fuaG35Cy

Score

10^/10

agenttesla zgrat keylogger persistence rat spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.bezzleauto.com
Port:
587
Username:
[email protected]
Password:
kex#-rHjHM4qKk52
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Detect ZGRat V1 34 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4584-2-0x0000000004FC0000-0x0000000005068000-memory.dmp	family_zgrat_v1
behavioral2/memory/4584-4-0x0000000004FC0000-0x0000000005063000-memory.dmp	family_zgrat_v1
behavioral2/memory/4584-5-0x0000000004FC0000-0x0000000005063000-memory.dmp	family_zgrat_v1
behavioral2/memory/4584-7-0x0000000004FC0000-0x0000000005063000-memory.dmp	family_zgrat_v1
behavioral2/memory/4584-9-0x0000000004FC0000-0x0000000005063000-memory.dmp	family_zgrat_v1
behavioral2/memory/4584-11-0x0000000004FC0000-0x0000000005063000-memory.dmp	family_zgrat_v1
behavioral2/memory/4584-13-0x0000000004FC0000-0x0000000005063000-memory.dmp	family_zgrat_v1
behavioral2/memory/4584-15-0x0000000004FC0000-0x0000000005063000-memory.dmp	family_zgrat_v1
behavioral2/memory/4584-17-0x0000000004FC0000-0x0000000005063000-memory.dmp	family_zgrat_v1
behavioral2/memory/4584-21-0x0000000004FC0000-0x0000000005063000-memory.dmp	family_zgrat_v1
behavioral2/memory/4584-19-0x0000000004FC0000-0x0000000005063000-memory.dmp	family_zgrat_v1
behavioral2/memory/4584-23-0x0000000004FC0000-0x0000000005063000-memory.dmp	family_zgrat_v1
behavioral2/memory/4584-25-0x0000000004FC0000-0x0000000005063000-memory.dmp	family_zgrat_v1
behavioral2/memory/4584-29-0x0000000004FC0000-0x0000000005063000-memory.dmp	family_zgrat_v1
behavioral2/memory/4584-27-0x0000000004FC0000-0x0000000005063000-memory.dmp	family_zgrat_v1
behavioral2/memory/4584-31-0x0000000004FC0000-0x0000000005063000-memory.dmp	family_zgrat_v1
behavioral2/memory/4584-33-0x0000000004FC0000-0x0000000005063000-memory.dmp	family_zgrat_v1
behavioral2/memory/4584-35-0x0000000004FC0000-0x0000000005063000-memory.dmp	family_zgrat_v1
behavioral2/memory/4584-37-0x0000000004FC0000-0x0000000005063000-memory.dmp	family_zgrat_v1
behavioral2/memory/4584-39-0x0000000004FC0000-0x0000000005063000-memory.dmp	family_zgrat_v1
behavioral2/memory/4584-41-0x0000000004FC0000-0x0000000005063000-memory.dmp	family_zgrat_v1
behavioral2/memory/4584-43-0x0000000004FC0000-0x0000000005063000-memory.dmp	family_zgrat_v1
behavioral2/memory/4584-49-0x0000000004FC0000-0x0000000005063000-memory.dmp	family_zgrat_v1
behavioral2/memory/4584-47-0x0000000004FC0000-0x0000000005063000-memory.dmp	family_zgrat_v1
behavioral2/memory/4584-45-0x0000000004FC0000-0x0000000005063000-memory.dmp	family_zgrat_v1
behavioral2/memory/4584-51-0x0000000004FC0000-0x0000000005063000-memory.dmp	family_zgrat_v1
behavioral2/memory/4584-53-0x0000000004FC0000-0x0000000005063000-memory.dmp	family_zgrat_v1
behavioral2/memory/4584-55-0x0000000004FC0000-0x0000000005063000-memory.dmp	family_zgrat_v1
behavioral2/memory/4584-59-0x0000000004FC0000-0x0000000005063000-memory.dmp	family_zgrat_v1
behavioral2/memory/4584-57-0x0000000004FC0000-0x0000000005063000-memory.dmp	family_zgrat_v1
behavioral2/memory/4584-61-0x0000000004FC0000-0x0000000005063000-memory.dmp	family_zgrat_v1
behavioral2/memory/4584-63-0x0000000004FC0000-0x0000000005063000-memory.dmp	family_zgrat_v1
behavioral2/memory/4584-65-0x0000000004FC0000-0x0000000005063000-memory.dmp	family_zgrat_v1
behavioral2/memory/4584-67-0x0000000004FC0000-0x0000000005063000-memory.dmp	family_zgrat_v1

