Analysis
- max time kernel
147s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
12/06/2024, 01:05
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
1045b847a054314a54af5cf2a115c39cac66c6e6ee37cc5988eb02ef845d9ffa.exe
Resource
win7-20231129-en
windows7-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
1045b847a054314a54af5cf2a115c39cac66c6e6ee37cc5988eb02ef845d9ffa.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
15 signatures
150 seconds
General
- Target 1045b847a054314a54af5cf2a115c39cac66c6e6ee37cc5988eb02ef845d9ffa.exe
- Size 1.2MB
- Sample240612-bflqyaxcnc
- SHA256 1045b847a054314a54af5cf2a115c39cac66c6e6ee37cc5988eb02ef845d9ffa
- MD5 5803a2fc9ec15de6690c023bafe5602f
- SHA1 2aa646820ee1bc5beb13e9c96ec1392a9f99f94a
- SHA512 e3bdb085484642162fad43cd6caf414d183898a106060e694ff9285f4e8837db7ae2fb296c04b0dffed17335791306ed1d4e8904ea0909b5ad1b5226ff6c5b50
- SSDEEP 24576:/AHnh+eWsN3skA4RV1Hom2KXMmHaLDxW9vqdWHK0Lj8Vl5:ih+ZkldoPK8YaLDAUWq0Lk
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Detect packed .NET executables. Mostly AgentTeslaV4. 33 IoCs
resource yara_rule behavioral2/memory/2468-16-0x0000000002FF0000-0x0000000003044000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/2468-19-0x0000000005A40000-0x0000000005A92000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/2468-25-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/2468-67-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/2468-81-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/2468-79-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/2468-77-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/2468-75-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/2468-73-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/2468-71-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/2468-69-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/2468-65-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/2468-63-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/2468-61-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/2468-59-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/2468-58-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/2468-55-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/2468-53-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/2468-51-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/2468-49-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/2468-47-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/2468-45-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/2468-43-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/2468-39-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/2468-37-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/2468-35-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/2468-33-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/2468-31-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/2468-29-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/2468-27-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/2468-41-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/2468-23-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/2468-22-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_EXE_Packed_GEN01 - Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 33 IoCs
resource yara_rule behavioral2/memory/2468-16-0x0000000002FF0000-0x0000000003044000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/2468-19-0x0000000005A40000-0x0000000005A92000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/2468-25-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/2468-67-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/2468-81-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/2468-79-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/2468-77-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/2468-75-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/2468-73-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/2468-71-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/2468-69-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/2468-65-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/2468-63-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/2468-61-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/2468-59-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/2468-58-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/2468-55-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/2468-53-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/2468-51-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/2468-49-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/2468-47-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/2468-45-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/2468-43-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/2468-39-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/2468-37-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/2468-35-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/2468-33-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/2468-31-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/2468-29-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/2468-27-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/2468-41-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/2468-23-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/2468-22-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers - Detects executables referencing Windows vault credential objects. Observed in infostealers 33 IoCs
resource yara_rule behavioral2/memory/2468-16-0x0000000002FF0000-0x0000000003044000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/2468-19-0x0000000005A40000-0x0000000005A92000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/2468-25-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/2468-67-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/2468-81-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/2468-79-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/2468-77-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/2468-75-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/2468-73-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/2468-71-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/2468-69-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/2468-65-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/2468-63-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/2468-61-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/2468-59-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/2468-58-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/2468-55-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/2468-53-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/2468-51-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/2468-49-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/2468-47-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/2468-45-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/2468-43-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/2468-39-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/2468-37-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/2468-35-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/2468-33-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/2468-31-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/2468-29-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/2468-27-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/2468-41-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/2468-23-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/2468-22-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID - Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers 33 IoCs
