agenttesla | 6a33fd9b1812a319e10fb337b87baabf2f90ae938b9bb1d0bed94c70b7cc2423

General

Target

ITEMS CATOLOG SLIDE.exe
Size

937KB
MD5

4a323d354ce4f623d28481674820af27
SHA1

47c96244f4f6c5ba61b09d97694afbf16707cff8
SHA256

9a40bb86b69f6c6702f4cef6b9b4c51c68d5923a239eaf6ed3029374d13ccee8
SHA512

2f5cec2c419460af012bfc233222db3ba7ba64c2339ac4c2f6dca17377c7cdf4f0cfa4fbec47577f35fcbeee728724483d5e98357681261a9a7cb7675a89fcb3
SSDEEP

12288:PMMbni72U8L4042zQ1WVeXFfJoPQ59ouW1md0PaLAJRCIYpu5ssoxJzNJbH7o:kMbni723L73/gXFxoYzcBVeNN7o

Score

10^/10

agenttesla keylogger persistence spyware stealer trojan

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
mail.avtorska.com.mk
Port:
587
Username:
[email protected]
Password:
avtorska2014@

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.avtorska.com.mk
Port:
587
Username:
[email protected]
Password:
avtorska2014@
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Executes dropped EXE 1 IoCs

Processes:

file.exe

pid process

2520 file.exe
Loads dropped DLL 3 IoCs

Processes:

cmd.exefile.exe

pid process

2256 cmd.exe
2520 file.exe
2520 file.exe
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
2520	file.exe

pid	process
2256	cmd.exe
2520	file.exe
2520	file.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

reg.exeRegAsm.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\files = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\mail\\file.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\skype = "C:\\Users\\Admin\\AppData\\Roaming\\skype\\skype.exe"	RegAsm.exe

Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

10 api.ipify.org
11 api.ipify.org
19 ip-api.com
Suspicious use of SetThreadContext 1 IoCs

Processes:

file.exe

description pid process target process

PID 2520 set thread context of 2852 2520 file.exe RegAsm.exe

flow	ioc
10	api.ipify.org
11	api.ipify.org
19	ip-api.com

description	pid	process	target process
PID 2520 set thread context of 2852	2520	file.exe	RegAsm.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

Processes:

RegAsm.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C	RegAsm.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802025300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c00b000000010000001600000047006c006f00620061006c005300690067006e000000140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	RegAsm.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 190000000100000010000000a823b4a20180beb460cab955c24d7e21030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b0b000000010000001600000047006c006f00620061006c005300690067006e0000005300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802020f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	RegAsm.exe

Runs ping.exe 1 TTPs 3 IoCs

Remote System Discovery
T1018

Processes:

PING.EXEPING.EXEPING.EXE

pid process

3068 PING.EXE
2660 PING.EXE
2312 PING.EXE

pid	process
3068	PING.EXE
2660	PING.EXE
2312	PING.EXE

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

ITEMS CATOLOG SLIDE.exefile.exeRegAsm.exe

pid	process
2004	ITEMS CATOLOG SLIDE.exe
2004	ITEMS CATOLOG SLIDE.exe
2004	ITEMS CATOLOG SLIDE.exe
2004	ITEMS CATOLOG SLIDE.exe
2004	ITEMS CATOLOG SLIDE.exe
2004	ITEMS CATOLOG SLIDE.exe
2004	ITEMS CATOLOG SLIDE.exe
2520	file.exe
2520	file.exe
2520	file.exe
2520	file.exe
2852	RegAsm.exe
2852	RegAsm.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

ITEMS CATOLOG SLIDE.exefile.exeRegAsm.exe

description pid process

Token: SeDebugPrivilege 2004 ITEMS CATOLOG SLIDE.exe
Token: SeDebugPrivilege 2520 file.exe
Token: SeDebugPrivilege 2852 RegAsm.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

RegAsm.exe

pid process

2852 RegAsm.exe

description	pid	process
Token: SeDebugPrivilege	2004	ITEMS CATOLOG SLIDE.exe
Token: SeDebugPrivilege	2520	file.exe
Token: SeDebugPrivilege	2852	RegAsm.exe

pid	process
2852	RegAsm.exe

Suspicious use of WriteProcessMemory 61 IoCs

Processes:

ITEMS CATOLOG SLIDE.execmd.execmd.exefile.exe

description	pid	process	target process
PID 2004 wrote to memory of 2884	2004	ITEMS CATOLOG SLIDE.exe	cmd.exe
PID 2004 wrote to memory of 2884	2004	ITEMS CATOLOG SLIDE.exe	cmd.exe
PID 2004 wrote to memory of 2884	2004	ITEMS CATOLOG SLIDE.exe	cmd.exe
PID 2004 wrote to memory of 2884	2004	ITEMS CATOLOG SLIDE.exe	cmd.exe
PID 2004 wrote to memory of 2884	2004	ITEMS CATOLOG SLIDE.exe	cmd.exe
PID 2004 wrote to memory of 2884	2004	ITEMS CATOLOG SLIDE.exe	cmd.exe
PID 2004 wrote to memory of 2884	2004	ITEMS CATOLOG SLIDE.exe	cmd.exe
PID 2884 wrote to memory of 2312	2884	cmd.exe	PING.EXE
PID 2884 wrote to memory of 2312	2884	cmd.exe	PING.EXE
PID 2884 wrote to memory of 2312	2884	cmd.exe	PING.EXE
PID 2884 wrote to memory of 2312	2884	cmd.exe	PING.EXE
PID 2884 wrote to memory of 2312	2884	cmd.exe	PING.EXE
PID 2884 wrote to memory of 2312	2884	cmd.exe	PING.EXE
PID 2884 wrote to memory of 2312	2884	cmd.exe	PING.EXE
PID 2004 wrote to memory of 2256	2004	ITEMS CATOLOG SLIDE.exe	cmd.exe
PID 2004 wrote to memory of 2256	2004	ITEMS CATOLOG SLIDE.exe	cmd.exe
PID 2004 wrote to memory of 2256	2004	ITEMS CATOLOG SLIDE.exe	cmd.exe
PID 2004 wrote to memory of 2256	2004	ITEMS CATOLOG SLIDE.exe	cmd.exe
PID 2004 wrote to memory of 2256	2004	ITEMS CATOLOG SLIDE.exe	cmd.exe
PID 2004 wrote to memory of 2256	2004	ITEMS CATOLOG SLIDE.exe	cmd.exe
PID 2004 wrote to memory of 2256	2004	ITEMS CATOLOG SLIDE.exe	cmd.exe
PID 2256 wrote to memory of 3068	2256	cmd.exe	PING.EXE
PID 2256 wrote to memory of 3068	2256	cmd.exe	PING.EXE
PID 2256 wrote to memory of 3068	2256	cmd.exe	PING.EXE
PID 2256 wrote to memory of 3068	2256	cmd.exe	PING.EXE
PID 2256 wrote to memory of 3068	2256	cmd.exe	PING.EXE
PID 2256 wrote to memory of 3068	2256	cmd.exe	PING.EXE
PID 2256 wrote to memory of 3068	2256	cmd.exe	PING.EXE
PID 2884 wrote to memory of 2684	2884	cmd.exe	reg.exe
PID 2884 wrote to memory of 2684	2884	cmd.exe	reg.exe
PID 2884 wrote to memory of 2684	2884	cmd.exe	reg.exe
PID 2884 wrote to memory of 2684	2884	cmd.exe	reg.exe
PID 2884 wrote to memory of 2684	2884	cmd.exe	reg.exe
PID 2884 wrote to memory of 2684	2884	cmd.exe	reg.exe
PID 2884 wrote to memory of 2684	2884	cmd.exe	reg.exe
PID 2256 wrote to memory of 2660	2256	cmd.exe	PING.EXE
PID 2256 wrote to memory of 2660	2256	cmd.exe	PING.EXE
PID 2256 wrote to memory of 2660	2256	cmd.exe	PING.EXE
PID 2256 wrote to memory of 2660	2256	cmd.exe	PING.EXE
PID 2256 wrote to memory of 2660	2256	cmd.exe	PING.EXE
PID 2256 wrote to memory of 2660	2256	cmd.exe	PING.EXE
PID 2256 wrote to memory of 2660	2256	cmd.exe	PING.EXE
PID 2256 wrote to memory of 2520	2256	cmd.exe	file.exe
PID 2256 wrote to memory of 2520	2256	cmd.exe	file.exe
PID 2256 wrote to memory of 2520	2256	cmd.exe	file.exe
PID 2256 wrote to memory of 2520	2256	cmd.exe	file.exe
PID 2256 wrote to memory of 2520	2256	cmd.exe	file.exe
PID 2256 wrote to memory of 2520	2256	cmd.exe	file.exe
PID 2256 wrote to memory of 2520	2256	cmd.exe	file.exe
PID 2520 wrote to memory of 2852	2520	file.exe	RegAsm.exe
PID 2520 wrote to memory of 2852	2520	file.exe	RegAsm.exe
PID 2520 wrote to memory of 2852	2520	file.exe	RegAsm.exe
PID 2520 wrote to memory of 2852	2520	file.exe	RegAsm.exe
PID 2520 wrote to memory of 2852	2520	file.exe	RegAsm.exe
PID 2520 wrote to memory of 2852	2520	file.exe	RegAsm.exe
PID 2520 wrote to memory of 2852	2520	file.exe	RegAsm.exe
PID 2520 wrote to memory of 2852	2520	file.exe	RegAsm.exe
PID 2520 wrote to memory of 2852	2520	file.exe	RegAsm.exe
PID 2520 wrote to memory of 2852	2520	file.exe	RegAsm.exe
PID 2520 wrote to memory of 2852	2520	file.exe	RegAsm.exe
PID 2520 wrote to memory of 2852	2520	file.exe	RegAsm.exe

