agenttesla | 5405273431552857b6acb561b5eb6c7706fbc485bb41a34d6a8e189f3a7ee019

Resubmissions

06/08/2024, 00:34

240806-awzr3atdnj 10

06/08/2024, 00:30

240806-ats7hatcrj 10

Analysis

max time kernel
122s
max time network
123s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
06/08/2024, 00:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

cool animated background.exe
Size

178KB
MD5

97ef3efe0044d25c94a7958a75ee552a
SHA1

e8cd4eb7dd0f5f4bcbf3ddab0639241cf1b762d3
SHA256

8d43dd1a54d4ec36b0185cd1b424b4cfd4f8507b41197fc948a34907df2a45dc
SHA512

0d18c855015d1367e32e2128b4fc5750e18f5ea1ec7c667d1c805833eb2a7c9e7c65e1624ead5930f148f0f0b701f3b3ea3ceb4ff210a79c53447fae9444e51e
SSDEEP

3072:leZ1UR9qD7+Bx7+BKh+tG8U6o97+Bqh+tG8U6o97+BZ7+Bn:gFGxh+Y8U6+Hh+Y8U6+e

Score

10^/10

agenttesla discovery keylogger spyware stealer trojan

Malware Config

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla payload 1 IoCs

resource	yara_rule
behavioral3/memory/4764-6-0x00000000056F0000-0x0000000005904000-memory.dmp	family_agenttesla

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
38	pastebin.com
34	pastebin.com
36	pastebin.com
37	pastebin.com

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cool animated background.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	cool animated background.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	cool animated background.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	cool animated background.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2632	firefox.exe
Token: SeDebugPrivilege	2632	firefox.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
2632	firefox.exe
2632	firefox.exe
2632	firefox.exe
2632	firefox.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
2632	firefox.exe
2632	firefox.exe
2632	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2632	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 204 wrote to memory of 2632	204	firefox.exe	75
PID 204 wrote to memory of 2632	204	firefox.exe	75
PID 204 wrote to memory of 2632	204	firefox.exe	75
PID 204 wrote to memory of 2632	204	firefox.exe	75
PID 204 wrote to memory of 2632	204	firefox.exe	75
PID 204 wrote to memory of 2632	204	firefox.exe	75
PID 204 wrote to memory of 2632	204	firefox.exe	75
PID 204 wrote to memory of 2632	204	firefox.exe	75
PID 204 wrote to memory of 2632	204	firefox.exe	75
PID 204 wrote to memory of 2632	204	firefox.exe	75
PID 204 wrote to memory of 2632	204	firefox.exe	75
PID 2632 wrote to memory of 3576	2632	firefox.exe	76
PID 2632 wrote to memory of 3576	2632	firefox.exe	76
PID 2632 wrote to memory of 5060	2632	firefox.exe	77
PID 2632 wrote to memory of 5060	2632	firefox.exe	77
PID 2632 wrote to memory of 5060	2632	firefox.exe	77
PID 2632 wrote to memory of 5060	2632	firefox.exe	77
PID 2632 wrote to memory of 5060	2632	firefox.exe	77
PID 2632 wrote to memory of 5060	2632	firefox.exe	77
PID 2632 wrote to memory of 5060	2632	firefox.exe	77
PID 2632 wrote to memory of 5060	2632	firefox.exe	77
PID 2632 wrote to memory of 5060	2632	firefox.exe	77
PID 2632 wrote to memory of 5060	2632	firefox.exe	77
PID 2632 wrote to memory of 5060	2632	firefox.exe	77
PID 2632 wrote to memory of 5060	2632	firefox.exe	77
PID 2632 wrote to memory of 5060	2632	firefox.exe	77
PID 2632 wrote to memory of 5060	2632	firefox.exe	77
PID 2632 wrote to memory of 5060	2632	firefox.exe	77
PID 2632 wrote to memory of 5060	2632	firefox.exe	77
PID 2632 wrote to memory of 5060	2632	firefox.exe	77
PID 2632 wrote to memory of 5060	2632	firefox.exe	77
PID 2632 wrote to memory of 5060	2632	firefox.exe	77
PID 2632 wrote to memory of 5060	2632	firefox.exe	77
PID 2632 wrote to memory of 5060	2632	firefox.exe	77
PID 2632 wrote to memory of 5060	2632	firefox.exe	77
PID 2632 wrote to memory of 5060	2632	firefox.exe	77
PID 2632 wrote to memory of 5060	2632	firefox.exe	77
PID 2632 wrote to memory of 5060	2632	firefox.exe	77
PID 2632 wrote to memory of 5060	2632	firefox.exe	77
PID 2632 wrote to memory of 5060	2632	firefox.exe	77
PID 2632 wrote to memory of 5060	2632	firefox.exe	77
PID 2632 wrote to memory of 5060	2632	firefox.exe	77
PID 2632 wrote to memory of 5060	2632	firefox.exe	77
PID 2632 wrote to memory of 5060	2632	firefox.exe	77
PID 2632 wrote to memory of 5060	2632	firefox.exe	77
PID 2632 wrote to memory of 5060	2632	firefox.exe	77
PID 2632 wrote to memory of 5060	2632	firefox.exe	77
PID 2632 wrote to memory of 5060	2632	firefox.exe	77
PID 2632 wrote to memory of 5060	2632	firefox.exe	77
PID 2632 wrote to memory of 5060	2632	firefox.exe	77
PID 2632 wrote to memory of 5060	2632	firefox.exe	77
PID 2632 wrote to memory of 5060	2632	firefox.exe	77
PID 2632 wrote to memory of 5060	2632	firefox.exe	77
PID 2632 wrote to memory of 5060	2632	firefox.exe	77
PID 2632 wrote to memory of 5060	2632	firefox.exe	77
PID 2632 wrote to memory of 5060	2632	firefox.exe	77
PID 2632 wrote to memory of 5060	2632	firefox.exe	77
PID 2632 wrote to memory of 5060	2632	firefox.exe	77
PID 2632 wrote to memory of 5060	2632	firefox.exe	77
PID 2632 wrote to memory of 5060	2632	firefox.exe	77
PID 2632 wrote to memory of 5060	2632	firefox.exe	77
PID 2632 wrote to memory of 4276	2632	firefox.exe	78
PID 2632 wrote to memory of 4276	2632	firefox.exe	78
PID 2632 wrote to memory of 4276	2632	firefox.exe	78

