Malware Analysis Report

2024-10-19 09:23

Sample ID 240612-chrweaydkq
Target b97ca324b50c24c05c82b6ae51702cc8bedcd1474bb875099260559463683883.exe
SHA256 b97ca324b50c24c05c82b6ae51702cc8bedcd1474bb875099260559463683883
Tags
agenttesla keylogger spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

b97ca324b50c24c05c82b6ae51702cc8bedcd1474bb875099260559463683883

Threat Level: Known bad

The file b97ca324b50c24c05c82b6ae51702cc8bedcd1474bb875099260559463683883.exe was found to be: Known bad.

Malicious Activity Summary

agenttesla keylogger spyware stealer trojan

AgentTesla

Detects executables referencing many email and collaboration clients. Observed in information stealers

Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

Detects executables referencing many file transfer clients. Observed in information stealers

Detect packed .NET executables. Mostly AgentTeslaV4.

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Detects executables referencing Windows vault credential objects. Observed in infostealers

Looks up external IP address via web service

AutoIT Executable

Suspicious use of SetThreadContext

Unsigned PE

Suspicious use of FindShellTrayWindow

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

MITRE ATT&CK

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-12 02:04

Signatures

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-12 02:04

Reported

2024-06-12 02:07

Platform

win7-20240220-en

Max time kernel

120s

Max time network

121s

Command Line

"C:\Users\Admin\AppData\Local\Temp\b97ca324b50c24c05c82b6ae51702cc8bedcd1474bb875099260559463683883.exe"

Signatures

AgentTesla

keylogger trojan stealer spyware agenttesla

Detect packed .NET executables. Mostly AgentTeslaV4.

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects executables referencing Windows vault credential objects. Observed in infostealers

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects executables referencing many email and collaboration clients. Observed in information stealers

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects executables referencing many file transfer clients. Observed in information stealers

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A api.ipify.org N/A N/A
N/A api.ipify.org N/A N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1660 set thread context of 1984 N/A C:\Users\Admin\AppData\Local\Temp\b97ca324b50c24c05c82b6ae51702cc8bedcd1474bb875099260559463683883.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\b97ca324b50c24c05c82b6ae51702cc8bedcd1474bb875099260559463683883.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1660 wrote to memory of 1984 N/A C:\Users\Admin\AppData\Local\Temp\b97ca324b50c24c05c82b6ae51702cc8bedcd1474bb875099260559463683883.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1660 wrote to memory of 1984 N/A C:\Users\Admin\AppData\Local\Temp\b97ca324b50c24c05c82b6ae51702cc8bedcd1474bb875099260559463683883.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1660 wrote to memory of 1984 N/A C:\Users\Admin\AppData\Local\Temp\b97ca324b50c24c05c82b6ae51702cc8bedcd1474bb875099260559463683883.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1660 wrote to memory of 1984 N/A C:\Users\Admin\AppData\Local\Temp\b97ca324b50c24c05c82b6ae51702cc8bedcd1474bb875099260559463683883.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1660 wrote to memory of 1984 N/A C:\Users\Admin\AppData\Local\Temp\b97ca324b50c24c05c82b6ae51702cc8bedcd1474bb875099260559463683883.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1660 wrote to memory of 1984 N/A C:\Users\Admin\AppData\Local\Temp\b97ca324b50c24c05c82b6ae51702cc8bedcd1474bb875099260559463683883.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1660 wrote to memory of 1984 N/A C:\Users\Admin\AppData\Local\Temp\b97ca324b50c24c05c82b6ae51702cc8bedcd1474bb875099260559463683883.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1660 wrote to memory of 1984 N/A C:\Users\Admin\AppData\Local\Temp\b97ca324b50c24c05c82b6ae51702cc8bedcd1474bb875099260559463683883.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Processes

C:\Users\Admin\AppData\Local\Temp\b97ca324b50c24c05c82b6ae51702cc8bedcd1474bb875099260559463683883.exe

"C:\Users\Admin\AppData\Local\Temp\b97ca324b50c24c05c82b6ae51702cc8bedcd1474bb875099260559463683883.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

