Analysis
-
max time kernel
118s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
13/06/2024, 01:29
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
8e85642be9336d213c4656c277dee5d9ee751ea822f33becb7c310506f058073.exe
Resource
win7-20240508-en
windows7-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
8e85642be9336d213c4656c277dee5d9ee751ea822f33becb7c310506f058073.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
15 signatures
150 seconds
General
-
Target
8e85642be9336d213c4656c277dee5d9ee751ea822f33becb7c310506f058073.exe
-
Size
1.2MB
-
MD5
359d3e96ff4d7d9134950f306a2df9db
-
SHA1
022d3dbd94f36564f5bfc9da8846c6db3cc3c096
-
SHA256
8e85642be9336d213c4656c277dee5d9ee751ea822f33becb7c310506f058073
-
SHA512
c12c770b40f1287ec215a1a6955efe2f09bcbd53e57f061f85af9e8bf5b87f4fc113508dd3a3334f8e22bbc45a0bc2b02b5499cb6f44f633f0ffaaaec671e00e
-
SSDEEP
24576:lAHnh+eWsN3skA4RV1Hom2KXMmHa8dIkziSlhSgQkY5:Uh+ZkldoPK8Ya8dIkPSd
Score
10/10
Malware Config
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Detect packed .NET executables. Mostly AgentTeslaV4. 33 IoCs
resource yara_rule behavioral1/memory/2492-16-0x0000000000450000-0x00000000004A4000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2492-17-0x0000000000B10000-0x0000000000B62000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2492-21-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2492-20-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2492-29-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2492-27-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2492-25-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2492-23-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2492-37-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2492-79-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2492-77-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2492-75-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2492-73-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2492-71-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2492-69-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2492-65-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2492-63-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2492-61-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2492-59-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2492-57-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2492-55-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2492-53-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2492-51-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2492-49-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2492-47-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2492-45-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2492-43-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2492-41-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2492-40-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2492-35-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2492-33-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2492-31-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2492-67-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_EXE_Packed_GEN01 -
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 33 IoCs
resource yara_rule behavioral1/memory/2492-16-0x0000000000450000-0x00000000004A4000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2492-17-0x0000000000B10000-0x0000000000B62000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2492-21-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2492-20-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2492-29-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2492-27-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2492-25-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2492-23-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2492-37-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2492-79-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2492-77-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2492-75-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2492-73-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2492-71-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2492-69-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2492-65-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2492-63-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2492-61-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2492-59-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2492-57-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2492-55-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2492-53-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2492-51-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2492-49-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2492-47-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2492-45-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2492-43-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2492-41-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2492-40-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2492-35-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2492-33-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2492-31-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2492-67-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers -
Detects executables referencing Windows vault credential objects. Observed in infostealers 33 IoCs
resource yara_rule behavioral1/memory/2492-16-0x0000000000450000-0x00000000004A4000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2492-17-0x0000000000B10000-0x0000000000B62000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2492-21-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2492-20-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2492-29-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2492-27-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2492-25-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2492-23-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2492-37-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2492-79-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2492-77-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2492-75-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2492-73-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2492-71-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2492-69-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2492-65-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2492-63-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2492-61-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2492-59-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2492-57-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2492-55-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2492-53-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2492-51-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2492-49-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2492-47-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2492-45-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2492-43-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2492-41-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2492-40-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2492-35-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2492-33-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2492-31-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2492-67-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID -
Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers 33 IoCs
resource yara_rule behavioral1/memory/2492-16-0x0000000000450000-0x00000000004A4000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2492-17-0x0000000000B10000-0x0000000000B62000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2492-21-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2492-20-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2492-29-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2492-27-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2492-25-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2492-23-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2492-37-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2492-79-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2492-77-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2492-75-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2492-73-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2492-71-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2492-69-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2492-65-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2492-63-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2492-61-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2492-59-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2492-57-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2492-55-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2492-53-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2492-51-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2492-49-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2492-47-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2492-45-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2492-43-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2492-41-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2492-40-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2492-35-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2492-33-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2492-31-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2492-67-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store -
Detects executables referencing many email and collaboration clients. Observed in information stealers 33 IoCs
resource yara_rule behavioral1/memory/2492-16-0x0000000000450000-0x00000000004A4000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2492-17-0x0000000000B10000-0x0000000000B62000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2492-21-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2492-20-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2492-29-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2492-27-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2492-25-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2492-23-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2492-37-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2492-79-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2492-77-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2492-75-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2492-73-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2492-71-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2492-69-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2492-65-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2492-63-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2492-61-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2492-59-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2492-57-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2492-55-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2492-53-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2492-51-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2492-49-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2492-47-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2492-45-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2492-43-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2492-41-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2492-40-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2492-35-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2492-33-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2492-31-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2492-67-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients -
Detects executables referencing many file transfer clients. Observed in information stealers 33 IoCs
resource yara_rule behavioral1/memory/2492-16-0x0000000000450000-0x00000000004A4000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2492-17-0x0000000000B10000-0x0000000000B62000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2492-21-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2492-20-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2492-29-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2492-27-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2492-25-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2492-23-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2492-37-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2492-79-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2492-77-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2492-75-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2492-73-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2492-71-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2492-69-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2492-65-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2492-63-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2492-61-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2492-59-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2492-57-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2492-55-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2492-53-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2492-51-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2492-49-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2492-47-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2492-45-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2492-43-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2492-41-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2492-40-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2492-35-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2492-33-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2492-31-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2492-67-0x0000000000B10000-0x0000000000B5D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2228 set thread context of 2492 2228 8e85642be9336d213c4656c277dee5d9ee751ea822f33becb7c310506f058073.exe 28 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2492 RegSvcs.exe 2492 RegSvcs.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2228 8e85642be9336d213c4656c277dee5d9ee751ea822f33becb7c310506f058073.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2492 RegSvcs.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2228 8e85642be9336d213c4656c277dee5d9ee751ea822f33becb7c310506f058073.exe 2228 8e85642be9336d213c4656c277dee5d9ee751ea822f33becb7c310506f058073.exe -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 2228 8e85642be9336d213c4656c277dee5d9ee751ea822f33becb7c310506f058073.exe 2228 8e85642be9336d213c4656c277dee5d9ee751ea822f33becb7c310506f058073.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2228 wrote to memory of 2492 2228 8e85642be9336d213c4656c277dee5d9ee751ea822f33becb7c310506f058073.exe 28 PID 2228 wrote to memory of 2492 2228 8e85642be9336d213c4656c277dee5d9ee751ea822f33becb7c310506f058073.exe 28 PID 2228 wrote to memory of 2492 2228 8e85642be9336d213c4656c277dee5d9ee751ea822f33becb7c310506f058073.exe 28 PID 2228 wrote to memory of 2492 2228 8e85642be9336d213c4656c277dee5d9ee751ea822f33becb7c310506f058073.exe 28 PID 2228 wrote to memory of 2492 2228 8e85642be9336d213c4656c277dee5d9ee751ea822f33becb7c310506f058073.exe 28 PID 2228 wrote to memory of 2492 2228 8e85642be9336d213c4656c277dee5d9ee751ea822f33becb7c310506f058073.exe 28 PID 2228 wrote to memory of 2492 2228 8e85642be9336d213c4656c277dee5d9ee751ea822f33becb7c310506f058073.exe 28 PID 2228 wrote to memory of 2492 2228 8e85642be9336d213c4656c277dee5d9ee751ea822f33becb7c310506f058073.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\8e85642be9336d213c4656c277dee5d9ee751ea822f33becb7c310506f058073.exe"C:\Users\Admin\AppData\Local\Temp\8e85642be9336d213c4656c277dee5d9ee751ea822f33becb7c310506f058073.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\8e85642be9336d213c4656c277dee5d9ee751ea822f33becb7c310506f058073.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2492
-