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Bank_Confirmation.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2598572287-1024438387-935107970-1000\Control Panel\International\Geo\Nation	Bank_Confirmation.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

Bank_Confirmation.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2598572287-1024438387-935107970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pdf = "C:\\Users\\Admin\\AppData\\Roaming\\pdf.exe"	Bank_Confirmation.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

Bank_Confirmation.exe

description pid process target process

PID 4584 set thread context of 624 4584 Bank_Confirmation.exe Bank_Confirmation.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	pid	process	target process
PID 4584 set thread context of 624	4584	Bank_Confirmation.exe	Bank_Confirmation.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.

System Information Discovery
T1082

Command and Scripting Interpreter
T1059

Processes:

ipconfig.exeipconfig.exe

pid process

1856 ipconfig.exe
1480 ipconfig.exe

pid	process
1856	ipconfig.exe
1480	ipconfig.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

Bank_Confirmation.exepowershell.exemsedge.exemsedge.exeBank_Confirmation.exeidentity_helper.exe

pid	process
4584	Bank_Confirmation.exe
2488	powershell.exe
2488	powershell.exe
4124	msedge.exe
4124	msedge.exe
1696	msedge.exe
1696	msedge.exe
624	Bank_Confirmation.exe
624	Bank_Confirmation.exe
624	Bank_Confirmation.exe
1880	identity_helper.exe
1880	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

msedge.exe

pid process

1696 msedge.exe
1696 msedge.exe
1696 msedge.exe
1696 msedge.exe
1696 msedge.exe
1696 msedge.exe
1696 msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

Bank_Confirmation.exepowershell.exeBank_Confirmation.exe

description	pid	process
Token: SeDebugPrivilege	4584	Bank_Confirmation.exe
Token: SeDebugPrivilege	2488	powershell.exe
Token: SeDebugPrivilege	624	Bank_Confirmation.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Bank_Confirmation.execmd.execmd.exemsedge.exemsedge.exe

