agenttesla | c3c64f2edc0e3e59c0e1526910c08623981c8c8446f49c0887199f35c4a8f57b

Analysis

max time kernel
157s
max time network
167s
platform
windows10-2004_x64
resource
win10v2004-20231127-en
resource tags

arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system
submitted
12-12-2023 15:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Bank_Confirmation.exe
Size

882KB
MD5

f82b121e447bb312a0c383d78a90490f
SHA1

a2570c68231136bb0d7b260f906d1e5a78c25f48
SHA256

d61fdb59b0176c8e329052c1b577dd366f17f206b79769bf3ae56ed6d52575de
SHA512

cfcf833f59f3f47aea75ea62b79d5ca57fcad8e56943bb60cd4af0212baf3c6720d9f991a3dd8964a9e272b2b82f0416fa5d06988e90dc9fda2a0e56d649dc31
SSDEEP

12288:r6zcyAwHWZJOLMZ7vgg24T4xT0Wm6y7+uSm0POeB83mAQuaPc19LW1lVmt1XS/2E:r6TH2gK0xxm64+ut1F2fuaG35Cy

Score

10^/10

agenttesla zgrat keylogger persistence rat spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.bezzleauto.com
Port:
587
Username:
[email protected]
Password:
kex#-rHjHM4qKk52
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Detect ZGRat V1 34 IoCs

Processes:

resource	yara_rule
behavioral2/memory/228-2-0x00000000054B0000-0x0000000005558000-memory.dmp	family_zgrat_v1
behavioral2/memory/228-4-0x00000000054B0000-0x0000000005553000-memory.dmp	family_zgrat_v1
behavioral2/memory/228-5-0x00000000054B0000-0x0000000005553000-memory.dmp	family_zgrat_v1
behavioral2/memory/228-7-0x00000000054B0000-0x0000000005553000-memory.dmp	family_zgrat_v1
behavioral2/memory/228-9-0x00000000054B0000-0x0000000005553000-memory.dmp	family_zgrat_v1
behavioral2/memory/228-11-0x00000000054B0000-0x0000000005553000-memory.dmp	family_zgrat_v1
behavioral2/memory/228-13-0x00000000054B0000-0x0000000005553000-memory.dmp	family_zgrat_v1
behavioral2/memory/228-15-0x00000000054B0000-0x0000000005553000-memory.dmp	family_zgrat_v1
behavioral2/memory/228-17-0x00000000054B0000-0x0000000005553000-memory.dmp	family_zgrat_v1
behavioral2/memory/228-19-0x00000000054B0000-0x0000000005553000-memory.dmp	family_zgrat_v1
behavioral2/memory/228-21-0x00000000054B0000-0x0000000005553000-memory.dmp	family_zgrat_v1
behavioral2/memory/228-23-0x00000000054B0000-0x0000000005553000-memory.dmp	family_zgrat_v1
behavioral2/memory/228-25-0x00000000054B0000-0x0000000005553000-memory.dmp	family_zgrat_v1
behavioral2/memory/228-27-0x00000000054B0000-0x0000000005553000-memory.dmp	family_zgrat_v1
behavioral2/memory/228-29-0x00000000054B0000-0x0000000005553000-memory.dmp	family_zgrat_v1
behavioral2/memory/228-31-0x00000000054B0000-0x0000000005553000-memory.dmp	family_zgrat_v1
behavioral2/memory/228-33-0x00000000054B0000-0x0000000005553000-memory.dmp	family_zgrat_v1
behavioral2/memory/228-35-0x00000000054B0000-0x0000000005553000-memory.dmp	family_zgrat_v1
behavioral2/memory/228-37-0x00000000054B0000-0x0000000005553000-memory.dmp	family_zgrat_v1
behavioral2/memory/228-39-0x00000000054B0000-0x0000000005553000-memory.dmp	family_zgrat_v1
behavioral2/memory/228-41-0x00000000054B0000-0x0000000005553000-memory.dmp	family_zgrat_v1
behavioral2/memory/228-43-0x00000000054B0000-0x0000000005553000-memory.dmp	family_zgrat_v1
behavioral2/memory/228-45-0x00000000054B0000-0x0000000005553000-memory.dmp	family_zgrat_v1
behavioral2/memory/228-47-0x00000000054B0000-0x0000000005553000-memory.dmp	family_zgrat_v1
behavioral2/memory/228-49-0x00000000054B0000-0x0000000005553000-memory.dmp	family_zgrat_v1
behavioral2/memory/228-51-0x00000000054B0000-0x0000000005553000-memory.dmp	family_zgrat_v1
behavioral2/memory/228-53-0x00000000054B0000-0x0000000005553000-memory.dmp	family_zgrat_v1
behavioral2/memory/228-55-0x00000000054B0000-0x0000000005553000-memory.dmp	family_zgrat_v1
behavioral2/memory/228-59-0x00000000054B0000-0x0000000005553000-memory.dmp	family_zgrat_v1
behavioral2/memory/228-57-0x00000000054B0000-0x0000000005553000-memory.dmp	family_zgrat_v1
behavioral2/memory/228-61-0x00000000054B0000-0x0000000005553000-memory.dmp	family_zgrat_v1
behavioral2/memory/228-63-0x00000000054B0000-0x0000000005553000-memory.dmp	family_zgrat_v1
behavioral2/memory/228-65-0x00000000054B0000-0x0000000005553000-memory.dmp	family_zgrat_v1
behavioral2/memory/228-67-0x00000000054B0000-0x0000000005553000-memory.dmp	family_zgrat_v1

