Analysis
- max time kernel
117s - max time network
118s - platform
windows7_x64 - resource
win7-20240508-en - resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system - submitted
13/06/2024, 01:54
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
af939cc96af0cc8c52e3fe8e3ea942a7421eeb412ee1c9d7bc26d82dc42190f7.exe
Resource
win7-20240508-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
af939cc96af0cc8c52e3fe8e3ea942a7421eeb412ee1c9d7bc26d82dc42190f7.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
14 signatures
150 seconds
General
- Target af939cc96af0cc8c52e3fe8e3ea942a7421eeb412ee1c9d7bc26d82dc42190f7.exe
- Size 1.2MB
- Sample240613-cbhzxstepp
- SHA256 af939cc96af0cc8c52e3fe8e3ea942a7421eeb412ee1c9d7bc26d82dc42190f7
- MD5 3969f79db5c214cefc7852a1491da1c8
- SHA1 5d036196f60a7a204d72bd075dc1ece935c36cb6
- SHA512 d2e2dcfef8b90c757af03a09fd4a28f1431cc8d590c439015e8487c338b9c7ed9a93fb7367189b7bf05d35616ad4470dd9d9be8cf29bf1d3920aa669e3eae644
- SSDEEP 24576:mqDEvCTbMWu7rQYlBQcBiT6rprG8aUvy6nrWo4:mTvC/MTQYxsWR7aUvy6S
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Detect packed .NET executables. Mostly AgentTeslaV4. 33 IoCs
resource yara_rule behavioral1/memory/1220-17-0x0000000000270000-0x00000000002C6000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/1220-18-0x0000000000470000-0x00000000004C4000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/1220-22-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/1220-48-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/1220-80-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/1220-78-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/1220-76-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/1220-74-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/1220-72-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/1220-70-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/1220-68-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/1220-66-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/1220-64-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/1220-62-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/1220-60-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/1220-58-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/1220-56-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/1220-54-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/1220-52-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/1220-50-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/1220-46-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/1220-42-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/1220-38-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/1220-36-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/1220-32-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/1220-30-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/1220-28-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/1220-26-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/1220-24-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/1220-44-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/1220-40-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/1220-34-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/1220-21-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_EXE_Packed_GEN01 - Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 33 IoCs
resource yara_rule behavioral1/memory/1220-17-0x0000000000270000-0x00000000002C6000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/1220-18-0x0000000000470000-0x00000000004C4000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/1220-22-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/1220-48-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/1220-80-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/1220-78-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/1220-76-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/1220-74-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/1220-72-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/1220-70-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/1220-68-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/1220-66-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/1220-64-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/1220-62-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/1220-60-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/1220-58-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/1220-56-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/1220-54-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/1220-52-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/1220-50-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/1220-46-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/1220-42-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/1220-38-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/1220-36-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/1220-32-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/1220-30-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/1220-28-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/1220-26-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/1220-24-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/1220-44-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/1220-40-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/1220-34-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/1220-21-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers - Detects executables referencing Windows vault credential objects. Observed in infostealers 33 IoCs
resource yara_rule behavioral1/memory/1220-17-0x0000000000270000-0x00000000002C6000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/1220-18-0x0000000000470000-0x00000000004C4000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/1220-22-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/1220-48-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/1220-80-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/1220-78-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/1220-76-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/1220-74-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/1220-72-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/1220-70-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/1220-68-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/1220-66-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/1220-64-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/1220-62-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/1220-60-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/1220-58-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/1220-56-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/1220-54-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/1220-52-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/1220-50-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/1220-46-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/1220-42-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/1220-38-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/1220-36-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/1220-32-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/1220-30-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/1220-28-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/1220-26-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/1220-24-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/1220-44-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/1220-40-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/1220-34-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/1220-21-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID - Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers 33 IoCs
resource yara_rule behavioral1/memory/1220-17-0x0000000000270000-0x00000000002C6000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/1220-18-0x0000000000470000-0x00000000004C4000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/1220-22-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/1220-48-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/1220-80-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/1220-78-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/1220-76-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/1220-74-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/1220-72-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/1220-70-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/1220-68-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/1220-66-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/1220-64-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/1220-62-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/1220-60-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/1220-58-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/1220-56-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/1220-54-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/1220-52-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/1220-50-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/1220-46-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/1220-42-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/1220-38-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/1220-36-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/1220-32-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/1220-30-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/1220-28-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/1220-26-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/1220-24-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/1220-44-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/1220-40-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/1220-34-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/1220-21-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store - Detects executables referencing many email and collaboration clients. Observed in information stealers 33 IoCs
resource yara_rule behavioral1/memory/1220-17-0x0000000000270000-0x00000000002C6000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/1220-18-0x0000000000470000-0x00000000004C4000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/1220-22-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/1220-48-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/1220-80-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/1220-78-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/1220-76-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/1220-74-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/1220-72-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/1220-70-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/1220-68-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/1220-66-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/1220-64-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/1220-62-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/1220-60-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/1220-58-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/1220-56-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/1220-54-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/1220-52-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/1220-50-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/1220-46-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/1220-42-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/1220-38-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/1220-36-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/1220-32-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/1220-30-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/1220-28-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/1220-26-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/1220-24-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/1220-44-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/1220-40-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/1220-34-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/1220-21-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients - Detects executables referencing many file transfer clients. Observed in information stealers 33 IoCs
resource yara_rule behavioral1/memory/1220-17-0x0000000000270000-0x00000000002C6000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/1220-18-0x0000000000470000-0x00000000004C4000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/1220-22-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/1220-48-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/1220-80-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/1220-78-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/1220-76-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/1220-74-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/1220-72-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/1220-70-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/1220-68-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/1220-66-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/1220-64-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/1220-62-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/1220-60-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/1220-58-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/1220-56-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/1220-54-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/1220-52-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/1220-50-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/1220-46-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/1220-42-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/1220-38-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/1220-36-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/1220-32-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/1220-30-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/1220-28-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/1220-26-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/1220-24-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/1220-44-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/1220-40-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/1220-34-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/1220-21-0x0000000000470000-0x00000000004BE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\fMNDB = "C:\\Users\\Admin\\AppData\\Roaming\\fMNDB\\fMNDB.exe" RegSvcs.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2592 set thread context of 1220 2592 af939cc96af0cc8c52e3fe8e3ea942a7421eeb412ee1c9d7bc26d82dc42190f7.exe 28 - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1220 RegSvcs.exe 1220 RegSvcs.exe - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2592 af939cc96af0cc8c52e3fe8e3ea942a7421eeb412ee1c9d7bc26d82dc42190f7.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1220 RegSvcs.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2592 wrote to memory of 1220 2592 af939cc96af0cc8c52e3fe8e3ea942a7421eeb412ee1c9d7bc26d82dc42190f7.exe 28 PID 2592 wrote to memory of 1220 2592 af939cc96af0cc8c52e3fe8e3ea942a7421eeb412ee1c9d7bc26d82dc42190f7.exe 28 PID 2592 wrote to memory of 1220 2592 af939cc96af0cc8c52e3fe8e3ea942a7421eeb412ee1c9d7bc26d82dc42190f7.exe 28 PID 2592 wrote to memory of 1220 2592 af939cc96af0cc8c52e3fe8e3ea942a7421eeb412ee1c9d7bc26d82dc42190f7.exe 28 PID 2592 wrote to memory of 1220 2592 af939cc96af0cc8c52e3fe8e3ea942a7421eeb412ee1c9d7bc26d82dc42190f7.exe 28 PID 2592 wrote to memory of 1220 2592 af939cc96af0cc8c52e3fe8e3ea942a7421eeb412ee1c9d7bc26d82dc42190f7.exe 28 PID 2592 wrote to memory of 1220 2592 af939cc96af0cc8c52e3fe8e3ea942a7421eeb412ee1c9d7bc26d82dc42190f7.exe 28 PID 2592 wrote to memory of 1220 2592 af939cc96af0cc8c52e3fe8e3ea942a7421eeb412ee1c9d7bc26d82dc42190f7.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\af939cc96af0cc8c52e3fe8e3ea942a7421eeb412ee1c9d7bc26d82dc42190f7.exe"C:\Users\Admin\AppData\Local\Temp\af939cc96af0cc8c52e3fe8e3ea942a7421eeb412ee1c9d7bc26d82dc42190f7.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\af939cc96af0cc8c52e3fe8e3ea942a7421eeb412ee1c9d7bc26d82dc42190f7.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1220
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\leucoryx
- Size 263KB
- SHA256 0fe1811cdd482215f8c5aa282f227612968d196f16ec43065982979177b040ae
- MD5 35c84fdc36263de93e10395d6b3f817b
- SHA1 c0b2a0b5901f2d83c07d4a758854fd0aa12db61b
- SHA512 a1514d814e97abf69488acd2bcfa642a2e5f8866ca6afd3ddcb9cd3ecd52db03f8b7f935b59991cee5dba95d9698efe9c749b4901df8bffa52a3fd63c91d48ca
- SSDEEP 6144:QeD7PSYIq2a2tvedeMc4RxOpP06F38HgGhlNcrRCXJ0tHImftum:NWlq2a2tvOVRxJ6FMHgeorEQImfUm
- MD5 SHA1 SHA512 SSDEEP