Analysis
- max time kernel
145s - max time network
53s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
13/06/2024, 01:54
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
af939cc96af0cc8c52e3fe8e3ea942a7421eeb412ee1c9d7bc26d82dc42190f7.exe
Resource
win7-20240508-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
af939cc96af0cc8c52e3fe8e3ea942a7421eeb412ee1c9d7bc26d82dc42190f7.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
14 signatures
150 seconds
General
- Target af939cc96af0cc8c52e3fe8e3ea942a7421eeb412ee1c9d7bc26d82dc42190f7.exe
- Size 1.2MB
- Sample240613-cbhzxstepp
- SHA256 af939cc96af0cc8c52e3fe8e3ea942a7421eeb412ee1c9d7bc26d82dc42190f7
- MD5 3969f79db5c214cefc7852a1491da1c8
- SHA1 5d036196f60a7a204d72bd075dc1ece935c36cb6
- SHA512 d2e2dcfef8b90c757af03a09fd4a28f1431cc8d590c439015e8487c338b9c7ed9a93fb7367189b7bf05d35616ad4470dd9d9be8cf29bf1d3920aa669e3eae644
- SSDEEP 24576:mqDEvCTbMWu7rQYlBQcBiT6rprG8aUvy6nrWo4:mTvC/MTQYxsWR7aUvy6S
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Detect packed .NET executables. Mostly AgentTeslaV4. 33 IoCs
resource yara_rule behavioral2/memory/5048-18-0x0000000005750000-0x00000000057A6000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/5048-22-0x0000000005830000-0x0000000005884000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/5048-29-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/5048-27-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/5048-25-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/5048-81-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/5048-83-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/5048-79-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/5048-77-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/5048-75-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/5048-74-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/5048-69-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/5048-67-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/5048-65-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/5048-63-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/5048-61-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/5048-57-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/5048-53-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/5048-49-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/5048-47-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/5048-45-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/5048-43-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/5048-42-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/5048-39-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/5048-35-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/5048-71-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/5048-59-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/5048-55-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/5048-51-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/5048-37-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/5048-33-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/5048-31-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/5048-24-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_EXE_Packed_GEN01 - Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 33 IoCs
resource yara_rule behavioral2/memory/5048-18-0x0000000005750000-0x00000000057A6000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/5048-22-0x0000000005830000-0x0000000005884000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/5048-29-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/5048-27-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/5048-25-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/5048-81-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/5048-83-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/5048-79-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/5048-77-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/5048-75-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/5048-74-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/5048-69-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/5048-67-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/5048-65-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/5048-63-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/5048-61-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/5048-57-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/5048-53-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/5048-49-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/5048-47-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/5048-45-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/5048-43-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/5048-42-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/5048-39-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/5048-35-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/5048-71-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/5048-59-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/5048-55-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/5048-51-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/5048-37-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/5048-33-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/5048-31-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/5048-24-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers - Detects executables referencing Windows vault credential objects. Observed in infostealers 33 IoCs
resource yara_rule behavioral2/memory/5048-18-0x0000000005750000-0x00000000057A6000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/5048-22-0x0000000005830000-0x0000000005884000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/5048-29-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/5048-27-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/5048-25-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/5048-81-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/5048-83-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/5048-79-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/5048-77-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/5048-75-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/5048-74-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/5048-69-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/5048-67-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/5048-65-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/5048-63-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/5048-61-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/5048-57-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/5048-53-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/5048-49-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/5048-47-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/5048-45-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/5048-43-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/5048-42-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/5048-39-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/5048-35-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/5048-71-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/5048-59-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/5048-55-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/5048-51-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/5048-37-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/5048-33-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/5048-31-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/5048-24-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID - Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers 33 IoCs
resource yara_rule behavioral2/memory/5048-18-0x0000000005750000-0x00000000057A6000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/5048-22-0x0000000005830000-0x0000000005884000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/5048-29-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/5048-27-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/5048-25-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/5048-81-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/5048-83-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/5048-79-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/5048-77-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/5048-75-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/5048-74-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/5048-69-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/5048-67-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/5048-65-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/5048-63-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/5048-61-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/5048-57-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/5048-53-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/5048-49-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/5048-47-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/5048-45-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/5048-43-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/5048-42-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/5048-39-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/5048-35-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/5048-71-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/5048-59-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/5048-55-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/5048-51-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/5048-37-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/5048-33-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/5048-31-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/5048-24-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store - Detects executables referencing many email and collaboration clients. Observed in information stealers 33 IoCs
resource yara_rule behavioral2/memory/5048-18-0x0000000005750000-0x00000000057A6000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/5048-22-0x0000000005830000-0x0000000005884000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/5048-29-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/5048-27-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/5048-25-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/5048-81-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/5048-83-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/5048-79-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/5048-77-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/5048-75-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/5048-74-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/5048-69-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/5048-67-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/5048-65-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/5048-63-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/5048-61-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/5048-57-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/5048-53-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/5048-49-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/5048-47-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/5048-45-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/5048-43-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/5048-42-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/5048-39-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/5048-35-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/5048-71-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/5048-59-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/5048-55-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/5048-51-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/5048-37-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/5048-33-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/5048-31-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/5048-24-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients - Detects executables referencing many file transfer clients. Observed in information stealers 33 IoCs
resource yara_rule behavioral2/memory/5048-18-0x0000000005750000-0x00000000057A6000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/5048-22-0x0000000005830000-0x0000000005884000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/5048-29-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/5048-27-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/5048-25-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/5048-81-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/5048-83-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/5048-79-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/5048-77-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/5048-75-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/5048-74-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/5048-69-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/5048-67-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/5048-65-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/5048-63-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/5048-61-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/5048-57-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/5048-53-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/5048-49-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/5048-47-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/5048-45-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/5048-43-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/5048-42-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/5048-39-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/5048-35-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/5048-71-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/5048-59-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/5048-55-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/5048-51-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/5048-37-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/5048-33-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/5048-31-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/5048-24-0x0000000005830000-0x000000000587E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fMNDB = "C:\\Users\\Admin\\AppData\\Roaming\\fMNDB\\fMNDB.exe" RegSvcs.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 5044 set thread context of 5048 5044 af939cc96af0cc8c52e3fe8e3ea942a7421eeb412ee1c9d7bc26d82dc42190f7.exe 85 - Program crash 1 IoCs
pid pid_target Process procid_target 3560 5044 WerFault.exe 81 - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 5048 RegSvcs.exe 5048 RegSvcs.exe - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 5044 af939cc96af0cc8c52e3fe8e3ea942a7421eeb412ee1c9d7bc26d82dc42190f7.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 5048 RegSvcs.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 5044 wrote to memory of 5048 5044 af939cc96af0cc8c52e3fe8e3ea942a7421eeb412ee1c9d7bc26d82dc42190f7.exe 85 PID 5044 wrote to memory of 5048 5044 af939cc96af0cc8c52e3fe8e3ea942a7421eeb412ee1c9d7bc26d82dc42190f7.exe 85 PID 5044 wrote to memory of 5048 5044 af939cc96af0cc8c52e3fe8e3ea942a7421eeb412ee1c9d7bc26d82dc42190f7.exe 85 PID 5044 wrote to memory of 5048 5044 af939cc96af0cc8c52e3fe8e3ea942a7421eeb412ee1c9d7bc26d82dc42190f7.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\af939cc96af0cc8c52e3fe8e3ea942a7421eeb412ee1c9d7bc26d82dc42190f7.exe"C:\Users\Admin\AppData\Local\Temp\af939cc96af0cc8c52e3fe8e3ea942a7421eeb412ee1c9d7bc26d82dc42190f7.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\af939cc96af0cc8c52e3fe8e3ea942a7421eeb412ee1c9d7bc26d82dc42190f7.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5048
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5044 -s 6002⤵
- Program crash
PID:3560
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5044 -ip 50441⤵PID:1396
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\aut41DB.tmp
- Size 263KB
- SHA256 0fe1811cdd482215f8c5aa282f227612968d196f16ec43065982979177b040ae
- MD5 35c84fdc36263de93e10395d6b3f817b
- SHA1 c0b2a0b5901f2d83c07d4a758854fd0aa12db61b
- SHA512 a1514d814e97abf69488acd2bcfa642a2e5f8866ca6afd3ddcb9cd3ecd52db03f8b7f935b59991cee5dba95d9698efe9c749b4901df8bffa52a3fd63c91d48ca
- SSDEEP 6144:QeD7PSYIq2a2tvedeMc4RxOpP06F38HgGhlNcrRCXJ0tHImftum:NWlq2a2tvOVRxJ6FMHgeorEQImfUm
- MD5 SHA1 SHA512 SSDEEP