"C:\Users\Admin\AppData\Local\Temp\b97ca324b50c24c05c82b6ae51702cc8bedcd1474bb875099260559463683883.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 api.ipify.org udp
US 104.26.13.205:443 api.ipify.org tcp

Files

memory/1660-10-0x0000000000160000-0x0000000000164000-memory.dmp

memory/1984-11-0x0000000000400000-0x0000000000446000-memory.dmp

memory/1984-13-0x0000000000400000-0x0000000000446000-memory.dmp

memory/1984-14-0x0000000000400000-0x0000000000446000-memory.dmp

memory/1984-15-0x000000007403E000-0x000000007403F000-memory.dmp

memory/1984-16-0x0000000000340000-0x0000000000394000-memory.dmp

memory/1984-17-0x0000000000530000-0x0000000000582000-memory.dmp

memory/1984-18-0x0000000074030000-0x000000007471E000-memory.dmp

memory/1984-76-0x0000000000530000-0x000000000057D000-memory.dmp

memory/1984-116-0x0000000074030000-0x000000007471E000-memory.dmp

memory/1984-201-0x0000000074030000-0x000000007471E000-memory.dmp

memory/1984-78-0x0000000000530000-0x000000000057D000-memory.dmp

memory/1984-74-0x0000000000530000-0x000000000057D000-memory.dmp

memory/1984-72-0x0000000000530000-0x000000000057D000-memory.dmp

memory/1984-70-0x0000000000530000-0x000000000057D000-memory.dmp

memory/1984-68-0x0000000000530000-0x000000000057D000-memory.dmp

memory/1984-66-0x0000000000530000-0x000000000057D000-memory.dmp

memory/1984-64-0x0000000000530000-0x000000000057D000-memory.dmp

memory/1984-62-0x0000000000530000-0x000000000057D000-memory.dmp

memory/1984-58-0x0000000000530000-0x000000000057D000-memory.dmp

memory/1984-56-0x0000000000530000-0x000000000057D000-memory.dmp

memory/1984-54-0x0000000000530000-0x000000000057D000-memory.dmp

memory/1984-52-0x0000000000530000-0x000000000057D000-memory.dmp

memory/1984-50-0x0000000000530000-0x000000000057D000-memory.dmp

memory/1984-46-0x0000000000530000-0x000000000057D000-memory.dmp

memory/1984-44-0x0000000000530000-0x000000000057D000-memory.dmp

memory/1984-42-0x0000000000530000-0x000000000057D000-memory.dmp

memory/1984-40-0x0000000000530000-0x000000000057D000-memory.dmp

memory/1984-38-0x0000000000530000-0x000000000057D000-memory.dmp

memory/1984-36-0x0000000000530000-0x000000000057D000-memory.dmp

memory/1984-34-0x0000000000530000-0x000000000057D000-memory.dmp

memory/1984-32-0x0000000000530000-0x000000000057D000-memory.dmp

memory/1984-30-0x0000000000530000-0x000000000057D000-memory.dmp

memory/1984-28-0x0000000000530000-0x000000000057D000-memory.dmp

memory/1984-26-0x0000000000530000-0x000000000057D000-memory.dmp

memory/1984-24-0x0000000000530000-0x000000000057D000-memory.dmp

memory/1984-22-0x0000000000530000-0x000000000057D000-memory.dmp

memory/1984-20-0x0000000000530000-0x000000000057D000-memory.dmp

memory/1984-19-0x0000000000530000-0x000000000057D000-memory.dmp

memory/1984-60-0x0000000000530000-0x000000000057D000-memory.dmp

memory/1984-48-0x0000000000530000-0x000000000057D000-memory.dmp

memory/1984-1051-0x0000000074030000-0x000000007471E000-memory.dmp

memory/1984-1052-0x000000007403E000-0x000000007403F000-memory.dmp

memory/1984-1053-0x0000000074030000-0x000000007471E000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-12 02:04

Reported

2024-06-12 02:07

Platform

win10v2004-20240508-en

Max time kernel

143s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\b97ca324b50c24c05c82b6ae51702cc8bedcd1474bb875099260559463683883.exe"

Signatures

AgentTesla

keylogger trojan stealer spyware agenttesla

Detect packed .NET executables. Mostly AgentTeslaV4.