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\cool animated background.exe
"C:\Users\Admin\AppData\Local\Temp\cool animated background.exe"
1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
PID:4764

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:204
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2632
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2632.0.90506251\67871339" -parentBuildID 20221007134813 -prefsHandle 1716 -prefMapHandle 1708 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d1951962-1292-4456-ad80-838d0c3c13e3} 2632 "\\.\pipe\gecko-crash-server-pipe.2632" 1796 1d7c3b09c58 gpu
    3⤵
    PID:3576
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2632.1.135890589\1487597949" -parentBuildID 20221007134813 -prefsHandle 2128 -prefMapHandle 2124 -prefsLen 20828 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8fa5e154-7706-4ac7-ac5a-3f0ef1d54751} 2632 "\\.\pipe\gecko-crash-server-pipe.2632" 2148 1d7c28f0158 socket
    3⤵
    PID:5060
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2632.2.387307861\240200788" -childID 1 -isForBrowser -prefsHandle 2688 -prefMapHandle 2852 -prefsLen 20931 -prefMapSize 233444 -jsInitHandle 1284 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {98162dc2-f65d-41cf-b046-d78af6dcc61b} 2632 "\\.\pipe\gecko-crash-server-pipe.2632" 2948 1d7c295e158 tab
    3⤵
    PID:4276
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2632.3.164768761\614551873" -childID 2 -isForBrowser -prefsHandle 3484 -prefMapHandle 3480 -prefsLen 26109 -prefMapSize 233444 -jsInitHandle 1284 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {562e04ff-6079-4427-909c-9dd42a9e608b} 2632 "\\.\pipe\gecko-crash-server-pipe.2632" 3492 1d7b785f558 tab
    3⤵
    PID:1688
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2632.4.1543191148\1059294183" -childID 3 -isForBrowser -prefsHandle 4392 -prefMapHandle 4388 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1284 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a89927fc-f437-4e8d-b901-23ccb92645b7} 2632 "\\.\pipe\gecko-crash-server-pipe.2632" 4336 1d7c8a33e58 tab
    3⤵
    PID:2804
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2632.5.399792286\1570125664" -childID 4 -isForBrowser -prefsHandle 4756 -prefMapHandle 4752 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1284 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c6d5c9ac-398e-443c-8103-6f4709c38fa1} 2632 "\\.\pipe\gecko-crash-server-pipe.2632" 4768 1d7b7869758 tab
    3⤵
    PID:752
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2632.6.1132148330\168480693" -childID 5 -isForBrowser -prefsHandle 4904 -prefMapHandle 4908 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1284 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {dedeebfa-6d19-43cf-8fd3-089888a140aa} 2632 "\\.\pipe\gecko-crash-server-pipe.2632" 4988 1d7c91b7258 tab
    3⤵
    PID:3776
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2632.7.1232901511\1492507517" -childID 6 -isForBrowser -prefsHandle 5004 -prefMapHandle 5104 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1284 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7cadb0a2-0877-4305-b08f-2958c0429490} 2632 "\\.\pipe\gecko-crash-server-pipe.2632" 4768 1d7c91b7e58 tab
    3⤵
    PID:4652
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2632.8.1888851583\396854793" -childID 7 -isForBrowser -prefsHandle 4596 -prefMapHandle 3100 -prefsLen 26503 -prefMapSize 233444 -jsInitHandle 1284 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8c9cd7ea-2a9c-4ba8-87f5-c28923109ef2} 2632 "\\.\pipe\gecko-crash-server-pipe.2632" 2584 1d7c6c7a058 tab
    3⤵
    PID:2576
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2632.9.1828801224\407788826" -parentBuildID 20221007134813 -prefsHandle 5888 -prefMapHandle 5884 -prefsLen 26503 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {02654dc3-73a9-4577-8066-7d6b1485602e} 2632 "\\.\pipe\gecko-crash-server-pipe.2632" 5828 1d7ca972558 rdd
    3⤵
    PID:4140
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2632.10.340174246\1295950133" -childID 8 -isForBrowser -prefsHandle 9908 -prefMapHandle 9912 -prefsLen 26503 -prefMapSize 233444 -jsInitHandle 1284 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b73a9491-3414-475d-94f3-4cbf638f406a} 2632 "\\.\pipe\gecko-crash-server-pipe.2632" 9952 1d7cba66d58 tab
    3⤵
    PID:1800
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2632.11.894416621\1298531865" -childID 9 -isForBrowser -prefsHandle 9904 -prefMapHandle 10024 -prefsLen 26503 -prefMapSize 233444 -jsInitHandle 1284 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b0be01d4-9dfe-4a73-8f9e-042c56f25bb4} 2632 "\\.\pipe\gecko-crash-server-pipe.2632" 9888 1d7cbaf9b58 tab
    3⤵
    PID:2972
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2632.12.1905749493\1587478509" -childID 10 -isForBrowser -prefsHandle 9604 -prefMapHandle 10080 -prefsLen 26503 -prefMapSize 233444 -jsInitHandle 1284 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3dcabbd5-3eb0-4737-b641-52fabe226e1e} 2632 "\\.\pipe\gecko-crash-server-pipe.2632" 9548 1d7cb7ae258 tab
    3⤵
    PID:4204
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2632.13.1615977945\821261042" -childID 11 -isForBrowser -prefsHandle 9568 -prefMapHandle 10024 -prefsLen 26503 -prefMapSize 233444 -jsInitHandle 1284 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {83f575f0-a563-4e9d-8de1-314d7705a0a3} 2632 "\\.\pipe\gecko-crash-server-pipe.2632" 9448 1d7cba67958 tab
    3⤵
    PID:5148
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2632.14.984038912\1760121057" -childID 12 -isForBrowser -prefsHandle 9324 -prefMapHandle 9556 -prefsLen 26503 -prefMapSize 233444 -jsInitHandle 1284 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e384bce7-7de5-4fdf-a49d-638f51120731} 2632 "\\.\pipe\gecko-crash-server-pipe.2632" 9328 1d7cba76258 tab
    3⤵
    PID:5156
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2632.15.893538632\1114004141" -childID 13 -isForBrowser -prefsHandle 8948 -prefMapHandle 8952 -prefsLen 26503 -prefMapSize 233444 -jsInitHandle 1284 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {fa5ea09a-8f9c-42f1-b928-9e4b82497fee} 2632 "\\.\pipe\gecko-crash-server-pipe.2632" 8984 1d7cbd95658 tab
    3⤵
    PID:5744
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2632.16.815413802\560803933" -childID 14 -isForBrowser -prefsHandle 9492 -prefMapHandle 9496 -prefsLen 26503 -prefMapSize 233444 -jsInitHandle 1284 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4ad3e22f-c149-44b4-8bf0-81d29205a82b} 2632 "\\.\pipe\gecko-crash-server-pipe.2632" 9484 1d7cbd96e58 tab
    3⤵
    PID:5752
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2632.17.746126324\527002790" -childID 15 -isForBrowser -prefsHandle 8788 -prefMapHandle 8784 -prefsLen 26503 -prefMapSize 233444 -jsInitHandle 1284 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1304606b-abf0-49fd-9b96-0b57c05fee5e} 2632 "\\.\pipe\gecko-crash-server-pipe.2632" 8796 1d7cbf7b658 tab
    3⤵
