Analysis
-
max time kernel
143s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
09-05-2024 01:23
Static task
static1
Behavioral task
behavioral1
Sample
39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a.exe
Resource
win10v2004-20240426-en
General
-
Target
39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a.exe
-
Size
145KB
-
MD5
115b5aae8c9a24258d28bfb74f638ac8
-
SHA1
3265a76ab3e92e5d77336427f3d6892fcb0d9cf7
-
SHA256
39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a
-
SHA512
2a8237a4b0f8dfcd6bce208a8b9a096f32edfe8de71ceb35e8bd842ffcc22dceae723c5270e766ab9f10f27e288344dd70d7f66b841cb828d21dcb313d8d058a
-
SSDEEP
1536:PezR1zewFnNK7GRvKVnnatIl6X0QnX3OON8UbBGk0:PI1zDFMQvynnatC6dW2h0
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot1263338506:AAEo1afaqZcanZqwKGJF2HA7xr6YOHyXHtU/
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Detect ZGRat V1 36 IoCs
Processes:
resource yara_rule behavioral2/memory/3312-4-0x00000000074E0000-0x00000000077CC000-memory.dmp family_zgrat_v1 behavioral2/memory/3312-12-0x00000000074E0000-0x00000000077C6000-memory.dmp family_zgrat_v1 behavioral2/memory/3312-10-0x00000000074E0000-0x00000000077C6000-memory.dmp family_zgrat_v1 behavioral2/memory/3312-18-0x00000000074E0000-0x00000000077C6000-memory.dmp family_zgrat_v1 behavioral2/memory/3312-16-0x00000000074E0000-0x00000000077C6000-memory.dmp family_zgrat_v1 behavioral2/memory/3312-24-0x00000000074E0000-0x00000000077C6000-memory.dmp family_zgrat_v1 behavioral2/memory/3312-22-0x00000000074E0000-0x00000000077C6000-memory.dmp family_zgrat_v1 behavioral2/memory/3312-54-0x00000000074E0000-0x00000000077C6000-memory.dmp family_zgrat_v1 behavioral2/memory/3312-56-0x00000000074E0000-0x00000000077C6000-memory.dmp family_zgrat_v1 behavioral2/memory/3312-66-0x00000000074E0000-0x00000000077C6000-memory.dmp family_zgrat_v1 behavioral2/memory/3312-64-0x00000000074E0000-0x00000000077C6000-memory.dmp family_zgrat_v1 behavioral2/memory/3312-70-0x00000000074E0000-0x00000000077C6000-memory.dmp family_zgrat_v1 behavioral2/memory/3312-68-0x00000000074E0000-0x00000000077C6000-memory.dmp family_zgrat_v1 behavioral2/memory/3312-62-0x00000000074E0000-0x00000000077C6000-memory.dmp family_zgrat_v1 behavioral2/memory/3312-60-0x00000000074E0000-0x00000000077C6000-memory.dmp family_zgrat_v1 behavioral2/memory/3312-58-0x00000000074E0000-0x00000000077C6000-memory.dmp family_zgrat_v1 behavioral2/memory/3312-52-0x00000000074E0000-0x00000000077C6000-memory.dmp family_zgrat_v1 behavioral2/memory/3312-50-0x00000000074E0000-0x00000000077C6000-memory.dmp family_zgrat_v1 behavioral2/memory/3312-48-0x00000000074E0000-0x00000000077C6000-memory.dmp family_zgrat_v1 behavioral2/memory/3312-46-0x00000000074E0000-0x00000000077C6000-memory.dmp family_zgrat_v1 behavioral2/memory/3312-44-0x00000000074E0000-0x00000000077C6000-memory.dmp family_zgrat_v1 behavioral2/memory/3312-42-0x00000000074E0000-0x00000000077C6000-memory.dmp family_zgrat_v1 behavioral2/memory/3312-40-0x00000000074E0000-0x00000000077C6000-memory.dmp family_zgrat_v1 behavioral2/memory/3312-38-0x00000000074E0000-0x00000000077C6000-memory.dmp family_zgrat_v1 behavioral2/memory/3312-36-0x00000000074E0000-0x00000000077C6000-memory.dmp family_zgrat_v1 behavioral2/memory/3312-30-0x00000000074E0000-0x00000000077C6000-memory.dmp family_zgrat_v1 behavioral2/memory/3312-20-0x00000000074E0000-0x00000000077C6000-memory.dmp family_zgrat_v1 behavioral2/memory/3312-34-0x00000000074E0000-0x00000000077C6000-memory.dmp family_zgrat_v1 behavioral2/memory/3312-32-0x00000000074E0000-0x00000000077C6000-memory.dmp family_zgrat_v1 behavioral2/memory/3312-28-0x00000000074E0000-0x00000000077C6000-memory.dmp family_zgrat_v1 behavioral2/memory/3312-26-0x00000000074E0000-0x00000000077C6000-memory.dmp family_zgrat_v1 behavioral2/memory/3312-8-0x00000000074E0000-0x00000000077C6000-memory.dmp family_zgrat_v1 behavioral2/memory/3312-14-0x00000000074E0000-0x00000000077C6000-memory.dmp family_zgrat_v1 behavioral2/memory/3312-7-0x00000000074E0000-0x00000000077C6000-memory.dmp family_zgrat_v1 behavioral2/memory/3992-7191-0x0000000004DD0000-0x0000000004E40000-memory.dmp family_zgrat_v1 behavioral2/memory/5696-7256-0x0000000005600000-0x0000000005830000-memory.dmp family_zgrat_v1 -
Detect packed .NET executables. Mostly AgentTeslaV4. 1 IoCs
Processes:
resource yara_rule behavioral2/memory/5940-12147-0x0000000000400000-0x0000000000442000-memory.dmp INDICATOR_EXE_Packed_GEN01 -
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 1 IoCs
Processes:
resource yara_rule behavioral2/memory/5940-12147-0x0000000000400000-0x0000000000442000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers -
Detects executables referencing Windows vault credential objects. Observed in infostealers 1 IoCs
Processes:
resource yara_rule behavioral2/memory/5940-12147-0x0000000000400000-0x0000000000442000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID -
Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers 1 IoCs
Processes:
resource yara_rule behavioral2/memory/5940-12147-0x0000000000400000-0x0000000000442000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store -
Detects executables referencing many email and collaboration clients. Observed in information stealers 1 IoCs
Processes:
resource yara_rule behavioral2/memory/5940-12147-0x0000000000400000-0x0000000000442000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients -
Detects executables referencing many file transfer clients. Observed in information stealers 1 IoCs
Processes:
resource yara_rule behavioral2/memory/5940-12147-0x0000000000400000-0x0000000000442000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients -
Downloads MZ/PE file
-
Executes dropped EXE 2 IoCs
Processes:
Thglbuzavc.exeThglbuzavc.exepid Process 5696 Thglbuzavc.exe 5940 Thglbuzavc.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 48 IoCs
Processes:
39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a.exeThglbuzavc.exedescription ioc Process Key opened \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a.exe Key created \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a.exe Key queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a.exe Key queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook 39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a.exe Key queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook 39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a.exe Key opened \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Thglbuzavc.exe Key created \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook 39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a.exe Key queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook 39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a.exe Key created \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a.exe Key queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a.exe Key queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a.exe Key created \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a.exe Key opened \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a.exe Key queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook 39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a.exe Key created \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a.exe Key created \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook 39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a.exe Key created \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a.exe Key created \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a.exe Key created \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a.exe Key queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a.exe Key opened \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a.exe Key created \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a.exe Key created \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook 39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a.exe Key created \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a.exe Key opened \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a.exe Key created \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a.exe Key created \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a.exe Key queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook 39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a.exe Key created \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook 39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a.exe Key created \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a.exe Key queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Thglbuzavc.exe Key opened \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a.exe Key queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a.exe Key queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a.exe Key opened \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Thglbuzavc.exe Key opened \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Thglbuzavc.exe Key created \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a.exe Key queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a.exe Key created \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook 39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a.exe Key created \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook 39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a.exe Key created \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a.exe Key queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook 39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a.exe Key opened \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a.exe Key created \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook 39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a.exe Key queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Thglbuzavc.exe Key queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Thglbuzavc.exe Key opened \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a.exe Key queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook 39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a.exeThglbuzavc.exedescription ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\notepad = "C:\\Users\\Admin\\AppData\\Roaming\\notepad.exe" 39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\notepad = "C:\\Users\\Admin\\AppData\\Roaming\\notepad.exe" Thglbuzavc.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 63 api.ipify.org 64 api.ipify.org -
Suspicious use of SetThreadContext 2 IoCs
Processes:
39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a.exeThglbuzavc.exedescription pid Process procid_target PID 3312 set thread context of 3992 3312 39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a.exe 90 PID 5696 set thread context of 5940 5696 Thglbuzavc.exe 99 -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a.exeThglbuzavc.exepid Process 3992 39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a.exe 3992 39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a.exe 3992 39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a.exe 3992 39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a.exe 5940 Thglbuzavc.exe 5940 Thglbuzavc.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a.exe39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a.exeThglbuzavc.exeThglbuzavc.exedescription pid Process Token: SeDebugPrivilege 3312 39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a.exe Token: SeDebugPrivilege 3312 39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a.exe Token: SeDebugPrivilege 3992 39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a.exe Token: SeDebugPrivilege 5696 Thglbuzavc.exe Token: SeDebugPrivilege 5696 Thglbuzavc.exe Token: SeDebugPrivilege 5940 Thglbuzavc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Thglbuzavc.exepid Process 5940 Thglbuzavc.exe -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a.exe39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a.exeThglbuzavc.exedescription pid Process procid_target PID 3312 wrote to memory of 3992 3312 39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a.exe 90 PID 3312 wrote to memory of 3992 3312 39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a.exe 90 PID 3312 wrote to memory of 3992 3312 39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a.exe 90 PID 3312 wrote to memory of 3992 3312 39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a.exe 90 PID 3312 wrote to memory of 3992 3312 39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a.exe 90 PID 3312 wrote to memory of 3992 3312 39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a.exe 90 PID 3312 wrote to memory of 3992 3312 39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a.exe 90 PID 3312 wrote to memory of 3992 3312 39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a.exe 90 PID 3992 wrote to memory of 5696 3992 39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a.exe 97 PID 3992 wrote to memory of 5696 3992 39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a.exe 97 PID 3992 wrote to memory of 5696 3992 39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a.exe 97 PID 5696 wrote to memory of 5940 5696 Thglbuzavc.exe 99 PID 5696 wrote to memory of 5940 5696 Thglbuzavc.exe 99 PID 5696 wrote to memory of 5940 5696 Thglbuzavc.exe 99 PID 5696 wrote to memory of 5940 5696 Thglbuzavc.exe 99 PID 5696 wrote to memory of 5940 5696 Thglbuzavc.exe 99 PID 5696 wrote to memory of 5940 5696 Thglbuzavc.exe 99 PID 5696 wrote to memory of 5940 5696 Thglbuzavc.exe 99 PID 5696 wrote to memory of 5940 5696 Thglbuzavc.exe 99 -
outlook_office_path 1 IoCs
Processes:
Thglbuzavc.exedescription ioc Process Key queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Thglbuzavc.exe -
outlook_win_path 1 IoCs
Processes:
Thglbuzavc.exedescription ioc Process Key queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Thglbuzavc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a.exe"C:\Users\Admin\AppData\Local\Temp\39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3312 -
C:\Users\Admin\AppData\Local\Temp\39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a.exe"C:\Users\Admin\AppData\Local\Temp\39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3992 -
C:\Users\Admin\AppData\Local\Temp\Thglbuzavc.exe"C:\Users\Admin\AppData\Local\Temp\Thglbuzavc.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5696 -
C:\Users\Admin\AppData\Local\Temp\Thglbuzavc.exe"C:\Users\Admin\AppData\Local\Temp\Thglbuzavc.exe"4⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
PID:5940
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a.exe.log
Filesize1KB
MD5f3eb81974dc5933681e933f07209ff5f
SHA17af8cae0f1d03e82daaf784df9886705685baac7
SHA256e82069884dd428bd6a1c67fe00c5fa56f9c4d62b538b694694a699588f1f4ab2
SHA512d9aa3871dffb76c8a73a7940fa03bbc9b65cf575cbd07f7c1fbf490cb0f3d670415eaef0bf79e34689f61ab3cdfbb104efdef004becc12e54b501f02f948aaff
-
Filesize
805B
MD558a9108e39c2ea50e65c23be3a9407cf
SHA1fb21f7b9330aa1a77080a3243b81b49035102d7b
SHA2566049be83020702896a539b5c8c13270add224d7b91b3ee0bebc328791b74a84b
SHA51293804ee8a4560503e47c07f5fa4a959e23355a01aba406c103d339debc9b2b1d20a345cdbb8d8069dac97b9151f228cf559ac3dde1500e3484fba1a4126842bf
-
Filesize
124KB
MD59618e15b04a4ddb39ed6c496575f6f95
SHA11c28f8750e5555776b3c80b187c5d15a443a7412
SHA256a4cd72e529e60b5f74c50e4e5b159efaf80625f23534dd15a28203760b8b28ab
SHA512f802582aa7510f6b950e3343b0560ffa9037c6d22373a6a33513637ab0f8e60ed23294a13ad8890935b02c64830b5232ba9f60d0c0fe90df02b5da30ecd7fa26
-
Filesize
152KB
MD573bd1e15afb04648c24593e8ba13e983
SHA14dd85ca46fcdf9d93f6b324f8bb0b5bb512a1b91
SHA256aab0b201f392fef9fdff09e56a9d0ac33d0f68be95da270e6dab89bb1f971d8b
SHA5126eb58fb41691894045569085bd64a83acd62277575ab002cf73d729bda4b6d43c36643a5fa336342e87a493326337ed43b8e5eaeae32f53210714699cb8dfac7
-
Filesize
2.3MB
MD5b5b77f0c912f438cbc5142c42818fa29
SHA194b5df605f00d34581435e3ca10b47094e31c0ab
SHA256ab3f0c321894430eed1ba65eca338a0471e18ba82cdd554084ed63f36ff91dce
SHA51287a1fbb1b8187377997b219bf6b286102648ff913ab0d73c78c67bee443702e9824bc14e980a2d38e5ece9a1fccc6e134f5dfa6f2b9bd9604ccb0d140418424f
-
Filesize
2.3MB
MD53e1044c6fe5320b1f34518af791a280f
SHA108a120be0bad2432304ef307d19199ff5f154404
SHA256c417dbc779736c6179af9f115300dbb871b3010b459360dc0a93ef56301dc051
SHA51289b2a47b3ed5470702cf6061675940eed191c5ff4ff953814a3d3278b619bd2669cfcd56ba3bc9d9ae2fb8287b24bbb98da58251a396c7456ccfa418a25cf204