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Bank_Confirmation.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3635043082-2972811465-3176142135-1000\Control Panel\International\Geo\Nation	Bank_Confirmation.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

Bank_Confirmation.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3635043082-2972811465-3176142135-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pdf = "C:\\Users\\Admin\\AppData\\Roaming\\pdf.exe"	Bank_Confirmation.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

Bank_Confirmation.exe

description pid process target process

PID 228 set thread context of 4604 228 Bank_Confirmation.exe Bank_Confirmation.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	pid	process	target process
PID 228 set thread context of 4604	228	Bank_Confirmation.exe	Bank_Confirmation.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.

System Information Discovery
T1082

Command and Scripting Interpreter
T1059

Processes:

ipconfig.exeipconfig.exe

pid process

2348 ipconfig.exe
400 ipconfig.exe

pid	process
2348	ipconfig.exe
400	ipconfig.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

Processes:

Bank_Confirmation.exepowershell.exeBank_Confirmation.exemsedge.exemsedge.exeidentity_helper.exe

pid	process
228	Bank_Confirmation.exe
2344	powershell.exe
2344	powershell.exe
228	Bank_Confirmation.exe
228	Bank_Confirmation.exe
228	Bank_Confirmation.exe
228	Bank_Confirmation.exe
4604	Bank_Confirmation.exe
4604	Bank_Confirmation.exe
4652	msedge.exe
4652	msedge.exe
3464	msedge.exe
3464	msedge.exe
688	identity_helper.exe
688	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

msedge.exe

pid process

3464 msedge.exe
3464 msedge.exe
3464 msedge.exe
3464 msedge.exe
3464 msedge.exe
3464 msedge.exe
3464 msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