    PID:5760
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2632.18.1621521404\395154729" -childID 16 -isForBrowser -prefsHandle 8464 -prefMapHandle 8932 -prefsLen 26768 -prefMapSize 233444 -jsInitHandle 1284 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {66cd34bb-c732-4866-bccf-aa92dd8e8eec} 2632 "\\.\pipe\gecko-crash-server-pipe.2632" 8476 1d7cca62858 tab
    3⤵
    PID:6108
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2632.19.1021944576\1437537900" -childID 17 -isForBrowser -prefsHandle 8252 -prefMapHandle 8256 -prefsLen 26768 -prefMapSize 233444 -jsInitHandle 1284 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {fef24c19-a39e-412b-9974-902e407259e4} 2632 "\\.\pipe\gecko-crash-server-pipe.2632" 8240 1d7ccd9aa58 tab
    3⤵
    PID:6208
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2632.20.1085844784\1319923885" -childID 18 -isForBrowser -prefsHandle 8056 -prefMapHandle 8052 -prefsLen 26768 -prefMapSize 233444 -jsInitHandle 1284 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3cc11d03-5c54-490e-9f15-fac3e6532184} 2632 "\\.\pipe\gecko-crash-server-pipe.2632" 8064 1d7ccd69558 tab
    3⤵
    PID:6380
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2632.21.1210410675\2024900250" -childID 19 -isForBrowser -prefsHandle 7972 -prefMapHandle 7968 -prefsLen 26768 -prefMapSize 233444 -jsInitHandle 1284 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {91b7d565-d17d-471b-9494-59697d3739df} 2632 "\\.\pipe\gecko-crash-server-pipe.2632" 7884 1d7ccd69858 tab
    3⤵
    PID:6392
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2632.22.392307098\2007737091" -childID 20 -isForBrowser -prefsHandle 7728 -prefMapHandle 7724 -prefsLen 26768 -prefMapSize 233444 -jsInitHandle 1284 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3244bada-a44b-4084-8333-aedf9da442f3} 2632 "\\.\pipe\gecko-crash-server-pipe.2632" 7740 1d7ccd68058 tab
    3⤵
    PID:6404
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2632.23.675539072\2056389860" -childID 21 -isForBrowser -prefsHandle 7396 -prefMapHandle 7656 -prefsLen 26768 -prefMapSize 233444 -jsInitHandle 1284 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {482d730e-4096-45bb-a9cf-370663f2d483} 2632 "\\.\pipe\gecko-crash-server-pipe.2632" 7404 1d7cd0a3058 tab
    3⤵
    PID:6592
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2632.24.336900084\42187538" -childID 22 -isForBrowser -prefsHandle 2624 -prefMapHandle 5508 -prefsLen 26768 -prefMapSize 233444 -jsInitHandle 1284 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {cdb0367f-3e6f-4890-9f05-3fed5ebebab0} 2632 "\\.\pipe\gecko-crash-server-pipe.2632" 9964 1d7c5d92258 tab
    3⤵
    PID:6104
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2632.25.1581817013\1675749252" -childID 23 -isForBrowser -prefsHandle 9256 -prefMapHandle 4728 -prefsLen 26768 -prefMapSize 233444 -jsInitHandle 1284 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b0094338-6336-4ec6-a927-a1048ff8276d} 2632 "\\.\pipe\gecko-crash-server-pipe.2632" 2712 1d7ccd99858 tab
    3⤵
    PID:6720
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2632.26.1788620146\119113390" -childID 24 -isForBrowser -prefsHandle 7156 -prefMapHandle 7152 -prefsLen 26768 -prefMapSize 233444 -jsInitHandle 1284 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e9051536-26e1-4067-aec0-1838083b7533} 2632 "\\.\pipe\gecko-crash-server-pipe.2632" 8564 1d7cd710b58 tab
    3⤵
    PID:6716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\cache2\doomed\10279