description	pid	process	target process
PID 4584 wrote to memory of 2508	4584	Bank_Confirmation.exe	cmd.exe
PID 4584 wrote to memory of 2508	4584	Bank_Confirmation.exe	cmd.exe
PID 4584 wrote to memory of 2508	4584	Bank_Confirmation.exe	cmd.exe
PID 2508 wrote to memory of 1480	2508	cmd.exe	ipconfig.exe
PID 2508 wrote to memory of 1480	2508	cmd.exe	ipconfig.exe
PID 2508 wrote to memory of 1480	2508	cmd.exe	ipconfig.exe
PID 4584 wrote to memory of 2488	4584	Bank_Confirmation.exe	powershell.exe
PID 4584 wrote to memory of 2488	4584	Bank_Confirmation.exe	powershell.exe
PID 4584 wrote to memory of 2488	4584	Bank_Confirmation.exe	powershell.exe
PID 4584 wrote to memory of 1184	4584	Bank_Confirmation.exe	cmd.exe
PID 4584 wrote to memory of 1184	4584	Bank_Confirmation.exe	cmd.exe
PID 4584 wrote to memory of 1184	4584	Bank_Confirmation.exe	cmd.exe
PID 1184 wrote to memory of 1856	1184	cmd.exe	ipconfig.exe
PID 1184 wrote to memory of 1856	1184	cmd.exe	ipconfig.exe
PID 1184 wrote to memory of 1856	1184	cmd.exe	ipconfig.exe
PID 2488 wrote to memory of 1696	2488	msedge.exe	msedge.exe
PID 2488 wrote to memory of 1696	2488	msedge.exe	msedge.exe
PID 1696 wrote to memory of 4504	1696	msedge.exe	msedge.exe
PID 1696 wrote to memory of 4504	1696	msedge.exe	msedge.exe
PID 1696 wrote to memory of 4764	1696	msedge.exe	msedge.exe
PID 1696 wrote to memory of 4764	1696	msedge.exe	msedge.exe
PID 1696 wrote to memory of 4764	1696	msedge.exe	msedge.exe
PID 1696 wrote to memory of 4764	1696	msedge.exe	msedge.exe
PID 1696 wrote to memory of 4764	1696	msedge.exe	msedge.exe
PID 1696 wrote to memory of 4764	1696	msedge.exe	msedge.exe
PID 1696 wrote to memory of 4764	1696	msedge.exe	msedge.exe
PID 1696 wrote to memory of 4764	1696	msedge.exe	msedge.exe
PID 1696 wrote to memory of 4764	1696	msedge.exe	msedge.exe
PID 1696 wrote to memory of 4764	1696	msedge.exe	msedge.exe
PID 1696 wrote to memory of 4764	1696	msedge.exe	msedge.exe
PID 1696 wrote to memory of 4764	1696	msedge.exe	msedge.exe
PID 1696 wrote to memory of 4764	1696	msedge.exe	msedge.exe
PID 1696 wrote to memory of 4764	1696	msedge.exe	msedge.exe
PID 1696 wrote to memory of 4764	1696	msedge.exe	msedge.exe
PID 1696 wrote to memory of 4764	1696	msedge.exe	msedge.exe
PID 1696 wrote to memory of 4764	1696	msedge.exe	msedge.exe
PID 1696 wrote to memory of 4764	1696	msedge.exe	msedge.exe
PID 1696 wrote to memory of 4764	1696	msedge.exe	msedge.exe
PID 1696 wrote to memory of 4764	1696	msedge.exe	msedge.exe
PID 1696 wrote to memory of 4764	1696	msedge.exe	msedge.exe
PID 1696 wrote to memory of 4764	1696	msedge.exe	msedge.exe
PID 1696 wrote to memory of 4764	1696	msedge.exe	msedge.exe
PID 1696 wrote to memory of 4764	1696	msedge.exe	msedge.exe
PID 1696 wrote to memory of 4764	1696	msedge.exe	msedge.exe
PID 1696 wrote to memory of 4764	1696	msedge.exe	msedge.exe
PID 1696 wrote to memory of 4764	1696	msedge.exe	msedge.exe
PID 1696 wrote to memory of 4764	1696	msedge.exe	msedge.exe
PID 1696 wrote to memory of 4764	1696	msedge.exe	msedge.exe
PID 1696 wrote to memory of 4764	1696	msedge.exe	msedge.exe
PID 1696 wrote to memory of 4764	1696	msedge.exe	msedge.exe
PID 1696 wrote to memory of 4764	1696	msedge.exe	msedge.exe
PID 1696 wrote to memory of 4764	1696	msedge.exe	msedge.exe
PID 1696 wrote to memory of 4764	1696	msedge.exe	msedge.exe
PID 1696 wrote to memory of 4764	1696	msedge.exe	msedge.exe
PID 1696 wrote to memory of 4764	1696	msedge.exe	msedge.exe
PID 1696 wrote to memory of 4764	1696	msedge.exe	msedge.exe
PID 1696 wrote to memory of 4764	1696	msedge.exe	msedge.exe
PID 1696 wrote to memory of 4764	1696	msedge.exe	msedge.exe
PID 1696 wrote to memory of 4764	1696	msedge.exe	msedge.exe
PID 1696 wrote to memory of 4124	1696	msedge.exe	msedge.exe
PID 1696 wrote to memory of 4124	1696	msedge.exe	msedge.exe
PID 1696 wrote to memory of 4204	1696	msedge.exe	msedge.exe
PID 1696 wrote to memory of 4204	1696	msedge.exe	msedge.exe
PID 1696 wrote to memory of 4204	1696	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\Bank_Confirmation.exe
"C:\Users\Admin\AppData\Local\Temp\Bank_Confirmation.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4584

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ipconfig /release
2⤵
- Suspicious use of WriteProcessMemory
PID:2508

C:\Windows\SysWOW64\ipconfig.exe
ipconfig /release
3⤵
- Gathers network information
PID:1480

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACcAaAB0AHQAcABzADoALwAvAGcAbwBvAGcAbABlAC4AYwBvAG0AJwA=
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2488

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.com/
3⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1696

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb0efd46f8,0x7ffb0efd4708,0x7ffb0efd4718
4⤵
PID:4504

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,17842855463212191246,11100516730859322706,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:2
4⤵
PID:4764

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,17842855463212191246,11100516730859322706,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2400 /prefetch:3
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:4124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,17842855463212191246,11100516730859322706,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2688 /prefetch:8
4⤵
PID:4204

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,17842855463212191246,11100516730859322706,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
4⤵
PID:1996