Bank_Confirmation.exepowershell.exeBank_Confirmation.exe

description	pid	process
Token: SeDebugPrivilege	228	Bank_Confirmation.exe
Token: SeDebugPrivilege	2344	powershell.exe
Token: SeDebugPrivilege	4604	Bank_Confirmation.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Bank_Confirmation.execmd.execmd.exepowershell.exemsedge.exe

description	pid	process	target process
PID 228 wrote to memory of 1708	228	Bank_Confirmation.exe	cmd.exe
PID 228 wrote to memory of 1708	228	Bank_Confirmation.exe	cmd.exe
PID 228 wrote to memory of 1708	228	Bank_Confirmation.exe	cmd.exe
PID 1708 wrote to memory of 400	1708	cmd.exe	ipconfig.exe
PID 1708 wrote to memory of 400	1708	cmd.exe	ipconfig.exe
PID 1708 wrote to memory of 400	1708	cmd.exe	ipconfig.exe
PID 228 wrote to memory of 2344	228	Bank_Confirmation.exe	powershell.exe
PID 228 wrote to memory of 2344	228	Bank_Confirmation.exe	powershell.exe
PID 228 wrote to memory of 2344	228	Bank_Confirmation.exe	powershell.exe
PID 228 wrote to memory of 4884	228	Bank_Confirmation.exe	cmd.exe
PID 228 wrote to memory of 4884	228	Bank_Confirmation.exe	cmd.exe
PID 228 wrote to memory of 4884	228	Bank_Confirmation.exe	cmd.exe
PID 4884 wrote to memory of 2348	4884	cmd.exe	ipconfig.exe
PID 4884 wrote to memory of 2348	4884	cmd.exe	ipconfig.exe
PID 4884 wrote to memory of 2348	4884	cmd.exe	ipconfig.exe
PID 2344 wrote to memory of 3464	2344	powershell.exe	msedge.exe
PID 2344 wrote to memory of 3464	2344	powershell.exe	msedge.exe
PID 3464 wrote to memory of 3528	3464	msedge.exe	msedge.exe
PID 3464 wrote to memory of 3528	3464	msedge.exe	msedge.exe
PID 228 wrote to memory of 2916	228	Bank_Confirmation.exe	Bank_Confirmation.exe
PID 228 wrote to memory of 2916	228	Bank_Confirmation.exe	Bank_Confirmation.exe
PID 228 wrote to memory of 2916	228	Bank_Confirmation.exe	Bank_Confirmation.exe
PID 228 wrote to memory of 5088	228	Bank_Confirmation.exe	Bank_Confirmation.exe
PID 228 wrote to memory of 5088	228	Bank_Confirmation.exe	Bank_Confirmation.exe
PID 228 wrote to memory of 5088	228	Bank_Confirmation.exe	Bank_Confirmation.exe
PID 228 wrote to memory of 4604	228	Bank_Confirmation.exe	Bank_Confirmation.exe
PID 228 wrote to memory of 4604	228	Bank_Confirmation.exe	Bank_Confirmation.exe
PID 228 wrote to memory of 4604	228	Bank_Confirmation.exe	Bank_Confirmation.exe
PID 228 wrote to memory of 4604	228	Bank_Confirmation.exe	Bank_Confirmation.exe
PID 228 wrote to memory of 4604	228	Bank_Confirmation.exe	Bank_Confirmation.exe
PID 228 wrote to memory of 4604	228	Bank_Confirmation.exe	Bank_Confirmation.exe
PID 228 wrote to memory of 4604	228	Bank_Confirmation.exe	Bank_Confirmation.exe
PID 228 wrote to memory of 4604	228	Bank_Confirmation.exe	Bank_Confirmation.exe
PID 3464 wrote to memory of 1900	3464	msedge.exe	msedge.exe
PID 3464 wrote to memory of 1900	3464	msedge.exe	msedge.exe
PID 3464 wrote to memory of 1900	3464	msedge.exe	msedge.exe
PID 3464 wrote to memory of 1900	3464	msedge.exe	msedge.exe
PID 3464 wrote to memory of 1900	3464	msedge.exe	msedge.exe
PID 3464 wrote to memory of 1900	3464	msedge.exe	msedge.exe
PID 3464 wrote to memory of 1900	3464	msedge.exe	msedge.exe
PID 3464 wrote to memory of 1900	3464	msedge.exe	msedge.exe
PID 3464 wrote to memory of 1900	3464	msedge.exe	msedge.exe
PID 3464 wrote to memory of 1900	3464	msedge.exe	msedge.exe
PID 3464 wrote to memory of 1900	3464	msedge.exe	msedge.exe
PID 3464 wrote to memory of 1900	3464	msedge.exe	msedge.exe
PID 3464 wrote to memory of 1900	3464	msedge.exe	msedge.exe
PID 3464 wrote to memory of 1900	3464	msedge.exe	msedge.exe
PID 3464 wrote to memory of 1900	3464	msedge.exe	msedge.exe
PID 3464 wrote to memory of 1900	3464	msedge.exe	msedge.exe
PID 3464 wrote to memory of 1900	3464	msedge.exe	msedge.exe
PID 3464 wrote to memory of 1900	3464	msedge.exe	msedge.exe
PID 3464 wrote to memory of 1900	3464	msedge.exe	msedge.exe
PID 3464 wrote to memory of 1900	3464	msedge.exe	msedge.exe
PID 3464 wrote to memory of 1900	3464	msedge.exe	msedge.exe
PID 3464 wrote to memory of 1900	3464	msedge.exe	msedge.exe
PID 3464 wrote to memory of 1900	3464	msedge.exe	msedge.exe
PID 3464 wrote to memory of 1900	3464	msedge.exe	msedge.exe
PID 3464 wrote to memory of 1900	3464	msedge.exe	msedge.exe
PID 3464 wrote to memory of 1900	3464	msedge.exe	msedge.exe
PID 3464 wrote to memory of 1900	3464	msedge.exe	msedge.exe
PID 3464 wrote to memory of 1900	3464	msedge.exe	msedge.exe
PID 3464 wrote to memory of 1900	3464	msedge.exe	msedge.exe
PID 3464 wrote to memory of 1900	3464	msedge.exe	msedge.exe
PID 3464 wrote to memory of 1900	3464	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\Bank_Confirmation.exe
"C:\Users\Admin\AppData\Local\Temp\Bank_Confirmation.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:228

