Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
08/06/2024, 01:37
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
e5b17791c2ba72a6863db36010e7c8f59697b825526ac1b0484e8728b4957d4d.exe
Resource
win7-20240220-en
windows7-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
e5b17791c2ba72a6863db36010e7c8f59697b825526ac1b0484e8728b4957d4d.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
15 signatures
150 seconds
General
- Target e5b17791c2ba72a6863db36010e7c8f59697b825526ac1b0484e8728b4957d4d.exe
- Size 1.2MB
- Sample240608-b168dagb57
- SHA256 e5b17791c2ba72a6863db36010e7c8f59697b825526ac1b0484e8728b4957d4d
- MD5 d6b1b64efb8f539537cebb0229ee2d22
- SHA1 826cfa8a12a7a7c451b552f5497b0a27de0c8def
- SHA512 dcce83cce7f280a9d111f85821c0a3a07bb937e7e6d89c8e63e6a22cfbf94441b3254a0ddf5c0862d635813d02cd92c524eb67debd6eb476c842dec89452f348
- SSDEEP 24576:DAHnh+eWsN3skA4RV1Hom2KXMmHafIUh8NZ4xhR5:Oh+ZkldoPK8YafI0MZ0x
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Detect packed .NET executables. Mostly AgentTeslaV4. 33 IoCs
resource yara_rule behavioral2/memory/2992-18-0x0000000005800000-0x0000000005854000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/2992-22-0x0000000005850000-0x00000000058A2000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/2992-27-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/2992-33-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/2992-83-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/2992-81-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/2992-79-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/2992-77-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/2992-75-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/2992-71-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/2992-70-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/2992-67-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/2992-65-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/2992-63-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/2992-61-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/2992-59-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/2992-57-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/2992-55-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/2992-53-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/2992-51-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/2992-49-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/2992-45-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/2992-43-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/2992-41-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/2992-39-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/2992-37-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/2992-35-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/2992-31-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/2992-29-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/2992-26-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/2992-73-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/2992-47-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/2992-24-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_EXE_Packed_GEN01 - Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 33 IoCs
resource yara_rule behavioral2/memory/2992-18-0x0000000005800000-0x0000000005854000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/2992-22-0x0000000005850000-0x00000000058A2000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/2992-27-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/2992-33-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/2992-83-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/2992-81-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/2992-79-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/2992-77-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/2992-75-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/2992-71-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/2992-70-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/2992-67-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/2992-65-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/2992-63-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/2992-61-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/2992-59-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/2992-57-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/2992-55-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/2992-53-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/2992-51-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/2992-49-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/2992-45-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/2992-43-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/2992-41-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/2992-39-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/2992-37-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/2992-35-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/2992-31-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/2992-29-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/2992-26-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/2992-73-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/2992-47-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/2992-24-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers - Detects executables referencing Windows vault credential objects. Observed in infostealers 33 IoCs
resource yara_rule behavioral2/memory/2992-18-0x0000000005800000-0x0000000005854000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/2992-22-0x0000000005850000-0x00000000058A2000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/2992-27-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/2992-33-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/2992-83-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/2992-81-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/2992-79-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/2992-77-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/2992-75-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/2992-71-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/2992-70-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/2992-67-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/2992-65-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/2992-63-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/2992-61-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/2992-59-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/2992-57-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/2992-55-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/2992-53-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/2992-51-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/2992-49-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/2992-45-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/2992-43-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/2992-41-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/2992-39-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/2992-37-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/2992-35-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/2992-31-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/2992-29-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/2992-26-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/2992-73-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/2992-47-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/2992-24-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID - Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers 33 IoCs
