Analysis
-
max time kernel
120s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
20/03/2024, 02:20
Behavioral task
behavioral1
Sample
68f921d55e5ebbc383106e2de957dfd3a9db76117d8baeaf60d824954e4c3dd4.exe
Resource
win7-20240221-en
General
-
Target
68f921d55e5ebbc383106e2de957dfd3a9db76117d8baeaf60d824954e4c3dd4.exe
-
Size
687KB
-
MD5
e78c1dbf5a60565752827b9da8be8f7c
-
SHA1
4a12a76c1156ba36a5ba6c71d861d9fb6d67b625
-
SHA256
68f921d55e5ebbc383106e2de957dfd3a9db76117d8baeaf60d824954e4c3dd4
-
SHA512
83e1c643808598d18ab70b46322c6809f4c08bbe2ad2459674bb5c0d48ecc42251ccda9b2b169be576299c2598633fdd8c07b54c4f7cfccb087be9c72af6ffca
-
SSDEEP
12288:MYV6MorX7qzuC3QHO9FQVHPF51jgcSpMQQpDkzgsp6YTzV+nvZSDaK4Tc0jNu:rBXu9HGaVHS2JDHY8vwaK4TNc
Malware Config
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Detect ZGRat V1 33 IoCs
resource yara_rule behavioral1/memory/2040-18-0x0000000000450000-0x00000000004A4000-memory.dmp family_zgrat_v1 behavioral1/memory/2040-22-0x0000000000B40000-0x0000000000B92000-memory.dmp family_zgrat_v1 behavioral1/memory/2040-24-0x0000000000B40000-0x0000000000B8C000-memory.dmp family_zgrat_v1 behavioral1/memory/2040-34-0x0000000000B40000-0x0000000000B8C000-memory.dmp family_zgrat_v1 behavioral1/memory/2040-32-0x0000000000B40000-0x0000000000B8C000-memory.dmp family_zgrat_v1 behavioral1/memory/2040-36-0x0000000000B40000-0x0000000000B8C000-memory.dmp family_zgrat_v1 behavioral1/memory/2040-30-0x0000000000B40000-0x0000000000B8C000-memory.dmp family_zgrat_v1 behavioral1/memory/2040-28-0x0000000000B40000-0x0000000000B8C000-memory.dmp family_zgrat_v1 behavioral1/memory/2040-26-0x0000000000B40000-0x0000000000B8C000-memory.dmp family_zgrat_v1 behavioral1/memory/2040-23-0x0000000000B40000-0x0000000000B8C000-memory.dmp family_zgrat_v1 behavioral1/memory/2040-38-0x0000000000B40000-0x0000000000B8C000-memory.dmp family_zgrat_v1 behavioral1/memory/2040-46-0x0000000000B40000-0x0000000000B8C000-memory.dmp family_zgrat_v1 behavioral1/memory/2040-54-0x0000000000B40000-0x0000000000B8C000-memory.dmp family_zgrat_v1 behavioral1/memory/2040-58-0x0000000000B40000-0x0000000000B8C000-memory.dmp family_zgrat_v1 behavioral1/memory/2040-66-0x0000000000B40000-0x0000000000B8C000-memory.dmp family_zgrat_v1 behavioral1/memory/2040-70-0x0000000000B40000-0x0000000000B8C000-memory.dmp family_zgrat_v1 behavioral1/memory/2040-72-0x0000000000B40000-0x0000000000B8C000-memory.dmp family_zgrat_v1 behavioral1/memory/2040-78-0x0000000000B40000-0x0000000000B8C000-memory.dmp family_zgrat_v1 behavioral1/memory/2040-82-0x0000000000B40000-0x0000000000B8C000-memory.dmp family_zgrat_v1 behavioral1/memory/2040-80-0x0000000000B40000-0x0000000000B8C000-memory.dmp family_zgrat_v1 behavioral1/memory/2040-76-0x0000000000B40000-0x0000000000B8C000-memory.dmp family_zgrat_v1 behavioral1/memory/2040-74-0x0000000000B40000-0x0000000000B8C000-memory.dmp family_zgrat_v1 behavioral1/memory/2040-68-0x0000000000B40000-0x0000000000B8C000-memory.dmp family_zgrat_v1 behavioral1/memory/2040-64-0x0000000000B40000-0x0000000000B8C000-memory.dmp family_zgrat_v1 behavioral1/memory/2040-62-0x0000000000B40000-0x0000000000B8C000-memory.dmp family_zgrat_v1 behavioral1/memory/2040-60-0x0000000000B40000-0x0000000000B8C000-memory.dmp family_zgrat_v1 behavioral1/memory/2040-56-0x0000000000B40000-0x0000000000B8C000-memory.dmp family_zgrat_v1 behavioral1/memory/2040-52-0x0000000000B40000-0x0000000000B8C000-memory.dmp family_zgrat_v1 behavioral1/memory/2040-50-0x0000000000B40000-0x0000000000B8C000-memory.dmp family_zgrat_v1 behavioral1/memory/2040-48-0x0000000000B40000-0x0000000000B8C000-memory.dmp family_zgrat_v1 behavioral1/memory/2040-44-0x0000000000B40000-0x0000000000B8C000-memory.dmp family_zgrat_v1 behavioral1/memory/2040-42-0x0000000000B40000-0x0000000000B8C000-memory.dmp family_zgrat_v1 behavioral1/memory/2040-40-0x0000000000B40000-0x0000000000B8C000-memory.dmp family_zgrat_v1 -
Detect packed .NET executables. Mostly AgentTeslaV4. 33 IoCs
resource yara_rule behavioral1/memory/2040-18-0x0000000000450000-0x00000000004A4000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2040-22-0x0000000000B40000-0x0000000000B92000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2040-24-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2040-34-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2040-32-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2040-36-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2040-30-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2040-28-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2040-26-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2040-23-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2040-38-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2040-46-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2040-54-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2040-58-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2040-66-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2040-70-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2040-72-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2040-78-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2040-82-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2040-80-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2040-76-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2040-74-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2040-68-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2040-64-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2040-62-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2040-60-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2040-56-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2040-52-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2040-50-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2040-48-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2040-44-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2040-42-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2040-40-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_EXE_Packed_GEN01 -
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 33 IoCs