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ipconfig /release
2⤵
- Suspicious use of WriteProcessMemory
PID:1708

C:\Windows\SysWOW64\ipconfig.exe
ipconfig /release
3⤵
- Gathers network information
PID:400

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACcAaAB0AHQAcABzADoALwAvAGcAbwBvAGcAbABlAC4AYwBvAG0AJwA=
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2344

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.com/
3⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3464

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffefbb446f8,0x7ffefbb44708,0x7ffefbb44718
4⤵
PID:3528

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2188,6374781534352408860,15146694500986934372,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:3
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:4652

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2188,6374781534352408860,15146694500986934372,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2200 /prefetch:2
4⤵
PID:1900

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2188,6374781534352408860,15146694500986934372,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2776 /prefetch:8
4⤵
PID:4228

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,6374781534352408860,15146694500986934372,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
4⤵
PID:5112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,6374781534352408860,15146694500986934372,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3496 /prefetch:1
4⤵
PID:3848

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,6374781534352408860,15146694500986934372,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4772 /prefetch:1
4⤵
PID:4640

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,6374781534352408860,15146694500986934372,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5344 /prefetch:1
4⤵
PID:4752

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,6374781534352408860,15146694500986934372,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5340 /prefetch:1
4⤵
PID:4428

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2188,6374781534352408860,15146694500986934372,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5732 /prefetch:8
4⤵
PID:2760

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2188,6374781534352408860,15146694500986934372,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5732 /prefetch:8
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:688

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,6374781534352408860,15146694500986934372,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4868 /prefetch:1
4⤵
PID:1768

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,6374781534352408860,15146694500986934372,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:1
4⤵
PID:1076

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ipconfig /renew
2⤵
- Suspicious use of WriteProcessMemory
PID:4884

C:\Windows\SysWOW64\ipconfig.exe
ipconfig /renew
3⤵
- Gathers network information
PID:2348