Filesize
7KB

MD5
20746718219b7fcdad4158e9b58f2554

SHA1
1452cb5efe04ca44f72334faf968353a1e564e46

SHA256
363b097215929fb9ada19f9a2dd1d8a4caadc0eefac16072c51bb4d72fa1054b

SHA512
63552548a22877953cc91bb35482bdf69310aa210a60abf536ec63e7de3aa19d83ac07d10a6c6bdfddce4f58b535819beb448b32a96c035520fd1e3b4701b2e7

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\cache2\doomed\17277

Filesize
8KB

MD5
fa9bbcd1b3c3ee5748cff2a973183719

SHA1
2983016037e8961d90ac6abc60984089d48a0a5f

SHA256
36e12b628acc60afa93ca8adf1e139be811744ff0cbf63d9745fd160c124b56e

SHA512
a238da74c9ba3060b31e535313fdcf2d7c550b55c4bd0b59c4947e244d316a2117a052290846dcc250b0ec4f2ee7ce13a098713b1c998c4b6bd8037db044e641

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\cache2\doomed\17579

Filesize
5KB

MD5
c6f1f34559f82a2764a17deba40819fd

SHA1
0874ee02df1b55702b3fdeb5f4fec9e369cb9c3d

SHA256
01eddb467a822b3af91040d3a74d149b6ba9261ff4a54d0d25968afb45bd2671

SHA512
9c146a4bb1b7cad4331c179150cccd7dcac01b8efce5889f824fbb71b76f0daa94a1e2c83c5bd40bd1f8651a372942235ea6583e102e839334098bcaa494c77a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\cache2\doomed\1901

Filesize
6KB

MD5
ccef78d9cf590d93ac620174e6803cf0

SHA1
e05ecd5b6c71a594d5308f6537a46a99e180258e

SHA256
aae5f25f680059682b159b7ef80eb0f41419faf9e60e79b5d923bedf5b87ac74

SHA512
277ea892d0b1f3fc6041083c277d0ba9599baa956173ed724452cbe3e3127534c6c101f89b80998f1f63039a354b4675b12914dc0fe99ad14ac66541040bde32

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\cache2\doomed\20289

Filesize
7KB

MD5
89d71a68f8a3a8c7719b1b9f7ba51d2b

SHA1
a0f0dabee4a98f7b06c4d3bda39f42764fa70fe1

SHA256
2febac7b7faa83ef6cf6df47a160e8f3e60c7d6eb456a72c63175cb3be7f3dc2

SHA512
de288fe0099f16f34fc93d1b5f65d8e03dc12d27fc9268ec802f4089de6507c3ca038250322119a8639c8197f61e85e4f8378bf08492a952ed3eb3fbcbaaddd5

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\cache2\doomed\2149

Filesize
6KB

MD5
6c1c22f95554f621be76fb156d8543e3

SHA1
156f47544f82721e073270e3f38cc9e409814a08

SHA256
f5c7c307445b48eb3495e5212d1d55f6b35309155ee92699e564bfa4b40b7ffd

SHA512
374456e70f04b9a6a31ba16d5d322361fa50a27887ae804c96cbec53264d933b55407909e46e8c75fe243942f11786ca58b08a23a714e74f036bec51db423034