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,17842855463212191246,11100516730859322706,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
4⤵
PID:1604

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,17842855463212191246,11100516730859322706,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4912 /prefetch:1
4⤵
PID:4608

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,17842855463212191246,11100516730859322706,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4916 /prefetch:8
4⤵
PID:2476

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,17842855463212191246,11100516730859322706,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4916 /prefetch:8
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:1880

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,17842855463212191246,11100516730859322706,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:1
4⤵
- Suspicious use of WriteProcessMemory
PID:2488

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,17842855463212191246,11100516730859322706,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4856 /prefetch:1
4⤵
PID:3080

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,17842855463212191246,11100516730859322706,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3936 /prefetch:1
4⤵
PID:760

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,17842855463212191246,11100516730859322706,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4908 /prefetch:1
4⤵
PID:4328

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ipconfig /renew
2⤵
- Suspicious use of WriteProcessMemory
PID:1184

C:\Windows\SysWOW64\ipconfig.exe
ipconfig /renew
3⤵
- Gathers network information
PID:1856

C:\Users\Admin\AppData\Local\Temp\Bank_Confirmation.exe
C:\Users\Admin\AppData\Local\Temp\Bank_Confirmation.exe
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:624

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2552

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2140

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Bank_Confirmation.exe.log

Filesize
927B

MD5
ef1b4e3bfd6facbbb8d6a12f5f5e32de

SHA1
8f3ef66bf86f1697c520303c78b11d58165d146f

SHA256
c652040e1a2f251b1b9e69419d6a53a91e850ea48491b3c54c2ff4a4a2907cd1

SHA512
b6329c2a18217008c5e3544313cd1c7135468c5fb45e5104b9fa2f55a1f14804e66b6b9afcaa8e813cb522f536c06dba32f3afd469c4958a7c57d7df4c0e7315

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9757335dca53b623d3211674e1e5c0e3

SHA1
d66177f71ab5ed83fefece6042269b5b7cd06e72

SHA256
02f0348e2af36f2955efda1613dc6480f1c68c8e55f19590b7b58e9355c6a940

SHA512
f13351398f5dd5b6cf638b174dc50ddc782b690c6d4736d48941923a3425b5dff4a9aa0da22773e9abc9559d40f020f268018db902e0a7772b7b1f4d21126f21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
af942c3e850e4a953243591978e37625

SHA1
313403ccab577a70c12958ccc633c366a708cc85

SHA256
bcb7331f804f460ec461ad810fc80efb397f3fa864ba0fe75ad7ca006e84de59

SHA512
432fcbff88afcda5c157c13eebb49d86c139b3b2eef45e020b7bfcf604f6673ea4ab282b20f781c77feafcd7959f562269a5537658f91ad145a329fcd1511df3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
75cf1473490f4c04f4e680e3ac00c113

SHA1
dec9c170628b6592930b12cd9287e858b27fa92b

SHA256
2014e55c3f8f1b4733e12f1b83aa809df6284056ba766528bb316dcc27522859

SHA512
1377fca49ba64e3b6a352f61e17d2658621172d8532c83b70d9b9bc37c7084c57e0c09ca9a56a782017e2fd2b2a5b640cf4e906a623e75c04772e46b36f0af12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3915067c84ffb8793e4e539dca3fdd15

SHA1
f0e49b10445046d6c2ae9c9df2c1e1e72b92d4db

SHA256
d7a60180b0a4a78f255b8792ddf669f9f0ea775fc126ca3c059351e49c1f6eb2

SHA512
0def3a253693c083878fbb3c2ac7a444d56f24e2446f66359cfa691bc141e9fc0946ff67452dcb0246d05a63f7b09e170094621ce129fe3cd98689ffaec1ee31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
37190b652124344617efb5621d47866b

SHA1
c17adab2dcb2fabe91e635170a7d5ad36d5b9c19

SHA256
2b024317d367d4e8afd4e3bd7c34f83d4cb580beff3aedc03fd6f5d1e51edaaf

SHA512
66c04d98a6f67c886e64f7fd7a01fb37dc76792e8c5fe2152315a2d7da911a482e72dab32bbcf7b3f9c5dcd77d633ae1fce08c03b37ae66a655b4094423fb19d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
c0499655f74785ff5fb5b5abf5b2f488