C:\Users\Admin\AppData\Local\Temp\Bank_Confirmation.exe
C:\Users\Admin\AppData\Local\Temp\Bank_Confirmation.exe
2⤵
PID:2916

C:\Users\Admin\AppData\Local\Temp\Bank_Confirmation.exe
C:\Users\Admin\AppData\Local\Temp\Bank_Confirmation.exe
2⤵
PID:5088

C:\Users\Admin\AppData\Local\Temp\Bank_Confirmation.exe
C:\Users\Admin\AppData\Local\Temp\Bank_Confirmation.exe
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4604

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1168

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
208a234643c411e1b919e904ee20115e

SHA1
400b6e6860953f981bfe4716c345b797ed5b2b5b

SHA256
af80020ae43388bbd3db31c75aade369d489a30a933574dea19163e094d5f458

SHA512
2779b96325234c836cbb91820ee332ed56c15b534ec0c7770b322a5c03849ec3ee67b0ec7978e1fab563eeed1cea96f5155d7b942702555d9352ff6711a548d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
313c93795d50c5a5254b79d30028aedc

SHA1
c258003c4a1705475544601e655d4e32f3620643

SHA256
097e55f50f20981009cd557af83dc3318cc194252781ac16905cf313170fef96

SHA512
fd36ae59f4dd1aa90189ec760cc6bb78d1eb9e346b1ffdee69d6aa2a92e174d2a96e5b4651b3b41b6f47ae3de29d7cf5f30577b81407ce8a178869999e9a91c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
134943e3f8562461377411bead7a76ae

SHA1
8a7e8ad2b72967a6325aea8b4d297c596ce0a346

SHA256
f6ec20090606b3aa9448b42aacaf5ac9b1aeb2206aecb2bf10093fd962d6978e

SHA512
1348ee468b127b2a8096e4bfaa0f5f7f6e7cdd624dac896c3142487bb7a97ba8ff700a6c88d56bcfc959f72c3290514963f1071602b2abbc6d49866e4c2fc7ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c4aefc259ea8cbbfd5299cd0ad66db6c

SHA1
6b023eb2abe7f0a7e07503d9cf23499b5d0a7d58

SHA256
75e2095c9c32bf47792a5e5a5785c7a1fe096ba072170d0c411f573c9cd0f909

SHA512
bcca744ec3b1c76f79f1f454f07f5992db8296903aed8713fff8e66540057af8fbd505654a8ab80575600aaf70401972d4827b085e14ac4cab435013ae290dd5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
cd941d896b454bf97a67bc0597f56f25

SHA1
acb64a7f5b598dfb21dfb6ae76fc3c1ecea9f197

SHA256
1eaea27ff435e18e29833ed8bdf6a19f373b6f7a6db9d958a77d63daf6623c3a

SHA512
3a2e932a62acedda19e0c8c37b77e718f533454cccecd8071e4e26ab1639ef747b7e4fc69d3ebf126fa15d41518a8374cf2f838dc1ee1c4e65dc1013baa87292

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
5a6206a3489650bf4a9c3ce44a428126

SHA1
3137a909ef8b098687ec536c57caa1bacc77224b

SHA256
0a9e623c6df237c02a585539bffb8249de48949c6d074fe0aaf43063731a3e28

SHA512
980da83c3142bf08433ec1770a2ec5f5560daf3ee680466f89beae8290e921c0db677489daad055fbc1f196388f8bc4f60e050600381f860b06d330062440a78

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
7f46d913dfca9f6a91fc33859ae97666

SHA1
13d2e1710c4cef5a169cc3c1561e1eaa6f514cb4

SHA256
8654798444902dafcbb4e52cc00148acb0e942fbcdcbbbb9622b6a20bf721d28

SHA512
dba3f56173c5a990769abb4e545ac5bc7b516e60673e620ab0fda155131c6375849a852a7520cf6ead4941c6d4e1c1528f9f9c47357335cbf1094a084d401539

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_q1pqiuzk.oo4.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
\??\pipe\LOCAL\crashpad_3464_NZAPTMNDINQUXKPH