C:\Users\Admin\AppData\Local\Temp\ITEMS CATOLOG SLIDE.exe
"C:\Users\Admin\AppData\Local\Temp\ITEMS CATOLOG SLIDE.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2004

C:\Windows\SysWOW64\cmd.exe
"cmd" /c ping 127.0.0.1 -n 9 > nul && REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "files" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\mail\file.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:2884

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 9
3⤵
- Runs ping.exe
PID:2312

C:\Windows\SysWOW64\reg.exe
REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "files" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\mail\file.exe"
3⤵
- Adds Run key to start application
PID:2684

C:\Windows\SysWOW64\cmd.exe
"cmd" /c ping 127.0.0.1 -n 12 > nul && copy "C:\Users\Admin\AppData\Local\Temp\ITEMS CATOLOG SLIDE.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\mail\file.exe" && ping 127.0.0.1 -n 12 > nul && "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\mail\file.exe"
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2256

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 12
3⤵
- Runs ping.exe
PID:3068

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 12
3⤵
- Runs ping.exe
PID:2660

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\mail\file.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\mail\file.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2520

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
4⤵
- Adds Run key to start application
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2852

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

2

T1112

Subvert Trust Controls

1

T1553

Install Root Certificate

1

T1553.004

Credential Access

Unsecured Credentials

2

T1552

Credentials In Files

2

T1552.001

Discovery

Remote System Discovery

1

T1018

Lateral Movement

Collection

Data from Local System

2

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize
242B

MD5
0e9e1dec783c9b8aa8cdbc1175bd9491

SHA1
ec0ec70c51fd128350f19435e484a7fb19fb3b79

SHA256
258322f36ac4ae5bb28a554c9b549bbc3a774f6b9ebcbe7145152e1c3245bd20

SHA512
92a0ec79aeca26304afb9aedb41e0a64aee862fc95d8961bfd8a7e449ae1407ec68c393af164c8ff38085c3a91b76317c6ab1ebbe66390fbf73eb66f81f0e752

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3B7F.tmp
Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\mail\file.exe
Filesize
937KB

MD5
4a323d354ce4f623d28481674820af27

SHA1
47c96244f4f6c5ba61b09d97694afbf16707cff8

SHA256
9a40bb86b69f6c6702f4cef6b9b4c51c68d5923a239eaf6ed3029374d13ccee8

SHA512
2f5cec2c419460af012bfc233222db3ba7ba64c2339ac4c2f6dca17377c7cdf4f0cfa4fbec47577f35fcbeee728724483d5e98357681261a9a7cb7675a89fcb3

Download Submit
memory/2004-1-0x00000000054E0000-0x0000000005524000-memory.dmp

Filesize
272KB

Download
memory/2004-0-0x0000000000DA0000-0x0000000000E90000-memory.dmp

Filesize
960KB

Download
memory/2520-11-0x0000000001130000-0x0000000001220000-memory.dmp

Filesize
960KB

Download
memory/2520-12-0x00000000007A0000-0x00000000007BA000-memory.dmp

Filesize
104KB

Download
memory/2520-13-0x0000000000680000-0x0000000000686000-memory.dmp

Filesize
24KB

Download
memory/2852-22-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2852-23-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2852-24-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2852-25-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2852-18-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2852-20-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2852-14-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2852-16-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads