Analysis
- max time kernel
148s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
19/05/2024, 02:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d4dfb7228adfd937f59d1e4cd050cdfe3e24e18dbe24eda9b2c01ea51c664ff4.exe
Resource
win7-20240508-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
d4dfb7228adfd937f59d1e4cd050cdfe3e24e18dbe24eda9b2c01ea51c664ff4.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
14 signatures
150 seconds
General
- Target d4dfb7228adfd937f59d1e4cd050cdfe3e24e18dbe24eda9b2c01ea51c664ff4.exe
- Size 261KB
- Sample240519-ckph3ada5y
- SHA256 d4dfb7228adfd937f59d1e4cd050cdfe3e24e18dbe24eda9b2c01ea51c664ff4
- MD5 ee73e48395918fc324d655c14482effd
- SHA1 d177209785824724c4786c14995d1726b16f76ca
- SHA512 56d10c4003bc51dc9daaa1c2610e20af14c9059ede6bd5394f22833adbeef25b5cb55fbb4cc0735d644375f01de779442066e257b77709e93eec6af92a231002
- SSDEEP 6144:MDKW1Lgbdl0TBBvjc/28EfxpAG9FuEIB61Q:ah1Lk70TnvjcO8gxjFuEIB6m
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Extracted
Credentials
-
Protocol
smtp
-
Host
mail.kino2.top
-
Port
587
-
Username
-
Password
]]KMGj9lIqJ#
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Detect packed .NET executables. Mostly AgentTeslaV4. 35 IoCs
resource yara_rule behavioral2/memory/4856-1-0x0000000004A90000-0x0000000004AE4000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4856-4-0x0000000005110000-0x0000000005162000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4856-67-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4856-69-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4856-63-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4856-61-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4856-59-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4856-57-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4856-55-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4856-53-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4856-52-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4856-49-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4856-47-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4856-45-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4856-43-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4856-41-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4856-39-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4856-37-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4856-33-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4856-31-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4856-30-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4856-27-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4856-25-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4856-19-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4856-17-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4856-15-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4856-10-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4856-7-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4856-6-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4856-65-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4856-35-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4856-23-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4856-21-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4856-13-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4856-11-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_EXE_Packed_GEN01 - Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 35 IoCs
resource yara_rule behavioral2/memory/4856-1-0x0000000004A90000-0x0000000004AE4000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/4856-4-0x0000000005110000-0x0000000005162000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/4856-67-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/4856-69-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/4856-63-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/4856-61-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/4856-59-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/4856-57-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/4856-55-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/4856-53-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/4856-52-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/4856-49-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/4856-47-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/4856-45-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/4856-43-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/4856-41-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/4856-39-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/4856-37-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/4856-33-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/4856-31-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/4856-30-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/4856-27-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/4856-25-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/4856-19-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/4856-17-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/4856-15-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/4856-10-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/4856-7-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/4856-6-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/4856-65-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/4856-35-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/4856-23-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/4856-21-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/4856-13-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/4856-11-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers - Detects executables referencing Windows vault credential objects. Observed in infostealers 35 IoCs
resource yara_rule behavioral2/memory/4856-1-0x0000000004A90000-0x0000000004AE4000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/4856-4-0x0000000005110000-0x0000000005162000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/4856-67-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/4856-69-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/4856-63-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/4856-61-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/4856-59-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/4856-57-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/4856-55-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/4856-53-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/4856-52-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/4856-49-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/4856-47-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/4856-45-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/4856-43-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/4856-41-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/4856-39-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/4856-37-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/4856-33-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/4856-31-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/4856-30-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/4856-27-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/4856-25-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/4856-19-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/4856-17-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/4856-15-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/4856-10-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/4856-7-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/4856-6-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/4856-65-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/4856-35-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/4856-23-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/4856-21-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/4856-13-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/4856-11-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID - Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers 35 IoCs
resource yara_rule behavioral2/memory/4856-1-0x0000000004A90000-0x0000000004AE4000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/4856-4-0x0000000005110000-0x0000000005162000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/4856-67-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/4856-69-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/4856-63-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/4856-61-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/4856-59-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/4856-57-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/4856-55-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/4856-53-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/4856-52-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/4856-49-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/4856-47-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/4856-45-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/4856-43-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/4856-41-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/4856-39-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/4856-37-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/4856-33-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/4856-31-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/4856-30-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/4856-27-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/4856-25-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/4856-19-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/4856-17-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/4856-15-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/4856-10-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/4856-7-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/4856-6-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/4856-65-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/4856-35-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/4856-23-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/4856-21-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/4856-13-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/4856-11-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store - Detects executables referencing many email and collaboration clients. Observed in information stealers 35 IoCs
resource yara_rule behavioral2/memory/4856-1-0x0000000004A90000-0x0000000004AE4000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/4856-4-0x0000000005110000-0x0000000005162000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/4856-67-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/4856-69-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/4856-63-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/4856-61-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/4856-59-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/4856-57-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/4856-55-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/4856-53-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/4856-52-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/4856-49-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/4856-47-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/4856-45-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/4856-43-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/4856-41-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/4856-39-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/4856-37-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/4856-33-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/4856-31-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/4856-30-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/4856-27-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/4856-25-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/4856-19-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/4856-17-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/4856-15-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/4856-10-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/4856-7-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/4856-6-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/4856-65-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/4856-35-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/4856-23-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/4856-21-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/4856-13-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/4856-11-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients - Detects executables referencing many file transfer clients. Observed in information stealers 35 IoCs
resource yara_rule behavioral2/memory/4856-1-0x0000000004A90000-0x0000000004AE4000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/4856-4-0x0000000005110000-0x0000000005162000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/4856-67-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/4856-69-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/4856-63-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/4856-61-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/4856-59-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/4856-57-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/4856-55-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/4856-53-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/4856-52-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/4856-49-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/4856-47-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/4856-45-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/4856-43-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/4856-41-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/4856-39-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/4856-37-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/4856-33-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/4856-31-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/4856-30-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/4856-27-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/4856-25-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/4856-19-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/4856-17-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/4856-15-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/4856-10-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/4856-7-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/4856-6-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/4856-65-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/4856-35-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/4856-23-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/4856-21-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/4856-13-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/4856-11-0x0000000005110000-0x000000000515D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients - Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 16 api.ipify.org 17 api.ipify.org - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4856 d4dfb7228adfd937f59d1e4cd050cdfe3e24e18dbe24eda9b2c01ea51c664ff4.exe 4856 d4dfb7228adfd937f59d1e4cd050cdfe3e24e18dbe24eda9b2c01ea51c664ff4.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4856 d4dfb7228adfd937f59d1e4cd050cdfe3e24e18dbe24eda9b2c01ea51c664ff4.exe