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects executables referencing Windows vault credential objects. Observed in infostealers

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects executables referencing many email and collaboration clients. Observed in information stealers

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects executables referencing many file transfer clients. Observed in information stealers

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A api.ipify.org N/A N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1712 set thread context of 1272 N/A C:\Users\Admin\AppData\Local\Temp\b97ca324b50c24c05c82b6ae51702cc8bedcd1474bb875099260559463683883.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2800 wrote to memory of 924 N/A C:\Users\Admin\AppData\Local\Temp\b97ca324b50c24c05c82b6ae51702cc8bedcd1474bb875099260559463683883.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 2800 wrote to memory of 924 N/A C:\Users\Admin\AppData\Local\Temp\b97ca324b50c24c05c82b6ae51702cc8bedcd1474bb875099260559463683883.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 2800 wrote to memory of 924 N/A C:\Users\Admin\AppData\Local\Temp\b97ca324b50c24c05c82b6ae51702cc8bedcd1474bb875099260559463683883.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 2800 wrote to memory of 2368 N/A C:\Users\Admin\AppData\Local\Temp\b97ca324b50c24c05c82b6ae51702cc8bedcd1474bb875099260559463683883.exe C:\Users\Admin\AppData\Local\Temp\b97ca324b50c24c05c82b6ae51702cc8bedcd1474bb875099260559463683883.exe
PID 2800 wrote to memory of 2368 N/A C:\Users\Admin\AppData\Local\Temp\b97ca324b50c24c05c82b6ae51702cc8bedcd1474bb875099260559463683883.exe C:\Users\Admin\AppData\Local\Temp\b97ca324b50c24c05c82b6ae51702cc8bedcd1474bb875099260559463683883.exe
PID 2800 wrote to memory of 2368 N/A C:\Users\Admin\AppData\Local\Temp\b97ca324b50c24c05c82b6ae51702cc8bedcd1474bb875099260559463683883.exe C:\Users\Admin\AppData\Local\Temp\b97ca324b50c24c05c82b6ae51702cc8bedcd1474bb875099260559463683883.exe
PID 2368 wrote to memory of 1576 N/A C:\Users\Admin\AppData\Local\Temp\b97ca324b50c24c05c82b6ae51702cc8bedcd1474bb875099260559463683883.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 2368 wrote to memory of 1576 N/A C:\Users\Admin\AppData\Local\Temp\b97ca324b50c24c05c82b6ae51702cc8bedcd1474bb875099260559463683883.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 2368 wrote to memory of 1576 N/A C:\Users\Admin\AppData\Local\Temp\b97ca324b50c24c05c82b6ae51702cc8bedcd1474bb875099260559463683883.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 2368 wrote to memory of 1712 N/A C:\Users\Admin\AppData\Local\Temp\b97ca324b50c24c05c82b6ae51702cc8bedcd1474bb875099260559463683883.exe C:\Users\Admin\AppData\Local\Temp\b97ca324b50c24c05c82b6ae51702cc8bedcd1474bb875099260559463683883.exe
PID 2368 wrote to memory of 1712 N/A C:\Users\Admin\AppData\Local\Temp\b97ca324b50c24c05c82b6ae51702cc8bedcd1474bb875099260559463683883.exe C:\Users\Admin\AppData\Local\Temp\b97ca324b50c24c05c82b6ae51702cc8bedcd1474bb875099260559463683883.exe
PID 2368 wrote to memory of 1712 N/A C:\Users\Admin\AppData\Local\Temp\b97ca324b50c24c05c82b6ae51702cc8bedcd1474bb875099260559463683883.exe C:\Users\Admin\AppData\Local\Temp\b97ca324b50c24c05c82b6ae51702cc8bedcd1474bb875099260559463683883.exe
PID 1712 wrote to memory of 1272 N/A C:\Users\Admin\AppData\Local\Temp\b97ca324b50c24c05c82b6ae51702cc8bedcd1474bb875099260559463683883.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1712 wrote to memory of 1272 N/A C:\Users\Admin\AppData\Local\Temp\b97ca324b50c24c05c82b6ae51702cc8bedcd1474bb875099260559463683883.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1712 wrote to memory of 1272 N/A C:\Users\Admin\AppData\Local\Temp\b97ca324b50c24c05c82b6ae51702cc8bedcd1474bb875099260559463683883.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1712 wrote to memory of 1272 N/A C:\Users\Admin\AppData\Local\Temp\b97ca324b50c24c05c82b6ae51702cc8bedcd1474bb875099260559463683883.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Processes