resource yara_rule behavioral2/memory/2468-16-0x0000000002FF0000-0x0000000003044000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/2468-19-0x0000000005A40000-0x0000000005A92000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/2468-25-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/2468-67-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/2468-81-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/2468-79-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/2468-77-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/2468-75-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/2468-73-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/2468-71-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/2468-69-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/2468-65-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/2468-63-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/2468-61-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/2468-59-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/2468-58-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/2468-55-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/2468-53-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/2468-51-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/2468-49-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/2468-47-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/2468-45-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/2468-43-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/2468-39-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/2468-37-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/2468-35-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/2468-33-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/2468-31-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/2468-29-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/2468-27-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/2468-41-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/2468-23-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/2468-22-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store - Detects executables referencing many email and collaboration clients. Observed in information stealers 33 IoCs
resource yara_rule behavioral2/memory/2468-16-0x0000000002FF0000-0x0000000003044000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/2468-19-0x0000000005A40000-0x0000000005A92000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/2468-25-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/2468-67-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/2468-81-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/2468-79-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/2468-77-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/2468-75-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/2468-73-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/2468-71-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/2468-69-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/2468-65-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/2468-63-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/2468-61-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/2468-59-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/2468-58-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/2468-55-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/2468-53-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/2468-51-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/2468-49-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/2468-47-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/2468-45-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/2468-43-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/2468-39-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/2468-37-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/2468-35-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/2468-33-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/2468-31-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/2468-29-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/2468-27-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/2468-41-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/2468-23-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/2468-22-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients - Detects executables referencing many file transfer clients. Observed in information stealers 33 IoCs
resource yara_rule behavioral2/memory/2468-16-0x0000000002FF0000-0x0000000003044000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/2468-19-0x0000000005A40000-0x0000000005A92000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/2468-25-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/2468-67-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/2468-81-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/2468-79-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/2468-77-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/2468-75-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/2468-73-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/2468-71-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/2468-69-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/2468-65-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/2468-63-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/2468-61-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/2468-59-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/2468-58-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/2468-55-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/2468-53-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/2468-51-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/2468-49-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/2468-47-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/2468-45-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/2468-43-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/2468-39-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/2468-37-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/2468-35-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/2468-33-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/2468-31-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/2468-29-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/2468-27-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/2468-41-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/2468-23-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/2468-22-0x0000000005A40000-0x0000000005A8D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\boqXv = "C:\\Users\\Admin\\AppData\\Roaming\\boqXv\\boqXv.exe" RegSvcs.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2300 set thread context of 2468 2300 1045b847a054314a54af5cf2a115c39cac66c6e6ee37cc5988eb02ef845d9ffa.exe 84 - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2468 RegSvcs.exe 2468 RegSvcs.exe - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2300 1045b847a054314a54af5cf2a115c39cac66c6e6ee37cc5988eb02ef845d9ffa.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2468 RegSvcs.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2300 1045b847a054314a54af5cf2a115c39cac66c6e6ee37cc5988eb02ef845d9ffa.exe 2300 1045b847a054314a54af5cf2a115c39cac66c6e6ee37cc5988eb02ef845d9ffa.exe - Suspicious use of SendNotifyMessage 2 IoCs
pid Process 2300 1045b847a054314a54af5cf2a115c39cac66c6e6ee37cc5988eb02ef845d9ffa.exe 2300 1045b847a054314a54af5cf2a115c39cac66c6e6ee37cc5988eb02ef845d9ffa.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2300 wrote to memory of 2468 2300 1045b847a054314a54af5cf2a115c39cac66c6e6ee37cc5988eb02ef845d9ffa.exe 84 PID 2300 wrote to memory of 2468 2300 1045b847a054314a54af5cf2a115c39cac66c6e6ee37cc5988eb02ef845d9ffa.exe 84 PID 2300 wrote to memory of 2468 2300 1045b847a054314a54af5cf2a115c39cac66c6e6ee37cc5988eb02ef845d9ffa.exe 84 PID 2300 wrote to memory of 2468 2300 1045b847a054314a54af5cf2a115c39cac66c6e6ee37cc5988eb02ef845d9ffa.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\1045b847a054314a54af5cf2a115c39cac66c6e6ee37cc5988eb02ef845d9ffa.exe"C:\Users\Admin\AppData\Local\Temp\1045b847a054314a54af5cf2a115c39cac66c6e6ee37cc5988eb02ef845d9ffa.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\1045b847a054314a54af5cf2a115c39cac66c6e6ee37cc5988eb02ef845d9ffa.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2468
-