resource yara_rule behavioral2/memory/2992-18-0x0000000005800000-0x0000000005854000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/2992-22-0x0000000005850000-0x00000000058A2000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/2992-27-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/2992-33-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/2992-83-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/2992-81-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/2992-79-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/2992-77-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/2992-75-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/2992-71-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/2992-70-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/2992-67-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/2992-65-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/2992-63-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/2992-61-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/2992-59-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/2992-57-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/2992-55-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/2992-53-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/2992-51-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/2992-49-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/2992-45-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/2992-43-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/2992-41-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/2992-39-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/2992-37-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/2992-35-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/2992-31-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/2992-29-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/2992-26-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/2992-73-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/2992-47-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/2992-24-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store - Detects executables referencing many email and collaboration clients. Observed in information stealers 33 IoCs
resource yara_rule behavioral2/memory/2992-18-0x0000000005800000-0x0000000005854000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/2992-22-0x0000000005850000-0x00000000058A2000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/2992-27-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/2992-33-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/2992-83-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/2992-81-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/2992-79-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/2992-77-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/2992-75-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/2992-71-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/2992-70-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/2992-67-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/2992-65-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/2992-63-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/2992-61-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/2992-59-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/2992-57-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/2992-55-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/2992-53-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/2992-51-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/2992-49-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/2992-45-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/2992-43-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/2992-41-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/2992-39-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/2992-37-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/2992-35-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/2992-31-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/2992-29-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/2992-26-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/2992-73-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/2992-47-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/2992-24-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients - Detects executables referencing many file transfer clients. Observed in information stealers 33 IoCs
resource yara_rule behavioral2/memory/2992-18-0x0000000005800000-0x0000000005854000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/2992-22-0x0000000005850000-0x00000000058A2000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/2992-27-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/2992-33-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/2992-83-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/2992-81-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/2992-79-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/2992-77-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/2992-75-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/2992-71-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/2992-70-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/2992-67-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/2992-65-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/2992-63-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/2992-61-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/2992-59-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/2992-57-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/2992-55-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/2992-53-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/2992-51-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/2992-49-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/2992-45-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/2992-43-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/2992-41-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/2992-39-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/2992-37-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/2992-35-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/2992-31-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/2992-29-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/2992-26-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/2992-73-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/2992-47-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/2992-24-0x0000000005850000-0x000000000589D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients - Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 14 api.ipify.org 15 api.ipify.org - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1984 set thread context of 2992 1984 e5b17791c2ba72a6863db36010e7c8f59697b825526ac1b0484e8728b4957d4d.exe 84 - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2992 RegSvcs.exe 2992 RegSvcs.exe - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1984 e5b17791c2ba72a6863db36010e7c8f59697b825526ac1b0484e8728b4957d4d.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2992 RegSvcs.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1984 e5b17791c2ba72a6863db36010e7c8f59697b825526ac1b0484e8728b4957d4d.exe 1984 e5b17791c2ba72a6863db36010e7c8f59697b825526ac1b0484e8728b4957d4d.exe - Suspicious use of SendNotifyMessage 2 IoCs
pid Process 1984 e5b17791c2ba72a6863db36010e7c8f59697b825526ac1b0484e8728b4957d4d.exe 1984 e5b17791c2ba72a6863db36010e7c8f59697b825526ac1b0484e8728b4957d4d.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1984 wrote to memory of 2992 1984 e5b17791c2ba72a6863db36010e7c8f59697b825526ac1b0484e8728b4957d4d.exe 84 PID 1984 wrote to memory of 2992 1984 e5b17791c2ba72a6863db36010e7c8f59697b825526ac1b0484e8728b4957d4d.exe 84 PID 1984 wrote to memory of 2992 1984 e5b17791c2ba72a6863db36010e7c8f59697b825526ac1b0484e8728b4957d4d.exe 84 PID 1984 wrote to memory of 2992 1984 e5b17791c2ba72a6863db36010e7c8f59697b825526ac1b0484e8728b4957d4d.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\e5b17791c2ba72a6863db36010e7c8f59697b825526ac1b0484e8728b4957d4d.exe"C:\Users\Admin\AppData\Local\Temp\e5b17791c2ba72a6863db36010e7c8f59697b825526ac1b0484e8728b4957d4d.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\e5b17791c2ba72a6863db36010e7c8f59697b825526ac1b0484e8728b4957d4d.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2992
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\aut442D.tmp
- Size 262KB
- SHA256 bb8d8be9577bffbd224cf59e7751d5a52c6e6add5dcce6fd9b6f80f0c11bef8c
- MD5 5ce8db079edd43f446072fd6aedc8ae5
- SHA1 889db4dbbf067504480360e979c50493a15ec21f
- SHA512 8e99562960199c4b450950f65dcaef79948629e70b8c90896ad11c6dca6e69328602ea75f2456252b1d18b03238af06a08f02b7b90ded73831b2564e8ab27fca
- SSDEEP 6144:4ZO5FgCqMlPYx1JPr4CmLzXOQuUwvVslduGqqJirz:tkqlYfJz4CmLTPNuDz
- MD5 SHA1 SHA512 SSDEEP