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\cache2\doomed\25019

Filesize
7KB

MD5
976462cd812fdd9d69e5b54360a05654

SHA1
d6de0515a94c2eba97e4711c9bb31b9a4db42681

SHA256
0251b89fc1ae32e393279f0026cc1a2e12c0267ad0e7e21b8170fc8c12a4a56a

SHA512
664c55fd518880108a092c75c9489a168872b8d9f57eaba8aed4610a4a0b2908f3e6f1d558b99ba2297e0cc0ef49df84d8949393d3fd64e139fb1b78610ba803

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\cache2\doomed\28610

Filesize
7KB

MD5
6f341eca574279f0bf609e3e2ba5bfae

SHA1
cd40f765159781aee3a95d8aa05740b049430f68

SHA256
4a90d57bdd15458ac2d4f8a3285ba95ba3b1dde5a1d0179ee382d2bc7c6fa32b

SHA512
336324285fb37c93b8ea5d13541b62af714ce2d65c835c5b2da79c844e5aa9138897cc1bb8784174b35841ca72aa338b702b6c0eb39ca4c379fc9369b69e6ee0

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\cache2\doomed\29276

Filesize
7KB

MD5
e68418e5fa63374be86017af77d67c02

SHA1
58bf1194482ef0295a2b6ce0ce4f667a66b30c0c

SHA256
99dcfa7039354281118bd6f32055abcb1bfb54708c4ed03c5e38eb32c9c2b220

SHA512
532629ee4682aed31102b1c22e4a517e9ed8bcac9a04c00ccd210d6ba9789afdac729f61736346f1724a8d8d07f85e6ae1ab7e37b5e35f84695124cc90c92ddf

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\cache2\doomed\7334

Filesize
6KB

MD5
5a915147f18590e8b265e7fbceb49503

SHA1
666c6fcdc5d27299c440a0a8e341711f71605afe

SHA256
0410d73bbf9efb80b7fda5878fdeb7cfd813d2cec3dd8c02ba07a0c1d559327e

SHA512
4ca8d5555c17ad9fd4d09a0fcb7e826db81cd805d6eea3b4cab2dda6147096ec22a5813dc395fb05389f0fce0825500d8707a0428cc33fe7f723bc9fe21d1f56

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\cache2\entries\1122804188F6C797DC8046D20283A0585337BA1D

Filesize
15KB

MD5
60d17ad0838780357eb43d5f9e7925c2

SHA1
463e8cae85459c2f3d175719cc3b0403ce3b5a71

SHA256
a38f30c22fa7a22f9770975ec939a0b0feef49d29a3c57cf0640ff25f4338f45

SHA512
0a077d3afc800845b258795c55debf6d0dbe782fcce15c57e79abf908c6d5d98cb797cf3e6ae8ea7ccbd7d39bf4d55b3b5df5b6c0e0a69bd44274f071727d735

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\cache2\entries\1BE6367B7647F11B0DC9D4C52CFA6BB02935FA23

Filesize
1.0MB

MD5
67e83156ef4fb89a5e08a28ff4bc1d69

SHA1
d6aa3cb56653523477ed7919c6167c84e836aced

SHA256
3becbdaa1cf57410fb4dfa8677847b5c6fc178e996e586bd161e04f28cf5bcab

SHA512
a8bf3085def1ffda209b78c4694422f283afb2e97b79552894d836e94f4e05eb12e67a8828f9c97bb283db2e09532482d4b3aa42956ca05d345baec81f6b390f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\cache2\entries\99F943E01ABBEDDF7BEDF2627823375478B2BC35

Filesize
10KB

MD5
f3b27ed973c7d50cd8aaccc3c14a90b9

SHA1
e05dd827a2167379fe3073d6585af0a939f83724

SHA256
f3cec39c56d797c835a75a0718b6409c43398e6cf24d319d5a1fc0fb466a4c9e

SHA512
ea5f787a1b10b1b0db624d0dbc53781187ca131a6fb2efbd13c39070649319506a405e2fd3aa52e2f98ec6a088c49e62849cbdff59540980ed6f29f1bd3f6363

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\cache2\entries\A24C199F229C091282316164886AB3AA2E5F3657

Filesize
16KB

MD5
e3e965118e17c4114867c25d7d64c40d

SHA1
be769b2ca5b0625480ec6daec8491d09b00718d5

SHA256
8bba2e2d387f6c6352652475db67517df4ac80a147cece3e05e3927628f25d8a

SHA512
3c02dd56fada82a139a775dd7ab88ef639656ea3ccb973f8dd22f13940dff51979a29ecbccdf7f83d52f10162df2f8a825377657185be581fc53e8c1ffa36a71

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\cache2\entries\A2CAA22D6614342E83407546A41044DA45DE6608

Filesize
17KB

MD5
7b4e7a35795fa419206a04a085d1594a

SHA1
37699f73f43a5c46d9babe2099d11502fc090590

SHA256
04fb4b9a865d5eaccfef762216bceb70e219a6e433a7ac21a9d6253c810796e9

SHA512
67fe5a59995efdedd0548ca465959474bc5002893fd4cc0f847b9567934433dcc371b20b289f701047690782d07caedfcea30376b6b09945a8f51a67affd36d8

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\thumbnails\328b405a228bd6287d5cd6074ae75069.png

Filesize
24KB

MD5
1c1d2fbc1d59b4558744419e036bb48a

SHA1
d214f07b86224ac25beeac105b3938c30051b55f

SHA256
cc994bb0e7ba40e158b37d13c9eba6ea9f1a03d5c340355411944c5097b14e66

SHA512
405540edd69ef5870c03690e5fdd5cd349d064f5d5875c1cc9671ec41388b286224a53b538ba1b60f5d9c0249ca83a0b94871dee7ce4d56c3ccad960df4990a8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\datareporting\glean\db\data.safe.bin

Filesize
9KB

MD5
9f646063930a8026f395ab490cb609ce

SHA1
9e83b0cf7e715b33d4a5ccb3feb77ac710cfb620

SHA256
7f644aa25f274904cf0e7c09c7920aade41d58e9500b731de06c7c584c1c0ae0

SHA512
3de571328a8c1865d0c195589de352fc0795c64e6749de56e84316833ca58c6e2442e8c719f68797bd754e15aa91d3288cd1d1f47684f598dbea9addd9489ced

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\datareporting\glean\pending_pings\f7bf099d-d027-4c48-8241-99e16e8768af

Filesize
734B

MD5
3dea9a3e4ef7a2f3b14e79e69a5e3b1e

SHA1
f510874ed8cddeb7360b99850e101bcec08587d0

SHA256
dee69613d25aa894acc0622c9fd401169d30171622791ca3f80677473a297644

SHA512
28ede15461c53d5d5c9ea33a045261bfc380babb29e78435bd301dd6949268f204ff3ad8b0dbeaf931237cb1a89aa439c491fcc07d0dbb16d72fea10bbd02a50

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\prefs-1.js

Filesize
6KB

MD5
677bbad45b8779636845d346d59a526a

SHA1
8f56e5f808f96a1ff83c8007da3de3978e5d8ccc

SHA256
2e1cbcff15c7945e7038d2c77722f850a32824a96f1ac5235709900da2b58925

SHA512
1f84d3dc5f509b7f0732ed012b5e8710bb9337b3260c4631cb1b189ea6e04d4603772b1e41b649a869c2c01195f6106f9c03fa900a00fc0cb951281eb9d881fd

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\prefs-1.js

Filesize
6KB

MD5
cc0ba88cd8cd891518af35c4a03124c7

SHA1
1d3825fc78c2366a2d8835b8d3b4141ab45952c4

SHA256
618f09aa49c988cd774f62399bb065981c3b6e2dcfa0d9846f96c7c1e3441fa8

SHA512
5e53618e872971bf3f01852279cf177325a684c829d0717315e212165c747dff121a7e14aa89a204e4b06d7b2179c950b08cce744a21fcbf213dd8a51905bd42

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
5a27420d867968a602d99c85a655b922

