Analysis
- max time kernel
148s - max time network
131s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
09/06/2024, 01:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8c56b0f77abb15a25ffdd9e0700475d339c640c4f40094a8bc97223d850c1f4a.exe
Resource
win7-20240419-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
8c56b0f77abb15a25ffdd9e0700475d339c640c4f40094a8bc97223d850c1f4a.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
14 signatures
150 seconds
General
- Target 8c56b0f77abb15a25ffdd9e0700475d339c640c4f40094a8bc97223d850c1f4a.exe
- Size 261KB
- Sample240609-b2qxsacc76
- SHA256 8c56b0f77abb15a25ffdd9e0700475d339c640c4f40094a8bc97223d850c1f4a
- MD5 cf98d600d1bcb5cbf653ce1c217afffd
- SHA1 b390d1d18f7525df4ba20fb9a05c29661313303e
- SHA512 6c1edcf5cc6ccdc3536ddd6e20f101551a3ec3ec9745eab9714922ca16a5c4d6763f8e1df172672ec5987310b6efb7335056ff23970f2404bad1bca228c87b20
- SSDEEP 6144:zDKW1Lgbdl0TBBvjc/pln9MM1opjyQk0cfXGN49gT:nh1Lk70Tnvjcn93eplkJmT
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Extracted
Credentials
-
Protocol
smtp
-
Host
fiber13.dnsiaas.com
-
Port
587
-
Username
-
Password
feXwu@m?K@@L
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Detect packed .NET executables. Mostly AgentTeslaV4. 35 IoCs
resource yara_rule behavioral2/memory/4468-1-0x0000000004920000-0x0000000004974000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4468-5-0x0000000004FA0000-0x0000000004FF2000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4468-32-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4468-68-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4468-66-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4468-62-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4468-60-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4468-56-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4468-52-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4468-48-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4468-46-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4468-44-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4468-40-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4468-38-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4468-36-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4468-34-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4468-30-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4468-28-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4468-24-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4468-22-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4468-20-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4468-18-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4468-16-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4468-14-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4468-70-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4468-64-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4468-10-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4468-58-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4468-54-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4468-8-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4468-50-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4468-7-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4468-42-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4468-26-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4468-12-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_EXE_Packed_GEN01 - Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 35 IoCs
resource yara_rule behavioral2/memory/4468-1-0x0000000004920000-0x0000000004974000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/4468-5-0x0000000004FA0000-0x0000000004FF2000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/4468-32-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/4468-68-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/4468-66-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/4468-62-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/4468-60-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/4468-56-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/4468-52-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/4468-48-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/4468-46-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/4468-44-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/4468-40-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/4468-38-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/4468-36-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/4468-34-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/4468-30-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/4468-28-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/4468-24-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/4468-22-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/4468-20-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/4468-18-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/4468-16-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/4468-14-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/4468-70-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/4468-64-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/4468-10-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/4468-58-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/4468-54-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/4468-8-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/4468-50-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/4468-7-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/4468-42-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/4468-26-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/4468-12-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers - Detects executables referencing Windows vault credential objects. Observed in infostealers 35 IoCs
resource yara_rule behavioral2/memory/4468-1-0x0000000004920000-0x0000000004974000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/4468-5-0x0000000004FA0000-0x0000000004FF2000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/4468-32-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/4468-68-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/4468-66-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/4468-62-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/4468-60-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/4468-56-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/4468-52-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/4468-48-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/4468-46-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/4468-44-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/4468-40-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/4468-38-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/4468-36-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/4468-34-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/4468-30-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/4468-28-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/4468-24-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/4468-22-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/4468-20-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/4468-18-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/4468-16-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/4468-14-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/4468-70-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/4468-64-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/4468-10-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/4468-58-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/4468-54-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/4468-8-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/4468-50-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/4468-7-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/4468-42-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/4468-26-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/4468-12-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID - Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers 35 IoCs
resource yara_rule behavioral2/memory/4468-1-0x0000000004920000-0x0000000004974000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/4468-5-0x0000000004FA0000-0x0000000004FF2000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/4468-32-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/4468-68-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/4468-66-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/4468-62-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/4468-60-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/4468-56-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/4468-52-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/4468-48-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/4468-46-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/4468-44-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/4468-40-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/4468-38-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/4468-36-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/4468-34-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/4468-30-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/4468-28-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/4468-24-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/4468-22-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/4468-20-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/4468-18-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/4468-16-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/4468-14-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/4468-70-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/4468-64-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/4468-10-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/4468-58-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/4468-54-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/4468-8-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/4468-50-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/4468-7-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/4468-42-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/4468-26-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/4468-12-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store - Detects executables referencing many email and collaboration clients. Observed in information stealers 35 IoCs
resource yara_rule behavioral2/memory/4468-1-0x0000000004920000-0x0000000004974000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/4468-5-0x0000000004FA0000-0x0000000004FF2000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/4468-32-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/4468-68-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/4468-66-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/4468-62-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/4468-60-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/4468-56-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/4468-52-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/4468-48-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/4468-46-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/4468-44-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/4468-40-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/4468-38-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/4468-36-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/4468-34-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/4468-30-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/4468-28-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/4468-24-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/4468-22-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/4468-20-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/4468-18-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/4468-16-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/4468-14-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/4468-70-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/4468-64-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/4468-10-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/4468-58-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/4468-54-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/4468-8-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/4468-50-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/4468-7-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/4468-42-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/4468-26-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/4468-12-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients - Detects executables referencing many file transfer clients. Observed in information stealers 35 IoCs
resource yara_rule behavioral2/memory/4468-1-0x0000000004920000-0x0000000004974000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/4468-5-0x0000000004FA0000-0x0000000004FF2000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/4468-32-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/4468-68-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/4468-66-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/4468-62-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/4468-60-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/4468-56-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/4468-52-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/4468-48-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/4468-46-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/4468-44-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/4468-40-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/4468-38-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/4468-36-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/4468-34-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/4468-30-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/4468-28-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/4468-24-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/4468-22-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/4468-20-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/4468-18-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/4468-16-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/4468-14-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/4468-70-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/4468-64-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/4468-10-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/4468-58-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/4468-54-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/4468-8-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/4468-50-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/4468-7-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/4468-42-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/4468-26-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/4468-12-0x0000000004FA0000-0x0000000004FED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients - Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 12 api.ipify.org 13 api.ipify.org - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4468 8c56b0f77abb15a25ffdd9e0700475d339c640c4f40094a8bc97223d850c1f4a.exe 4468 8c56b0f77abb15a25ffdd9e0700475d339c640c4f40094a8bc97223d850c1f4a.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4468 8c56b0f77abb15a25ffdd9e0700475d339c640c4f40094a8bc97223d850c1f4a.exe