Analysis
- max time kernel
105s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
08/06/2024, 01:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
86ab02d0fc678ff261986a22fde52074e9d9f99cf5e3f28e4b7e6d66c74fa5fa.exe
Resource
win7-20240215-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
86ab02d0fc678ff261986a22fde52074e9d9f99cf5e3f28e4b7e6d66c74fa5fa.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
14 signatures
150 seconds
General
- Target 86ab02d0fc678ff261986a22fde52074e9d9f99cf5e3f28e4b7e6d66c74fa5fa.exe
- Size 262KB
- Sample240608-bqq4eafa4y
- SHA256 86ab02d0fc678ff261986a22fde52074e9d9f99cf5e3f28e4b7e6d66c74fa5fa
- MD5 202066665e3dbf7c97c55ec3e339193c
- SHA1 4f9c5cbca8a744723968f7fbe7b1bd2bc327bb0d
- SHA512 e23d88fe3a67b5431f919081da8431a9d0e8117a2ae3af4109310aaa68f042988ee07f7e1ff95bb7b60e0599a5c65247fe834e63bb5b696db8780198e7fe1d9e
- SSDEEP 6144:XDKW1Lgbdl0TBBvjc/rgRcdZYMI2IuNjXBFsBzZ4C7tWP8:Th1Lk70TnvjcMcdBZIuNL2x8P8
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Extracted
Credentials
-
Protocol
smtp
-
Host
fiber13.dnsiaas.com
-
Port
587
-
Username
-
Password
M1.N&IG&4uI]
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Detect packed .NET executables. Mostly AgentTeslaV4. 35 IoCs
resource yara_rule behavioral2/memory/4808-1-0x0000000002620000-0x0000000002674000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4808-4-0x0000000004B50000-0x0000000004BA2000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4808-60-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4808-68-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4808-66-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4808-64-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4808-62-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4808-58-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4808-56-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4808-54-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4808-53-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4808-50-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4808-46-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4808-44-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4808-42-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4808-40-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4808-38-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4808-36-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4808-34-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4808-32-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4808-30-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4808-28-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4808-22-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4808-20-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4808-18-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4808-16-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4808-14-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4808-12-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4808-8-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4808-6-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4808-5-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4808-48-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4808-26-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4808-24-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4808-10-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_EXE_Packed_GEN01 - Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 35 IoCs
resource yara_rule behavioral2/memory/4808-1-0x0000000002620000-0x0000000002674000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/4808-4-0x0000000004B50000-0x0000000004BA2000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/4808-60-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/4808-68-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/4808-66-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/4808-64-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/4808-62-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/4808-58-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/4808-56-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/4808-54-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/4808-53-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/4808-50-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/4808-46-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/4808-44-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/4808-42-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/4808-40-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/4808-38-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/4808-36-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/4808-34-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/4808-32-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/4808-30-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/4808-28-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/4808-22-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/4808-20-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/4808-18-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/4808-16-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/4808-14-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/4808-12-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/4808-8-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/4808-6-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/4808-5-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/4808-48-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/4808-26-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/4808-24-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/4808-10-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers - Detects executables referencing Windows vault credential objects. Observed in infostealers 35 IoCs
resource yara_rule behavioral2/memory/4808-1-0x0000000002620000-0x0000000002674000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/4808-4-0x0000000004B50000-0x0000000004BA2000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/4808-60-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/4808-68-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/4808-66-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/4808-64-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/4808-62-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/4808-58-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/4808-56-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/4808-54-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/4808-53-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/4808-50-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/4808-46-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/4808-44-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/4808-42-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/4808-40-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/4808-38-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/4808-36-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/4808-34-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/4808-32-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/4808-30-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/4808-28-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/4808-22-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/4808-20-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/4808-18-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/4808-16-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/4808-14-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/4808-12-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/4808-8-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/4808-6-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/4808-5-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/4808-48-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/4808-26-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/4808-24-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/4808-10-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID - Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers 35 IoCs
resource yara_rule behavioral2/memory/4808-1-0x0000000002620000-0x0000000002674000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/4808-4-0x0000000004B50000-0x0000000004BA2000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/4808-60-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/4808-68-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/4808-66-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/4808-64-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/4808-62-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/4808-58-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/4808-56-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/4808-54-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/4808-53-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/4808-50-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/4808-46-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/4808-44-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/4808-42-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/4808-40-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/4808-38-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/4808-36-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/4808-34-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/4808-32-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/4808-30-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/4808-28-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/4808-22-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/4808-20-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/4808-18-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/4808-16-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/4808-14-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/4808-12-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/4808-8-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/4808-6-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/4808-5-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/4808-48-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/4808-26-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/4808-24-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/4808-10-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store - Detects executables referencing many email and collaboration clients. Observed in information stealers 35 IoCs
resource yara_rule behavioral2/memory/4808-1-0x0000000002620000-0x0000000002674000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/4808-4-0x0000000004B50000-0x0000000004BA2000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/4808-60-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/4808-68-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/4808-66-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/4808-64-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/4808-62-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/4808-58-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/4808-56-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/4808-54-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/4808-53-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/4808-50-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/4808-46-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/4808-44-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/4808-42-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/4808-40-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/4808-38-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/4808-36-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/4808-34-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/4808-32-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/4808-30-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/4808-28-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/4808-22-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/4808-20-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/4808-18-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/4808-16-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/4808-14-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/4808-12-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/4808-8-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/4808-6-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/4808-5-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/4808-48-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/4808-26-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/4808-24-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/4808-10-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients - Detects executables referencing many file transfer clients. Observed in information stealers 35 IoCs
resource yara_rule behavioral2/memory/4808-1-0x0000000002620000-0x0000000002674000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/4808-4-0x0000000004B50000-0x0000000004BA2000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/4808-60-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/4808-68-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/4808-66-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/4808-64-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/4808-62-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/4808-58-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/4808-56-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/4808-54-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/4808-53-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/4808-50-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/4808-46-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/4808-44-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/4808-42-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/4808-40-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/4808-38-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/4808-36-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/4808-34-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/4808-32-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/4808-30-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/4808-28-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/4808-22-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/4808-20-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/4808-18-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/4808-16-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/4808-14-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/4808-12-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/4808-8-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/4808-6-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/4808-5-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/4808-48-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/4808-26-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/4808-24-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/4808-10-0x0000000004B50000-0x0000000004B9D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients - Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 12 api.ipify.org 13 api.ipify.org - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4808 86ab02d0fc678ff261986a22fde52074e9d9f99cf5e3f28e4b7e6d66c74fa5fa.exe 4808 86ab02d0fc678ff261986a22fde52074e9d9f99cf5e3f28e4b7e6d66c74fa5fa.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4808 86ab02d0fc678ff261986a22fde52074e9d9f99cf5e3f28e4b7e6d66c74fa5fa.exe