Analysis
-
max time kernel
117s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
29-03-2024 02:07
Behavioral task
behavioral1
Sample
222370596f59183040772e971c9b262d1fa1aba5386b448e423c6cff2d23319a.exe
Resource
win7-20240221-en
General
-
Target
222370596f59183040772e971c9b262d1fa1aba5386b448e423c6cff2d23319a.exe
-
Size
867KB
-
MD5
2c520c9db37e16343941bbba36fc22ef
-
SHA1
b168bb726e9ec94166e60cc3d502843058ede5a4
-
SHA256
222370596f59183040772e971c9b262d1fa1aba5386b448e423c6cff2d23319a
-
SHA512
097379427ac91ccde3e7cf09223a8f6a9955c77c786d975e78aa7c5a5e693b92c172322ecc6c32dfc80e4ae2964c805f11ac0268afd95aa82921b296666d758a
-
SSDEEP
12288:Z6Wq4aaE6KwyF5L0Y2D1PqL/2p7v95HcYuHfWpKbyiJZUHKA4b5:vthEVaPqLOp7v954uMbyiJWHKAK5
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot6811787827:AAEr4cj8xrQKX5i6BnPzE4vzpRaL4EziTo4/
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Detect ZGRat V1 32 IoCs
Processes:
resource yara_rule behavioral1/memory/2504-34-0x0000000000680000-0x00000000006D4000-memory.dmp family_zgrat_v1 behavioral1/memory/2504-39-0x0000000000E00000-0x0000000000E54000-memory.dmp family_zgrat_v1 behavioral1/memory/2504-40-0x0000000000E00000-0x0000000000E4D000-memory.dmp family_zgrat_v1 behavioral1/memory/2504-41-0x0000000000E00000-0x0000000000E4D000-memory.dmp family_zgrat_v1 behavioral1/memory/2504-45-0x0000000000E00000-0x0000000000E4D000-memory.dmp family_zgrat_v1 behavioral1/memory/2504-43-0x0000000000E00000-0x0000000000E4D000-memory.dmp family_zgrat_v1 behavioral1/memory/2504-47-0x0000000000E00000-0x0000000000E4D000-memory.dmp family_zgrat_v1 behavioral1/memory/2504-49-0x0000000000E00000-0x0000000000E4D000-memory.dmp family_zgrat_v1 behavioral1/memory/2504-51-0x0000000000E00000-0x0000000000E4D000-memory.dmp family_zgrat_v1 behavioral1/memory/2504-53-0x0000000000E00000-0x0000000000E4D000-memory.dmp family_zgrat_v1 behavioral1/memory/2504-55-0x0000000000E00000-0x0000000000E4D000-memory.dmp family_zgrat_v1 behavioral1/memory/2504-57-0x0000000000E00000-0x0000000000E4D000-memory.dmp family_zgrat_v1 behavioral1/memory/2504-59-0x0000000000E00000-0x0000000000E4D000-memory.dmp family_zgrat_v1 behavioral1/memory/2504-61-0x0000000000E00000-0x0000000000E4D000-memory.dmp family_zgrat_v1 behavioral1/memory/2504-63-0x0000000000E00000-0x0000000000E4D000-memory.dmp family_zgrat_v1 behavioral1/memory/2504-65-0x0000000000E00000-0x0000000000E4D000-memory.dmp family_zgrat_v1 behavioral1/memory/2504-67-0x0000000000E00000-0x0000000000E4D000-memory.dmp family_zgrat_v1 behavioral1/memory/2504-69-0x0000000000E00000-0x0000000000E4D000-memory.dmp family_zgrat_v1 behavioral1/memory/2504-71-0x0000000000E00000-0x0000000000E4D000-memory.dmp family_zgrat_v1 behavioral1/memory/2504-73-0x0000000000E00000-0x0000000000E4D000-memory.dmp family_zgrat_v1 behavioral1/memory/2504-75-0x0000000000E00000-0x0000000000E4D000-memory.dmp family_zgrat_v1 behavioral1/memory/2504-77-0x0000000000E00000-0x0000000000E4D000-memory.dmp family_zgrat_v1 behavioral1/memory/2504-79-0x0000000000E00000-0x0000000000E4D000-memory.dmp family_zgrat_v1 behavioral1/memory/2504-81-0x0000000000E00000-0x0000000000E4D000-memory.dmp family_zgrat_v1 behavioral1/memory/2504-83-0x0000000000E00000-0x0000000000E4D000-memory.dmp family_zgrat_v1 behavioral1/memory/2504-85-0x0000000000E00000-0x0000000000E4D000-memory.dmp family_zgrat_v1 behavioral1/memory/2504-87-0x0000000000E00000-0x0000000000E4D000-memory.dmp family_zgrat_v1 behavioral1/memory/2504-89-0x0000000000E00000-0x0000000000E4D000-memory.dmp family_zgrat_v1 behavioral1/memory/2504-91-0x0000000000E00000-0x0000000000E4D000-memory.dmp family_zgrat_v1 behavioral1/memory/2504-93-0x0000000000E00000-0x0000000000E4D000-memory.dmp family_zgrat_v1 behavioral1/memory/2504-95-0x0000000000E00000-0x0000000000E4D000-memory.dmp family_zgrat_v1 behavioral1/memory/2504-97-0x0000000000E00000-0x0000000000E4D000-memory.dmp family_zgrat_v1 -
Detect packed .NET executables. Mostly AgentTeslaV4. 32 IoCs
Processes:
resource yara_rule behavioral1/memory/2504-34-0x0000000000680000-0x00000000006D4000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2504-39-0x0000000000E00000-0x0000000000E54000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2504-40-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2504-41-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2504-45-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2504-43-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2504-47-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2504-49-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2504-51-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2504-53-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2504-55-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2504-57-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2504-59-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2504-61-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2504-63-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2504-65-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2504-67-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2504-69-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2504-71-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2504-73-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2504-75-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2504-77-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2504-79-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2504-81-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2504-83-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2504-85-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2504-87-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2504-89-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2504-91-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2504-93-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2504-95-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2504-97-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_EXE_Packed_GEN01 -
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 32 IoCs
Processes:
resource yara_rule behavioral1/memory/2504-34-0x0000000000680000-0x00000000006D4000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2504-39-0x0000000000E00000-0x0000000000E54000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2504-40-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2504-41-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2504-45-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2504-43-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2504-47-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2504-49-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2504-51-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2504-53-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2504-55-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2504-57-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2504-59-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2504-61-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2504-63-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2504-65-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2504-67-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2504-69-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2504-71-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2504-73-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2504-75-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2504-77-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2504-79-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2504-81-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2504-83-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2504-85-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2504-87-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2504-89-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2504-91-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2504-93-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2504-95-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2504-97-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers -
Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 33 IoCs
Processes:
resource yara_rule behavioral1/memory/2504-34-0x0000000000680000-0x00000000006D4000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL behavioral1/memory/2504-39-0x0000000000E00000-0x0000000000E54000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL behavioral1/memory/2504-40-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL behavioral1/memory/2504-41-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL behavioral1/memory/2504-45-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL behavioral1/memory/2504-43-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL behavioral1/memory/2504-47-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL behavioral1/memory/2504-49-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL behavioral1/memory/2504-51-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL behavioral1/memory/2504-53-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL behavioral1/memory/2504-55-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL behavioral1/memory/2504-57-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL behavioral1/memory/2504-59-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL behavioral1/memory/2504-61-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL behavioral1/memory/2504-63-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL behavioral1/memory/2504-65-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL behavioral1/memory/2504-67-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL behavioral1/memory/2504-69-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL behavioral1/memory/2504-71-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL behavioral1/memory/2504-73-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL behavioral1/memory/2504-75-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL behavioral1/memory/2504-77-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL behavioral1/memory/2504-79-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL behavioral1/memory/2504-81-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL behavioral1/memory/2504-83-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL behavioral1/memory/2504-85-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL behavioral1/memory/2504-87-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL behavioral1/memory/2504-89-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL behavioral1/memory/2504-91-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL behavioral1/memory/2504-93-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL behavioral1/memory/2504-95-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL behavioral1/memory/2504-97-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL behavioral1/memory/2504-1086-0x0000000001270000-0x00000000012B0000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL -
Detects executables referencing Windows vault credential objects. Observed in infostealers 32 IoCs
Processes:
resource yara_rule behavioral1/memory/2504-34-0x0000000000680000-0x00000000006D4000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2504-39-0x0000000000E00000-0x0000000000E54000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2504-40-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2504-41-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2504-45-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2504-43-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2504-47-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2504-49-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2504-51-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2504-53-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2504-55-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2504-57-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2504-59-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2504-61-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2504-63-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2504-65-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2504-67-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2504-69-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2504-71-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2504-73-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2504-75-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2504-77-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2504-79-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2504-81-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2504-83-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2504-85-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2504-87-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2504-89-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2504-91-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2504-93-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2504-95-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2504-97-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID -
Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers 32 IoCs
Processes:
resource yara_rule behavioral1/memory/2504-34-0x0000000000680000-0x00000000006D4000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2504-39-0x0000000000E00000-0x0000000000E54000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2504-40-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2504-41-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2504-45-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2504-43-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2504-47-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2504-49-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2504-51-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2504-53-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2504-55-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2504-57-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2504-59-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2504-61-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2504-63-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2504-65-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2504-67-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2504-69-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2504-71-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2504-73-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2504-75-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2504-77-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2504-79-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2504-81-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2504-83-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2504-85-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2504-87-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2504-89-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2504-91-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2504-93-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2504-95-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2504-97-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store -
Detects executables referencing many email and collaboration clients. Observed in information stealers 32 IoCs
Processes:
resource yara_rule behavioral1/memory/2504-34-0x0000000000680000-0x00000000006D4000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2504-39-0x0000000000E00000-0x0000000000E54000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2504-40-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2504-41-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2504-45-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2504-43-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2504-47-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2504-49-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2504-51-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2504-53-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2504-55-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2504-57-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2504-59-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2504-61-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2504-63-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2504-65-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2504-67-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2504-69-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2504-71-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2504-73-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2504-75-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2504-77-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2504-79-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2504-81-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2504-83-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2504-85-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2504-87-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2504-89-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2504-91-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2504-93-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2504-95-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2504-97-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients -
Detects executables referencing many file transfer clients. Observed in information stealers 32 IoCs
Processes:
resource yara_rule behavioral1/memory/2504-34-0x0000000000680000-0x00000000006D4000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2504-39-0x0000000000E00000-0x0000000000E54000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2504-40-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2504-41-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2504-45-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2504-43-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2504-47-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2504-49-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2504-51-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2504-53-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2504-55-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2504-57-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2504-59-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2504-61-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2504-63-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2504-65-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2504-67-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2504-69-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2504-71-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2504-73-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2504-75-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2504-77-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2504-79-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2504-81-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2504-83-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2504-85-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2504-87-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2504-89-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2504-91-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2504-93-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2504-95-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2504-97-0x0000000000E00000-0x0000000000E4D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients -
UPX dump on OEP (original entry point) 5 IoCs
Processes:
resource yara_rule behavioral1/memory/2068-0-0x0000000000400000-0x0000000000540000-memory.dmp UPX behavioral1/memory/2068-13-0x0000000000400000-0x0000000000540000-memory.dmp UPX behavioral1/memory/2068-14-0x0000000003090000-0x00000000031D0000-memory.dmp UPX behavioral1/memory/1740-15-0x0000000000400000-0x0000000000540000-memory.dmp UPX behavioral1/memory/1740-31-0x0000000000400000-0x0000000000540000-memory.dmp UPX -
Processes:
resource yara_rule behavioral1/memory/2068-0-0x0000000000400000-0x0000000000540000-memory.dmp upx behavioral1/memory/2068-13-0x0000000000400000-0x0000000000540000-memory.dmp upx behavioral1/memory/2068-14-0x0000000003090000-0x00000000031D0000-memory.dmp upx behavioral1/memory/1740-15-0x0000000000400000-0x0000000000540000-memory.dmp upx behavioral1/memory/1740-31-0x0000000000400000-0x0000000000540000-memory.dmp upx -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 ip-api.com -
AutoIT Executable 3 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral1/memory/2068-13-0x0000000000400000-0x0000000000540000-memory.dmp autoit_exe behavioral1/memory/1740-15-0x0000000000400000-0x0000000000540000-memory.dmp autoit_exe behavioral1/memory/1740-31-0x0000000000400000-0x0000000000540000-memory.dmp autoit_exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
222370596f59183040772e971c9b262d1fa1aba5386b448e423c6cff2d23319a.exedescription pid process target process PID 1740 set thread context of 2504 1740 222370596f59183040772e971c9b262d1fa1aba5386b448e423c6cff2d23319a.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
RegSvcs.exepid process 2504 RegSvcs.exe 2504 RegSvcs.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
222370596f59183040772e971c9b262d1fa1aba5386b448e423c6cff2d23319a.exe222370596f59183040772e971c9b262d1fa1aba5386b448e423c6cff2d23319a.exepid process 2068 222370596f59183040772e971c9b262d1fa1aba5386b448e423c6cff2d23319a.exe 1740 222370596f59183040772e971c9b262d1fa1aba5386b448e423c6cff2d23319a.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RegSvcs.exedescription pid process Token: SeDebugPrivilege 2504 RegSvcs.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
222370596f59183040772e971c9b262d1fa1aba5386b448e423c6cff2d23319a.exe222370596f59183040772e971c9b262d1fa1aba5386b448e423c6cff2d23319a.exepid process 2068 222370596f59183040772e971c9b262d1fa1aba5386b448e423c6cff2d23319a.exe 2068 222370596f59183040772e971c9b262d1fa1aba5386b448e423c6cff2d23319a.exe 1740 222370596f59183040772e971c9b262d1fa1aba5386b448e423c6cff2d23319a.exe 1740 222370596f59183040772e971c9b262d1fa1aba5386b448e423c6cff2d23319a.exe -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
222370596f59183040772e971c9b262d1fa1aba5386b448e423c6cff2d23319a.exe222370596f59183040772e971c9b262d1fa1aba5386b448e423c6cff2d23319a.exepid process 2068 222370596f59183040772e971c9b262d1fa1aba5386b448e423c6cff2d23319a.exe 2068 222370596f59183040772e971c9b262d1fa1aba5386b448e423c6cff2d23319a.exe 1740 222370596f59183040772e971c9b262d1fa1aba5386b448e423c6cff2d23319a.exe 1740 222370596f59183040772e971c9b262d1fa1aba5386b448e423c6cff2d23319a.exe -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
222370596f59183040772e971c9b262d1fa1aba5386b448e423c6cff2d23319a.exe222370596f59183040772e971c9b262d1fa1aba5386b448e423c6cff2d23319a.exedescription pid process target process PID 2068 wrote to memory of 1904 2068 222370596f59183040772e971c9b262d1fa1aba5386b448e423c6cff2d23319a.exe RegSvcs.exe PID 2068 wrote to memory of 1904 2068 222370596f59183040772e971c9b262d1fa1aba5386b448e423c6cff2d23319a.exe RegSvcs.exe PID 2068 wrote to memory of 1904 2068 222370596f59183040772e971c9b262d1fa1aba5386b448e423c6cff2d23319a.exe RegSvcs.exe PID 2068 wrote to memory of 1904 2068 222370596f59183040772e971c9b262d1fa1aba5386b448e423c6cff2d23319a.exe RegSvcs.exe PID 2068 wrote to memory of 1904 2068 222370596f59183040772e971c9b262d1fa1aba5386b448e423c6cff2d23319a.exe RegSvcs.exe PID 2068 wrote to memory of 1904 2068 222370596f59183040772e971c9b262d1fa1aba5386b448e423c6cff2d23319a.exe RegSvcs.exe PID 2068 wrote to memory of 1904 2068 222370596f59183040772e971c9b262d1fa1aba5386b448e423c6cff2d23319a.exe RegSvcs.exe PID 2068 wrote to memory of 1740 2068 222370596f59183040772e971c9b262d1fa1aba5386b448e423c6cff2d23319a.exe 222370596f59183040772e971c9b262d1fa1aba5386b448e423c6cff2d23319a.exe PID 2068 wrote to memory of 1740 2068 222370596f59183040772e971c9b262d1fa1aba5386b448e423c6cff2d23319a.exe 222370596f59183040772e971c9b262d1fa1aba5386b448e423c6cff2d23319a.exe PID 2068 wrote to memory of 1740 2068 222370596f59183040772e971c9b262d1fa1aba5386b448e423c6cff2d23319a.exe 222370596f59183040772e971c9b262d1fa1aba5386b448e423c6cff2d23319a.exe PID 2068 wrote to memory of 1740 2068 222370596f59183040772e971c9b262d1fa1aba5386b448e423c6cff2d23319a.exe 222370596f59183040772e971c9b262d1fa1aba5386b448e423c6cff2d23319a.exe PID 1740 wrote to memory of 2504 1740 222370596f59183040772e971c9b262d1fa1aba5386b448e423c6cff2d23319a.exe RegSvcs.exe PID 1740 wrote to memory of 2504 1740 222370596f59183040772e971c9b262d1fa1aba5386b448e423c6cff2d23319a.exe RegSvcs.exe PID 1740 wrote to memory of 2504 1740 222370596f59183040772e971c9b262d1fa1aba5386b448e423c6cff2d23319a.exe RegSvcs.exe PID 1740 wrote to memory of 2504 1740 222370596f59183040772e971c9b262d1fa1aba5386b448e423c6cff2d23319a.exe RegSvcs.exe PID 1740 wrote to memory of 2504 1740 222370596f59183040772e971c9b262d1fa1aba5386b448e423c6cff2d23319a.exe RegSvcs.exe PID 1740 wrote to memory of 2504 1740 222370596f59183040772e971c9b262d1fa1aba5386b448e423c6cff2d23319a.exe RegSvcs.exe PID 1740 wrote to memory of 2504 1740 222370596f59183040772e971c9b262d1fa1aba5386b448e423c6cff2d23319a.exe RegSvcs.exe PID 1740 wrote to memory of 2504 1740 222370596f59183040772e971c9b262d1fa1aba5386b448e423c6cff2d23319a.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\222370596f59183040772e971c9b262d1fa1aba5386b448e423c6cff2d23319a.exe"C:\Users\Admin\AppData\Local\Temp\222370596f59183040772e971c9b262d1fa1aba5386b448e423c6cff2d23319a.exe"1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\222370596f59183040772e971c9b262d1fa1aba5386b448e423c6cff2d23319a.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\222370596f59183040772e971c9b262d1fa1aba5386b448e423c6cff2d23319a.exe"C:\Users\Admin\AppData\Local\Temp\222370596f59183040772e971c9b262d1fa1aba5386b448e423c6cff2d23319a.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\222370596f59183040772e971c9b262d1fa1aba5386b448e423c6cff2d23319a.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\adstipulatorFilesize
262KB
MD50640ead3d46b6c0d03329465e335daa8
SHA1077a512a096bc44a644f6effb2f7b9d29e5fb1ce
SHA256c5f4b6c2f000f82540e97ee79b27d36cc1ccc0d5723427a98022908711af76c0
SHA5124eb42091437ccab1cd62fdd2574a87582dc55d6ee40e4f84eafbe493e4a92b09bf6f1318bf2c602c846fb723076a3d9c17f79dd9392c3715560197ee2b0ebc3f
-
C:\Users\Admin\AppData\Local\Temp\prophetessesFilesize
29KB
MD5dd40dab296567678a5ff863481ffce43
SHA1eb440c3d5736c3162ed10d42d6f07fb71fae6072
SHA256d9d55c2ac887add910fbd722e9d626bb3bb738a9fa8637331faa1918956e4c66
SHA512151b16ea966752544e899a5df4e68526736f5ef6da41c65931921da0ecd3e77019489c865249972370365704f64b0626ab91453cb2adcc387b066b2161b5b1be
-
memory/1740-15-0x0000000000400000-0x0000000000540000-memory.dmpFilesize
1.2MB
-
memory/1740-31-0x0000000000400000-0x0000000000540000-memory.dmpFilesize
1.2MB
-
memory/2068-0-0x0000000000400000-0x0000000000540000-memory.dmpFilesize
1.2MB
-
memory/2068-12-0x0000000000250000-0x0000000000254000-memory.dmpFilesize
16KB
-
memory/2068-13-0x0000000000400000-0x0000000000540000-memory.dmpFilesize
1.2MB
-
memory/2068-14-0x0000000003090000-0x00000000031D0000-memory.dmpFilesize
1.2MB
-
memory/2504-29-0x0000000000400000-0x0000000000446000-memory.dmpFilesize
280KB
-
memory/2504-32-0x0000000000400000-0x0000000000446000-memory.dmpFilesize
280KB
-
memory/2504-33-0x0000000000400000-0x0000000000446000-memory.dmpFilesize
280KB
-
memory/2504-34-0x0000000000680000-0x00000000006D4000-memory.dmpFilesize
336KB
-
memory/2504-35-0x00000000745C0000-0x0000000074CAE000-memory.dmpFilesize
6.9MB
-
memory/2504-36-0x0000000001270000-0x00000000012B0000-memory.dmpFilesize
256KB
-
memory/2504-37-0x0000000001270000-0x00000000012B0000-memory.dmpFilesize
256KB
-
memory/2504-38-0x0000000001270000-0x00000000012B0000-memory.dmpFilesize
256KB
-
memory/2504-39-0x0000000000E00000-0x0000000000E54000-memory.dmpFilesize
336KB
-
memory/2504-40-0x0000000000E00000-0x0000000000E4D000-memory.dmpFilesize
308KB
-
memory/2504-41-0x0000000000E00000-0x0000000000E4D000-memory.dmpFilesize
308KB
-
memory/2504-45-0x0000000000E00000-0x0000000000E4D000-memory.dmpFilesize
308KB
-
memory/2504-43-0x0000000000E00000-0x0000000000E4D000-memory.dmpFilesize
308KB
-
memory/2504-47-0x0000000000E00000-0x0000000000E4D000-memory.dmpFilesize
308KB
-
memory/2504-49-0x0000000000E00000-0x0000000000E4D000-memory.dmpFilesize
308KB
-
memory/2504-51-0x0000000000E00000-0x0000000000E4D000-memory.dmpFilesize
308KB
-
memory/2504-53-0x0000000000E00000-0x0000000000E4D000-memory.dmpFilesize
308KB
-
memory/2504-55-0x0000000000E00000-0x0000000000E4D000-memory.dmpFilesize
308KB
-
memory/2504-57-0x0000000000E00000-0x0000000000E4D000-memory.dmpFilesize
308KB
-
memory/2504-59-0x0000000000E00000-0x0000000000E4D000-memory.dmpFilesize
308KB
-
memory/2504-61-0x0000000000E00000-0x0000000000E4D000-memory.dmpFilesize
308KB
-
memory/2504-63-0x0000000000E00000-0x0000000000E4D000-memory.dmpFilesize
308KB
-
memory/2504-65-0x0000000000E00000-0x0000000000E4D000-memory.dmpFilesize
308KB
-
memory/2504-67-0x0000000000E00000-0x0000000000E4D000-memory.dmpFilesize
308KB
-
memory/2504-69-0x0000000000E00000-0x0000000000E4D000-memory.dmpFilesize
308KB
-
memory/2504-71-0x0000000000E00000-0x0000000000E4D000-memory.dmpFilesize
308KB
-
memory/2504-73-0x0000000000E00000-0x0000000000E4D000-memory.dmpFilesize
308KB
-
memory/2504-75-0x0000000000E00000-0x0000000000E4D000-memory.dmpFilesize
308KB
-
memory/2504-77-0x0000000000E00000-0x0000000000E4D000-memory.dmpFilesize
308KB
-
memory/2504-79-0x0000000000E00000-0x0000000000E4D000-memory.dmpFilesize
308KB
-
memory/2504-81-0x0000000000E00000-0x0000000000E4D000-memory.dmpFilesize
308KB
-
memory/2504-83-0x0000000000E00000-0x0000000000E4D000-memory.dmpFilesize
308KB
-
memory/2504-85-0x0000000000E00000-0x0000000000E4D000-memory.dmpFilesize
308KB
-
memory/2504-87-0x0000000000E00000-0x0000000000E4D000-memory.dmpFilesize
308KB
-
memory/2504-89-0x0000000000E00000-0x0000000000E4D000-memory.dmpFilesize
308KB
-
memory/2504-91-0x0000000000E00000-0x0000000000E4D000-memory.dmpFilesize
308KB
-
memory/2504-93-0x0000000000E00000-0x0000000000E4D000-memory.dmpFilesize
308KB
-
memory/2504-95-0x0000000000E00000-0x0000000000E4D000-memory.dmpFilesize
308KB
-
memory/2504-97-0x0000000000E00000-0x0000000000E4D000-memory.dmpFilesize
308KB
-
memory/2504-1086-0x0000000001270000-0x00000000012B0000-memory.dmpFilesize
256KB
-
memory/2504-1087-0x0000000000400000-0x0000000000446000-memory.dmpFilesize
280KB
-
memory/2504-1088-0x00000000745C0000-0x0000000074CAE000-memory.dmpFilesize
6.9MB
-
memory/2504-1089-0x0000000001270000-0x00000000012B0000-memory.dmpFilesize
256KB
-
memory/2504-1090-0x0000000001270000-0x00000000012B0000-memory.dmpFilesize
256KB
-
memory/2504-1091-0x0000000001270000-0x00000000012B0000-memory.dmpFilesize
256KB