resource yara_rule behavioral1/memory/2040-18-0x0000000000450000-0x00000000004A4000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2040-22-0x0000000000B40000-0x0000000000B92000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2040-24-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2040-34-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2040-32-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2040-36-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2040-30-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2040-28-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2040-26-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2040-23-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2040-38-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2040-46-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2040-54-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2040-58-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2040-66-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2040-70-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2040-72-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2040-78-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2040-82-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2040-80-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2040-76-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2040-74-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2040-68-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2040-64-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2040-62-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2040-60-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2040-56-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2040-52-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2040-50-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2040-48-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2040-44-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2040-42-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2040-40-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers -
Detects executables referencing Windows vault credential objects. Observed in infostealers 33 IoCs
resource yara_rule behavioral1/memory/2040-18-0x0000000000450000-0x00000000004A4000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2040-22-0x0000000000B40000-0x0000000000B92000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2040-24-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2040-34-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2040-32-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2040-36-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2040-30-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2040-28-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2040-26-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2040-23-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2040-38-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2040-46-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2040-54-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2040-58-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2040-66-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2040-70-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2040-72-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2040-78-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2040-82-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2040-80-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2040-76-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2040-74-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2040-68-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2040-64-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2040-62-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2040-60-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2040-56-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2040-52-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2040-50-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2040-48-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2040-44-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2040-42-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2040-40-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID -
Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers 33 IoCs
resource yara_rule behavioral1/memory/2040-18-0x0000000000450000-0x00000000004A4000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2040-22-0x0000000000B40000-0x0000000000B92000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2040-24-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2040-34-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2040-32-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2040-36-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2040-30-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2040-28-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2040-26-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2040-23-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2040-38-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2040-46-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2040-54-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2040-58-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2040-66-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2040-70-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2040-72-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2040-78-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2040-82-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2040-80-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2040-76-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2040-74-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2040-68-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2040-64-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2040-62-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2040-60-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2040-56-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2040-52-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2040-50-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2040-48-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2040-44-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2040-42-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2040-40-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store -
Detects executables referencing many email and collaboration clients. Observed in information stealers 33 IoCs