SHA1
334f08bdb5d7564d1b11e543a2d431bd05b8bdd1

SHA256
6aa332a4d21802b2dbcd08e153764da60f538ceb0daaaaf7504ba8f67c08ef03

SHA512
5f0cec6dd823f2b3ac62017383dbbf71ed38893724312ec75e73fb197e0bcd5418bb70fdfe9150f5ca495d5f8547d8a08618bdacb5010514a3cb1101437d698e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
49a514f6c9203bc498d0996726336da6

SHA1
e8dd8f1a74717aa2b16d233738dc1971dfa92060

SHA256
782e99835d87758fc582a2873e5b7853906ad5178f581de2ddc9311076c54dca

SHA512
a98b4891d929e8372719d93876d48f9d2e6ae55c81a243dd077cc99e4cf8a297417102bcffa1908ac490c1477d1dfae583f893e1884b5ae64622ee968a64b3c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_q2sxbdjf.yq2.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
\??\pipe\LOCAL\crashpad_1696_ATNSUETIYJZHVPIR

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/624-1076-0x00000000069B0000-0x00000000069BA000-memory.dmp

Filesize
40KB

Download
memory/624-1074-0x0000000005760000-0x0000000005770000-memory.dmp

Filesize
64KB

Download
memory/624-1023-0x0000000005760000-0x0000000005770000-memory.dmp

Filesize
64KB

Download
memory/624-1019-0x0000000074AC0000-0x0000000075270000-memory.dmp

Filesize
7.7MB

Download
memory/624-1018-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/624-1075-0x0000000006A00000-0x0000000006A92000-memory.dmp

Filesize
584KB

Download
memory/624-1033-0x0000000006580000-0x000000000661C000-memory.dmp

Filesize
624KB

Download
memory/624-1032-0x0000000006490000-0x00000000064E0000-memory.dmp

Filesize
320KB

Download
memory/624-1073-0x0000000074AC0000-0x0000000075270000-memory.dmp

Filesize
7.7MB

Download
memory/2488-949-0x00000000056F0000-0x0000000005A44000-memory.dmp

Filesize
3.3MB

Download
memory/2488-939-0x0000000005580000-0x00000000055E6000-memory.dmp

Filesize
408KB

Download
memory/2488-954-0x0000000006100000-0x0000000006122000-memory.dmp

Filesize
136KB

Download
memory/2488-952-0x0000000006D60000-0x0000000006DF6000-memory.dmp

Filesize
600KB

Download
memory/2488-951-0x0000000005BD0000-0x0000000005C1C000-memory.dmp

Filesize
304KB

Download
memory/2488-950-0x0000000005B90000-0x0000000005BAE000-memory.dmp

Filesize
120KB

Download
memory/2488-953-0x0000000006080000-0x000000000609A000-memory.dmp

Filesize
104KB

Download
memory/2488-931-0x0000000074AC0000-0x0000000075270000-memory.dmp

Filesize
7.7MB

Download
memory/2488-958-0x0000000074AC0000-0x0000000075270000-memory.dmp

Filesize
7.7MB

Download
memory/2488-938-0x0000000004D60000-0x0000000004DC6000-memory.dmp

Filesize
408KB

Download
memory/2488-937-0x0000000004CC0000-0x0000000004CE2000-memory.dmp

Filesize
136KB

Download
memory/2488-936-0x0000000004EE0000-0x0000000005508000-memory.dmp

Filesize
6.2MB

Download
memory/2488-935-0x0000000002820000-0x0000000002830000-memory.dmp

Filesize
64KB

Download
memory/2488-932-0x0000000002230000-0x0000000002266000-memory.dmp

Filesize
216KB

Download
memory/2488-934-0x0000000002820000-0x0000000002830000-memory.dmp

Filesize
64KB

Download
memory/4584-33-0x0000000004FC0000-0x0000000005063000-memory.dmp

Filesize
652KB

Download
memory/4584-37-0x0000000004FC0000-0x0000000005063000-memory.dmp

Filesize
652KB

Download
memory/4584-926-0x0000000004EF0000-0x0000000004EF1000-memory.dmp

Filesize
4KB

Download
memory/4584-927-0x00000000050A0000-0x00000000050E2000-memory.dmp

Filesize
264KB

Download
memory/4584-928-0x00000000050E0000-0x000000000512C000-memory.dmp

Filesize
304KB

Download
memory/4584-929-0x0000000074AC0000-0x0000000075270000-memory.dmp

Filesize
7.7MB

Download
memory/4584-65-0x0000000004FC0000-0x0000000005063000-memory.dmp

Filesize
652KB

Download
memory/4584-930-0x00000000064C0000-0x0000000006A64000-memory.dmp

Filesize
5.6MB

Download
memory/4584-63-0x0000000004FC0000-0x0000000005063000-memory.dmp

Filesize
652KB

Download
memory/4584-61-0x0000000004FC0000-0x0000000005063000-memory.dmp

Filesize
652KB

Download
memory/4584-57-0x0000000004FC0000-0x0000000005063000-memory.dmp

Filesize
652KB

Download
memory/4584-59-0x0000000004FC0000-0x0000000005063000-memory.dmp

Filesize
652KB

Download
memory/4584-55-0x0000000004FC0000-0x0000000005063000-memory.dmp

Filesize
652KB

Download
memory/4584-53-0x0000000004FC0000-0x0000000005063000-memory.dmp

Filesize
652KB

Download
memory/4584-51-0x0000000004FC0000-0x0000000005063000-memory.dmp

Filesize
652KB

Download
memory/4584-45-0x0000000004FC0000-0x0000000005063000-memory.dmp

Filesize
652KB

Download
memory/4584-47-0x0000000004FC0000-0x0000000005063000-memory.dmp

Filesize
652KB

Download
memory/4584-49-0x0000000004FC0000-0x0000000005063000-memory.dmp

Filesize
652KB

Download
memory/4584-43-0x0000000004FC0000-0x0000000005063000-memory.dmp

Filesize
652KB

Download
memory/4584-41-0x0000000004FC0000-0x0000000005063000-memory.dmp

Filesize
652KB

Download
memory/4584-39-0x0000000004FC0000-0x0000000005063000-memory.dmp

Filesize
652KB

Download
memory/4584-67-0x0000000004FC0000-0x0000000005063000-memory.dmp

Filesize
652KB

Download
memory/4584-35-0x0000000004FC0000-0x0000000005063000-memory.dmp

Filesize
652KB

Download
memory/4584-0-0x0000000000510000-0x00000000005F2000-memory.dmp

Filesize
904KB

Download
memory/4584-31-0x0000000004FC0000-0x0000000005063000-memory.dmp

Filesize
652KB

Download
memory/4584-27-0x0000000004FC0000-0x0000000005063000-memory.dmp

Filesize
652KB

Download
memory/4584-29-0x0000000004FC0000-0x0000000005063000-memory.dmp

Filesize
652KB

Download
memory/4584-25-0x0000000004FC0000-0x0000000005063000-memory.dmp

Filesize
652KB

Download
memory/4584-23-0x0000000004FC0000-0x0000000005063000-memory.dmp

Filesize
652KB

Download
memory/4584-1020-0x0000000074AC0000-0x0000000075270000-memory.dmp

Filesize
7.7MB

Download
memory/4584-19-0x0000000004FC0000-0x0000000005063000-memory.dmp

Filesize
652KB

Download
memory/4584-21-0x0000000004FC0000-0x0000000005063000-memory.dmp

Filesize
652KB

Download
memory/4584-17-0x0000000004FC0000-0x0000000005063000-memory.dmp

Filesize
652KB

Download
memory/4584-15-0x0000000004FC0000-0x0000000005063000-memory.dmp

Filesize
652KB

Download
memory/4584-13-0x0000000004FC0000-0x0000000005063000-memory.dmp

Filesize
652KB

Download
memory/4584-11-0x0000000004FC0000-0x0000000005063000-memory.dmp

Filesize
652KB

Download
memory/4584-9-0x0000000004FC0000-0x0000000005063000-memory.dmp

Filesize
652KB

Download
memory/4584-7-0x0000000004FC0000-0x0000000005063000-memory.dmp

Filesize
652KB

Download
memory/4584-5-0x0000000004FC0000-0x0000000005063000-memory.dmp

Filesize
652KB

Download
memory/4584-4-0x0000000004FC0000-0x0000000005063000-memory.dmp

Filesize
652KB

Download
memory/4584-3-0x0000000004F40000-0x0000000004F50000-memory.dmp

Filesize
64KB

Download
memory/4584-2-0x0000000004FC0000-0x0000000005068000-memory.dmp

Filesize
672KB

Download
memory/4584-1-0x0000000074AC0000-0x0000000075270000-memory.dmp

Filesize
7.7MB

Download