C:\Users\Admin\AppData\Local\Temp\b97ca324b50c24c05c82b6ae51702cc8bedcd1474bb875099260559463683883.exe

"C:\Users\Admin\AppData\Local\Temp\b97ca324b50c24c05c82b6ae51702cc8bedcd1474bb875099260559463683883.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

"C:\Users\Admin\AppData\Local\Temp\b97ca324b50c24c05c82b6ae51702cc8bedcd1474bb875099260559463683883.exe"

C:\Users\Admin\AppData\Local\Temp\b97ca324b50c24c05c82b6ae51702cc8bedcd1474bb875099260559463683883.exe

"C:\Users\Admin\AppData\Local\Temp\b97ca324b50c24c05c82b6ae51702cc8bedcd1474bb875099260559463683883.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

"C:\Users\Admin\AppData\Local\Temp\b97ca324b50c24c05c82b6ae51702cc8bedcd1474bb875099260559463683883.exe"

C:\Users\Admin\AppData\Local\Temp\b97ca324b50c24c05c82b6ae51702cc8bedcd1474bb875099260559463683883.exe

"C:\Users\Admin\AppData\Local\Temp\b97ca324b50c24c05c82b6ae51702cc8bedcd1474bb875099260559463683883.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

"C:\Users\Admin\AppData\Local\Temp\b97ca324b50c24c05c82b6ae51702cc8bedcd1474bb875099260559463683883.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3756,i,9746875443948590908,1444894342962555245,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 api.ipify.org udp

Files

memory/2800-10-0x00000000010B0000-0x00000000010B4000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\prophetesses

MD5 2fd14cb64c85288ce300a01aa0206b37
SHA1 add171fddcd001c709dc745bf3cd3b9ed4aa254b
SHA256 b8a3e5188aa61b09556215649a89210e9cd48aa0ca8b893a4c299d721be4147b
SHA512 5072663b1f0c2dee814050cf7682a58fc0184570c56ddb746d98bf0cd04dfd2cfd1786b6349676b94cd07f665738f340575baccfcbac0db7882663b7f5f0551f

C:\Users\Admin\AppData\Local\Temp\Melber

MD5 cbef02b13616b971d9ee3a12cfb806b8
SHA1 57f755b94add6c0d30b8ead691eae92839133609
SHA256 d2f5e3c76c00df75d797415396979d4acaaddc51c26b685036f6bc33d3baa84f
SHA512 7e8633ce85d9a0c93a998b5a43ff37b6bddb87d2eaaa7db2820f3e24879882c21b39f2581fa951375e803ae53cd172c2b8409f61f5d8e03942741c33a0987b9c

C:\Users\Admin\AppData\Local\Temp\aut693.tmp

MD5 1f68ab1a913155475090c1b6920b2100
SHA1 a5f5ee6767e46d2a14f04fc56c0609ae7f045e46
SHA256 895be284a7a2fd435ef1aad4428496b0a44d7ec75130f3c9fd2aa72b501543e4
SHA512 614b6ddf6edfb2ae18caa8eba1e9d9515436d88ae577108b3c14571f27708100b258f25ee73f3b782082e32d5e5a0f4dfa1f8b52b3c666f29b5884265483d088

C:\Users\Admin\AppData\Local\Temp\aut6A3.tmp

MD5 32b0677668558a39f86bbb428d200f31
SHA1 e700c24e6e5854d552e2a3b8fca1ecf6f5d68372
SHA256 2227e8b902d06540892f364fb943dc40f1e5e0a12c41a9b5e4925bf0f2e0d0f9
SHA512 72586a6a2da9429b99ca8d2ae83fa973f4c80a4ab2836ab6120f47637584d6131d619898cf1b3faa041bda5acd420d895270b49e7639c9c6a0b1379b9283d518

memory/1272-35-0x0000000000400000-0x0000000000446000-memory.dmp

memory/1272-37-0x0000000000400000-0x0000000000446000-memory.dmp

memory/1272-38-0x0000000000400000-0x0000000000446000-memory.dmp

memory/1272-36-0x0000000000400000-0x0000000000446000-memory.dmp

memory/1272-39-0x0000000005560000-0x00000000055B4000-memory.dmp

memory/1272-40-0x0000000005BA0000-0x0000000006144000-memory.dmp

memory/1272-41-0x0000000005630000-0x0000000005682000-memory.dmp

memory/1272-53-0x0000000005630000-0x000000000567D000-memory.dmp

memory/1272-99-0x0000000005630000-0x000000000567D000-memory.dmp

memory/1272-97-0x0000000005630000-0x000000000567D000-memory.dmp

memory/1272-93-0x0000000005630000-0x000000000567D000-memory.dmp

memory/1272-91-0x0000000005630000-0x000000000567D000-memory.dmp

memory/1272-89-0x0000000005630000-0x000000000567D000-memory.dmp

memory/1272-87-0x0000000005630000-0x000000000567D000-memory.dmp

memory/1272-85-0x0000000005630000-0x000000000567D000-memory.dmp

memory/1272-83-0x0000000005630000-0x000000000567D000-memory.dmp

memory/1272-79-0x0000000005630000-0x000000000567D000-memory.dmp

memory/1272-77-0x0000000005630000-0x000000000567D000-memory.dmp

memory/1272-75-0x0000000005630000-0x000000000567D000-memory.dmp

memory/1272-73-0x0000000005630000-0x000000000567D000-memory.dmp

memory/1272-71-0x0000000005630000-0x000000000567D000-memory.dmp

memory/1272-69-0x0000000005630000-0x000000000567D000-memory.dmp

memory/1272-67-0x0000000005630000-0x000000000567D000-memory.dmp

memory/1272-65-0x0000000005630000-0x000000000567D000-memory.dmp

memory/1272-63-0x0000000005630000-0x000000000567D000-memory.dmp

memory/1272-61-0x0000000005630000-0x000000000567D000-memory.dmp

memory/1272-59-0x0000000005630000-0x000000000567D000-memory.dmp

memory/1272-57-0x0000000005630000-0x000000000567D000-memory.dmp

memory/1272-55-0x0000000005630000-0x000000000567D000-memory.dmp

memory/1272-51-0x0000000005630000-0x000000000567D000-memory.dmp

memory/1272-49-0x0000000005630000-0x000000000567D000-memory.dmp

memory/1272-47-0x0000000005630000-0x000000000567D000-memory.dmp

memory/1272-101-0x0000000005630000-0x000000000567D000-memory.dmp

memory/1272-95-0x0000000005630000-0x000000000567D000-memory.dmp

memory/1272-45-0x0000000005630000-0x000000000567D000-memory.dmp

memory/1272-81-0x0000000005630000-0x000000000567D000-memory.dmp

memory/1272-43-0x0000000005630000-0x000000000567D000-memory.dmp

memory/1272-42-0x0000000005630000-0x000000000567D000-memory.dmp

memory/1272-1072-0x0000000005810000-0x0000000005876000-memory.dmp

memory/1272-1073-0x0000000006DD0000-0x0000000006E20000-memory.dmp

memory/1272-1074-0x0000000006EC0000-0x0000000006F52000-memory.dmp

memory/1272-1075-0x0000000006E30000-0x0000000006E3A000-memory.dmp

memory/1272-1076-0x0000000000400000-0x0000000000446000-memory.dmp