resource yara_rule behavioral1/memory/2040-18-0x0000000000450000-0x00000000004A4000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2040-22-0x0000000000B40000-0x0000000000B92000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2040-24-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2040-34-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2040-32-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2040-36-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2040-30-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2040-28-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2040-26-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2040-23-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2040-38-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2040-46-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2040-54-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2040-58-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2040-66-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2040-70-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2040-72-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2040-78-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2040-82-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2040-80-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2040-76-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2040-74-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2040-68-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2040-64-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2040-62-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2040-60-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2040-56-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2040-52-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2040-50-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2040-48-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2040-44-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2040-42-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2040-40-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients -
Detects executables referencing many file transfer clients. Observed in information stealers 33 IoCs
resource yara_rule behavioral1/memory/2040-18-0x0000000000450000-0x00000000004A4000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2040-22-0x0000000000B40000-0x0000000000B92000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2040-24-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2040-34-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2040-32-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2040-36-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2040-30-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2040-28-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2040-26-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2040-23-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2040-38-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2040-46-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2040-54-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2040-58-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2040-66-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2040-70-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2040-72-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2040-78-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2040-82-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2040-80-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2040-76-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2040-74-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2040-68-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2040-64-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2040-62-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2040-60-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2040-56-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2040-52-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2040-50-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2040-48-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2040-44-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2040-42-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2040-40-0x0000000000B40000-0x0000000000B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients -
UPX dump on OEP (original entry point) 2 IoCs
resource yara_rule behavioral1/memory/2236-0-0x0000000000B50000-0x0000000000CD5000-memory.dmp UPX behavioral1/memory/2236-15-0x0000000000B50000-0x0000000000CD5000-memory.dmp UPX -
resource yara_rule behavioral1/memory/2236-0-0x0000000000B50000-0x0000000000CD5000-memory.dmp upx behavioral1/memory/2236-15-0x0000000000B50000-0x0000000000CD5000-memory.dmp upx -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 api.ipify.org 5 api.ipify.org -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/2236-15-0x0000000000B50000-0x0000000000CD5000-memory.dmp autoit_exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2236 set thread context of 2040 2236 68f921d55e5ebbc383106e2de957dfd3a9db76117d8baeaf60d824954e4c3dd4.exe 28 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2040 RegSvcs.exe 2040 RegSvcs.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2236 68f921d55e5ebbc383106e2de957dfd3a9db76117d8baeaf60d824954e4c3dd4.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2040 RegSvcs.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2236 68f921d55e5ebbc383106e2de957dfd3a9db76117d8baeaf60d824954e4c3dd4.exe 2236 68f921d55e5ebbc383106e2de957dfd3a9db76117d8baeaf60d824954e4c3dd4.exe -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 2236 68f921d55e5ebbc383106e2de957dfd3a9db76117d8baeaf60d824954e4c3dd4.exe 2236 68f921d55e5ebbc383106e2de957dfd3a9db76117d8baeaf60d824954e4c3dd4.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2236 wrote to memory of 2040 2236 68f921d55e5ebbc383106e2de957dfd3a9db76117d8baeaf60d824954e4c3dd4.exe 28 PID 2236 wrote to memory of 2040 2236 68f921d55e5ebbc383106e2de957dfd3a9db76117d8baeaf60d824954e4c3dd4.exe 28 PID 2236 wrote to memory of 2040 2236 68f921d55e5ebbc383106e2de957dfd3a9db76117d8baeaf60d824954e4c3dd4.exe 28 PID 2236 wrote to memory of 2040 2236 68f921d55e5ebbc383106e2de957dfd3a9db76117d8baeaf60d824954e4c3dd4.exe 28 PID 2236 wrote to memory of 2040 2236 68f921d55e5ebbc383106e2de957dfd3a9db76117d8baeaf60d824954e4c3dd4.exe 28 PID 2236 wrote to memory of 2040 2236 68f921d55e5ebbc383106e2de957dfd3a9db76117d8baeaf60d824954e4c3dd4.exe 28 PID 2236 wrote to memory of 2040 2236 68f921d55e5ebbc383106e2de957dfd3a9db76117d8baeaf60d824954e4c3dd4.exe 28 PID 2236 wrote to memory of 2040 2236 68f921d55e5ebbc383106e2de957dfd3a9db76117d8baeaf60d824954e4c3dd4.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\68f921d55e5ebbc383106e2de957dfd3a9db76117d8baeaf60d824954e4c3dd4.exe"C:\Users\Admin\AppData\Local\Temp\68f921d55e5ebbc383106e2de957dfd3a9db76117d8baeaf60d824954e4c3dd4.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\68f921d55e5ebbc383106e2de957dfd3a9db76117d8baeaf60d824954e4c3dd4.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2040
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
261KB
MD54dbac371fb653107db7f5ecf33b5fd9c
SHA1db1c112d238f298f4e6129be8ea667666b92077f
SHA256637b7ff21bacc52eabac95e6a522216affacf05ac2b00e2697b492a3fbc30a68
SHA512f647ca9628cdfd6e6f4b4d643e8e1db48f719ba7e5687742e3d3dedcfb7ff931aa7e26f604090913897604f8af8d44a517f22dd2c00501f7839ab7707d3f3019