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/228-63-0x00000000054B0000-0x0000000005553000-memory.dmp

Filesize
652KB

Download
memory/228-929-0x0000000074D40000-0x00000000754F0000-memory.dmp

Filesize
7.7MB

Download
memory/228-13-0x00000000054B0000-0x0000000005553000-memory.dmp

Filesize
652KB

Download
memory/228-15-0x00000000054B0000-0x0000000005553000-memory.dmp

Filesize
652KB

Download
memory/228-17-0x00000000054B0000-0x0000000005553000-memory.dmp

Filesize
652KB

Download
memory/228-19-0x00000000054B0000-0x0000000005553000-memory.dmp

Filesize
652KB

Download
memory/228-21-0x00000000054B0000-0x0000000005553000-memory.dmp

Filesize
652KB

Download
memory/228-23-0x00000000054B0000-0x0000000005553000-memory.dmp

Filesize
652KB

Download
memory/228-25-0x00000000054B0000-0x0000000005553000-memory.dmp

Filesize
652KB

Download
memory/228-27-0x00000000054B0000-0x0000000005553000-memory.dmp

Filesize
652KB

Download
memory/228-29-0x00000000054B0000-0x0000000005553000-memory.dmp

Filesize
652KB

Download
memory/228-31-0x00000000054B0000-0x0000000005553000-memory.dmp

Filesize
652KB

Download
memory/228-33-0x00000000054B0000-0x0000000005553000-memory.dmp

Filesize
652KB

Download
memory/228-35-0x00000000054B0000-0x0000000005553000-memory.dmp

Filesize
652KB

Download
memory/228-37-0x00000000054B0000-0x0000000005553000-memory.dmp

Filesize
652KB

Download
memory/228-39-0x00000000054B0000-0x0000000005553000-memory.dmp

Filesize
652KB

Download
memory/228-41-0x00000000054B0000-0x0000000005553000-memory.dmp

Filesize
652KB

Download
memory/228-43-0x00000000054B0000-0x0000000005553000-memory.dmp

Filesize
652KB

Download
memory/228-45-0x00000000054B0000-0x0000000005553000-memory.dmp

Filesize
652KB

Download
memory/228-47-0x00000000054B0000-0x0000000005553000-memory.dmp

Filesize
652KB

Download
memory/228-49-0x00000000054B0000-0x0000000005553000-memory.dmp

Filesize
652KB

Download
memory/228-51-0x00000000054B0000-0x0000000005553000-memory.dmp

Filesize
652KB

Download
memory/228-53-0x00000000054B0000-0x0000000005553000-memory.dmp

Filesize
652KB

Download
memory/228-55-0x00000000054B0000-0x0000000005553000-memory.dmp

Filesize
652KB

Download
memory/228-59-0x00000000054B0000-0x0000000005553000-memory.dmp

Filesize
652KB

Download
memory/228-57-0x00000000054B0000-0x0000000005553000-memory.dmp

Filesize
652KB

Download
memory/228-61-0x00000000054B0000-0x0000000005553000-memory.dmp

Filesize
652KB

Download
memory/228-9-0x00000000054B0000-0x0000000005553000-memory.dmp

Filesize
652KB

Download
memory/228-65-0x00000000054B0000-0x0000000005553000-memory.dmp

Filesize
652KB

Download
memory/228-67-0x00000000054B0000-0x0000000005553000-memory.dmp

Filesize
652KB

Download
memory/228-926-0x0000000005590000-0x0000000005591000-memory.dmp

Filesize
4KB

Download
memory/228-927-0x0000000005630000-0x0000000005672000-memory.dmp

Filesize
264KB

Download
memory/228-928-0x0000000005670000-0x00000000056BC000-memory.dmp

Filesize
304KB

Download
memory/228-11-0x00000000054B0000-0x0000000005553000-memory.dmp

Filesize
652KB

Download
memory/228-930-0x0000000005620000-0x0000000005630000-memory.dmp

Filesize
64KB

Download
memory/228-931-0x0000000006850000-0x0000000006DF4000-memory.dmp

Filesize
5.6MB

Download
memory/228-969-0x0000000074D40000-0x00000000754F0000-memory.dmp

Filesize
7.7MB

Download
memory/228-0-0x0000000074D40000-0x00000000754F0000-memory.dmp

Filesize
7.7MB

Download
memory/228-1-0x0000000000A90000-0x0000000000B72000-memory.dmp

Filesize
904KB

Download
memory/228-2-0x00000000054B0000-0x0000000005558000-memory.dmp

Filesize
672KB

Download
memory/228-3-0x0000000005620000-0x0000000005630000-memory.dmp

Filesize
64KB

Download
memory/228-4-0x00000000054B0000-0x0000000005553000-memory.dmp

Filesize
652KB

Download
memory/228-5-0x00000000054B0000-0x0000000005553000-memory.dmp

Filesize
652KB

Download
memory/228-7-0x00000000054B0000-0x0000000005553000-memory.dmp

Filesize
652KB

Download
memory/2344-955-0x00000000062A0000-0x00000000062C2000-memory.dmp

Filesize
136KB

Download
memory/2344-932-0x00000000027A0000-0x00000000027D6000-memory.dmp

Filesize
216KB

Download
memory/2344-951-0x0000000005D60000-0x0000000005D7E000-memory.dmp

Filesize
120KB

Download
memory/2344-952-0x0000000005DA0000-0x0000000005DEC000-memory.dmp

Filesize
304KB

Download
memory/2344-953-0x00000000062F0000-0x0000000006386000-memory.dmp

Filesize
600KB

Download
memory/2344-954-0x0000000006250000-0x000000000626A000-memory.dmp

Filesize
104KB

Download
memory/2344-950-0x00000000058A0000-0x0000000005BF4000-memory.dmp

Filesize
3.3MB

Download
memory/2344-959-0x0000000074D40000-0x00000000754F0000-memory.dmp

Filesize
7.7MB

Download
memory/2344-936-0x0000000004A10000-0x0000000004A20000-memory.dmp

Filesize
64KB

Download
memory/2344-934-0x0000000074D40000-0x00000000754F0000-memory.dmp

Filesize
7.7MB

Download
memory/2344-935-0x0000000004A10000-0x0000000004A20000-memory.dmp

Filesize
64KB

Download
memory/2344-937-0x0000000005050000-0x0000000005678000-memory.dmp

Filesize
6.2MB

Download
memory/2344-949-0x0000000005820000-0x0000000005886000-memory.dmp

Filesize
408KB

Download
memory/2344-944-0x0000000005680000-0x00000000056E6000-memory.dmp

Filesize
408KB

Download
memory/2344-938-0x0000000004E10000-0x0000000004E32000-memory.dmp

Filesize
136KB

Download
memory/4604-1026-0x0000000006660000-0x00000000066FC000-memory.dmp

Filesize
624KB

Download
memory/4604-1025-0x0000000006570000-0x00000000065C0000-memory.dmp

Filesize
320KB

Download
memory/4604-970-0x00000000056D0000-0x00000000056E0000-memory.dmp

Filesize
64KB

Download
memory/4604-1074-0x0000000074D40000-0x00000000754F0000-memory.dmp

Filesize
7.7MB

Download
memory/4604-968-0x0000000074D40000-0x00000000754F0000-memory.dmp

Filesize
7.7MB

Download
memory/4604-1080-0x00000000056D0000-0x00000000056E0000-memory.dmp

Filesize
64KB

Download
memory/4604-1081-0x0000000006C20000-0x0000000006CB2000-memory.dmp

Filesize
584KB

Download
memory/4604-1082-0x0000000006BD0000-0x0000000006BDA000-memory.dmp

Filesize
40KB

Download
memory/4604-967-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download