SHA1
c5d466b5ded0d1d09fe0646589254d4ec54c71f8

SHA256
d3d415d68e7477bb7a5ff216e303857f280c9463e47869731f72e759f0ecc544

SHA512
11215e1948f09eebdf017c5e5cdeb4132cf761e82aa3f85f53d0499fcc7245804920017a6c0ac362a3bc8e770e261506a39c000e4be616e91018520f1200f336

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
2KB

MD5
b07205a0b78b83df4fe53693319ee157

SHA1
b3da63ac9bc6f26b03c7ca006598955fb9e266e6

SHA256
9c7eaefbb3c84b5a72e2392d58e2ef842a19edccbaeec0aa04cba4d9a82570a1

SHA512
9362ee5ad95e52e1cc9e61533eeadb0e5cc9348ed68d6fcafc5063dab2e9382e1d9a71764fb5a1f4aead3612e2c673454c723024d0fc73eac78438a8c0292925

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
2KB

MD5
1473ea45119cd4e860f1dacbd39239ea

SHA1
496117937fe498ada6de3378aea51c98771b219d

SHA256
f0d0ec374d0671e651b5ce37cbe8e06b1cc770671babb456664f29e5343ef4e6

SHA512
d3345a791e299910e9739359cc1be77a524278ad7dcd6f1de88ce16a8e7b4a835899575e2898262e9068bd7a3f5d871a4d7a114dd84378290b121837eeb0b681

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
2KB

MD5
88d03d3a6e9527765a7c5a4339c0128d

SHA1
244facdf56166c03c7b60e0a22352c0be406028c

SHA256
aa7f43711a972ea6d722ab35198841486fdb41986923583357fe42896a11c0a8

SHA512
6eb711ddd4bfac34d5bce2eef60c6d936e7465c1daba862fe2d631eb9488319c85ca6fc2822014207c59ea540e1630bbfff150e7aba7bc6e93ebab3f22454a79

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
184KB

MD5
0d0013d9708d9fef539adc917f5b87f6

SHA1
5e071e6b4d8abf007c8bb78ee948caf5bb0439e1

SHA256
f416d29cdbaa66b7d04483831d2a593a735316fafb643414a12df78da0ab054b

SHA512
851e9965a0fed9e0f5195ce655635cf13687d18678e4a9df807ab22cbc53c02cd2006fd65d93cd80b2a06d709e59122ea9933ba5cec551c6d51f5e9b4c175388

Download Submit
memory/4764-0-0x0000000073C1E000-0x0000000073C1F000-memory.dmp

Filesize
4KB

Download
memory/4764-8-0x0000000073C1E000-0x0000000073C1F000-memory.dmp

Filesize
4KB

Download
memory/4764-7-0x0000000073C10000-0x00000000742FE000-memory.dmp

Filesize
6.9MB

Download
memory/4764-5-0x0000000073C10000-0x00000000742FE000-memory.dmp

Filesize
6.9MB

Download
memory/4764-4-0x0000000004B60000-0x0000000004B6A000-memory.dmp

Filesize
40KB

Download
memory/4764-3-0x0000000004B70000-0x0000000004C02000-memory.dmp

Filesize
584KB

Download
memory/4764-653-0x0000000073C10000-0x00000000742FE000-memory.dmp

Filesize
6.9MB

Download
memory/4764-6-0x00000000056F0000-0x0000000005904000-memory.dmp

Filesize
2.1MB

Download
memory/4764-666-0x0000000073C10000-0x00000000742FE000-memory.dmp

Filesize
6.9MB

Download
memory/4764-9-0x0000000073C10000-0x00000000742FE000-memory.dmp

Filesize
6.9MB

Download
memory/4764-2-0x0000000004FD0000-0x00000000054CE000-memory.dmp

Filesize
5.0MB

Download
memory/4764-749-0x0000000073C10000-0x00000000742FE000-memory.dmp

Filesize
6.9MB

Download
memory/4764-10-0x0000000073C10000-0x00000000742FE000-memory.dmp

Filesize
6.9MB

Download
memory/4764-1-0x00000000002D0000-0x0000000000302000-memory.dmp

Filesize
200KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads