agenttesla | 499d0e04aeabb42bfa3d686bc65b45b3b116116cf9231ea2717569e44dcfc8de

Analysis

max time kernel
122s
max time network
129s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
20-01-2025 01:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Order confirmation for PO 7UH2025.exe
Size

549KB
MD5

f61aec6b837c52490e5af74f2558decd
SHA1

90d0c4a77384dcfb04b27f66a889e8bb627ff06c
SHA256

9c0ad5329e00794b6b9591cf7f4f633cd2d0e3d1209d50b99cb48838fe63b79a
SHA512

c8cadeef5cf02efbfa34df770063a78b82ff2ca5280bb0b47f85e41e9609c3978ec88cc4ddb6cf2fc7fbbad0547215ef3c61f7721e1c66315061ec2ee8ec17fd
SSDEEP

12288:2pzQijkXRZXMnWJsGQkHgQ0cNrSdSG774u4U4U4U+H0U4H0U4UjU+J4J4H4f4D4z:kciwXvXrQkHg8NrSdSG779LLLS/o/L49

Score

10^/10

agenttesla discovery keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: ftp
Host:
ftp://ftp.transotraval.cl
Port:
21
Username:
[email protected]
Password:
vIZ2P]dt&a!d

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Agenttesla family
agenttesla
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
6	ip-api.com
7	ip-api.com
8	ip-api.com

Suspicious use of SetThreadContext 64 IoCs

description	pid	Process	procid_target
PID 2552 set thread context of 2588	2552	Order confirmation for PO 7UH2025.exe	29
PID 2552 set thread context of 2752	2552	Order confirmation for PO 7UH2025.exe	30
PID 2552 set thread context of 2848	2552	Order confirmation for PO 7UH2025.exe	31
PID 2552 set thread context of 2496	2552	Order confirmation for PO 7UH2025.exe	32
PID 2552 set thread context of 1972	2552	Order confirmation for PO 7UH2025.exe	33
PID 2552 set thread context of 2456	2552	Order confirmation for PO 7UH2025.exe	34
PID 2552 set thread context of 2504	2552	Order confirmation for PO 7UH2025.exe	35
PID 2552 set thread context of 344	2552	Order confirmation for PO 7UH2025.exe	36
PID 2552 set thread context of 2668	2552	Order confirmation for PO 7UH2025.exe	37
PID 2552 set thread context of 3060	2552	Order confirmation for PO 7UH2025.exe	38
PID 2552 set thread context of 356	2552	Order confirmation for PO 7UH2025.exe	39
PID 2552 set thread context of 1628	2552	Order confirmation for PO 7UH2025.exe	40
PID 2552 set thread context of 2636	2552	Order confirmation for PO 7UH2025.exe	42
PID 2552 set thread context of 1884	2552	Order confirmation for PO 7UH2025.exe	43
PID 2552 set thread context of 2352	2552	Order confirmation for PO 7UH2025.exe	44
PID 2552 set thread context of 2860	2552	Order confirmation for PO 7UH2025.exe	45
PID 2552 set thread context of 1116	2552	Order confirmation for PO 7UH2025.exe	47
PID 2552 set thread context of 1056	2552	Order confirmation for PO 7UH2025.exe	48
PID 2552 set thread context of 1496	2552	Order confirmation for PO 7UH2025.exe	50
PID 2552 set thread context of 1736	2552	Order confirmation for PO 7UH2025.exe	51
PID 2552 set thread context of 1704	2552	Order confirmation for PO 7UH2025.exe	52
PID 2552 set thread context of 1192	2552	Order confirmation for PO 7UH2025.exe	53
PID 2552 set thread context of 2568	2552	Order confirmation for PO 7UH2025.exe	54
PID 2552 set thread context of 2720	2552	Order confirmation for PO 7UH2025.exe	55
PID 2552 set thread context of 2948	2552	Order confirmation for PO 7UH2025.exe	56
PID 2552 set thread context of 2536	2552	Order confirmation for PO 7UH2025.exe	57
PID 2552 set thread context of 1640	2552	Order confirmation for PO 7UH2025.exe	58
PID 2552 set thread context of 1412	2552	Order confirmation for PO 7UH2025.exe	59
PID 2552 set thread context of 2828	2552	Order confirmation for PO 7UH2025.exe	60
PID 2552 set thread context of 1920	2552	Order confirmation for PO 7UH2025.exe	61
PID 2552 set thread context of 1664	2552	Order confirmation for PO 7UH2025.exe	62
PID 2552 set thread context of 2684	2552	Order confirmation for PO 7UH2025.exe	63
PID 2552 set thread context of 2152	2552	Order confirmation for PO 7UH2025.exe	64
PID 2552 set thread context of 1288	2552	Order confirmation for PO 7UH2025.exe	65
PID 2552 set thread context of 2980	2552	Order confirmation for PO 7UH2025.exe	66
PID 2552 set thread context of 1692	2552	Order confirmation for PO 7UH2025.exe	70
PID 2552 set thread context of 1300	2552	Order confirmation for PO 7UH2025.exe	71
PID 2552 set thread context of 2864	2552	Order confirmation for PO 7UH2025.exe	72
PID 2552 set thread context of 2404	2552	Order confirmation for PO 7UH2025.exe	73
PID 2552 set thread context of 2756	2552	Order confirmation for PO 7UH2025.exe	74
PID 2552 set thread context of 2576	2552	Order confirmation for PO 7UH2025.exe	75
PID 2552 set thread context of 2772	2552	Order confirmation for PO 7UH2025.exe	76
PID 2552 set thread context of 2924	2552	Order confirmation for PO 7UH2025.exe	77
PID 2552 set thread context of 2800	2552	Order confirmation for PO 7UH2025.exe	78
PID 2552 set thread context of 2096	2552	Order confirmation for PO 7UH2025.exe	82
PID 2552 set thread context of 2296	2552	Order confirmation for PO 7UH2025.exe	83
PID 2552 set thread context of 748	2552	Order confirmation for PO 7UH2025.exe	84
PID 2552 set thread context of 772	2552	Order confirmation for PO 7UH2025.exe	85
PID 2552 set thread context of 2888	2552	Order confirmation for PO 7UH2025.exe	87
PID 2552 set thread context of 2768	2552	Order confirmation for PO 7UH2025.exe	88
PID 2552 set thread context of 2612	2552	Order confirmation for PO 7UH2025.exe	89
PID 2552 set thread context of 2584	2552	Order confirmation for PO 7UH2025.exe	91
PID 2552 set thread context of 1016	2552	Order confirmation for PO 7UH2025.exe	92
PID 2552 set thread context of 1848	2552	Order confirmation for PO 7UH2025.exe	93
PID 2552 set thread context of 1080	2552	Order confirmation for PO 7UH2025.exe	94
PID 2552 set thread context of 348	2552	Order confirmation for PO 7UH2025.exe	95
PID 2552 set thread context of 992	2552	Order confirmation for PO 7UH2025.exe	96
PID 2552 set thread context of 2364	2552	Order confirmation for PO 7UH2025.exe	97
PID 2552 set thread context of 2676	2552	Order confirmation for PO 7UH2025.exe	98
PID 2552 set thread context of 2316	2552	Order confirmation for PO 7UH2025.exe	99
PID 2552 set thread context of 340	2552	Order confirmation for PO 7UH2025.exe	100
PID 2552 set thread context of 2136	2552	Order confirmation for PO 7UH2025.exe	101
PID 2552 set thread context of 904	2552	Order confirmation for PO 7UH2025.exe	102
PID 2552 set thread context of 2476	2552	Order confirmation for PO 7UH2025.exe	103

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 51 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regasm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	installutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	installutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	installutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regasm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	installutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
2352	AddInProcess32.exe
2496	AddInProcess32.exe
2668	AddInProcess32.exe
1628	AddInProcess32.exe
2496	AddInProcess32.exe
2588	AddInProcess32.exe
2588	AddInProcess32.exe
1628	AddInProcess32.exe
2352	AddInProcess32.exe
2668	AddInProcess32.exe
2636	installutil.exe
2636	installutil.exe
1056	AddInProcess32.exe
1056	AddInProcess32.exe
1664	AddInProcess32.exe
1664	AddInProcess32.exe
1920	installutil.exe
1920	installutil.exe
1692	regasm.exe
1692	regasm.exe
2612	AddInProcess32.exe
2612	AddInProcess32.exe
2676	AddInProcess32.exe
2676	AddInProcess32.exe
1016	AddInProcess32.exe
1016	AddInProcess32.exe
340	AddInProcess32.exe
340	AddInProcess32.exe
992	AddInProcess32.exe
992	AddInProcess32.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeDebugPrivilege	2352	AddInProcess32.exe
Token: SeDebugPrivilege	2588	AddInProcess32.exe
Token: SeDebugPrivilege	2496	AddInProcess32.exe
Token: SeDebugPrivilege	1628	AddInProcess32.exe
Token: SeDebugPrivilege	2668	AddInProcess32.exe
Token: SeDebugPrivilege	2636	installutil.exe
Token: SeDebugPrivilege	1056	AddInProcess32.exe
Token: SeDebugPrivilege	1664	AddInProcess32.exe
Token: SeDebugPrivilege	1920	installutil.exe
Token: SeDebugPrivilege	1692	regasm.exe
Token: SeDebugPrivilege	2612	AddInProcess32.exe
Token: SeDebugPrivilege	2676	AddInProcess32.exe
Token: SeDebugPrivilege	1016	AddInProcess32.exe
Token: SeDebugPrivilege	340	AddInProcess32.exe
Token: SeDebugPrivilege	992	AddInProcess32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2552 wrote to memory of 2588	2552	Order confirmation for PO 7UH2025.exe	29
PID 2552 wrote to memory of 2588	2552	Order confirmation for PO 7UH2025.exe	29
PID 2552 wrote to memory of 2588	2552	Order confirmation for PO 7UH2025.exe	29
PID 2552 wrote to memory of 2588	2552	Order confirmation for PO 7UH2025.exe	29
PID 2552 wrote to memory of 2588	2552	Order confirmation for PO 7UH2025.exe	29
PID 2552 wrote to memory of 2588	2552	Order confirmation for PO 7UH2025.exe	29
PID 2552 wrote to memory of 2588	2552	Order confirmation for PO 7UH2025.exe	29
PID 2552 wrote to memory of 2588	2552	Order confirmation for PO 7UH2025.exe	29
PID 2552 wrote to memory of 2588	2552	Order confirmation for PO 7UH2025.exe	29
PID 2552 wrote to memory of 2752	2552	Order confirmation for PO 7UH2025.exe	30
PID 2552 wrote to memory of 2752	2552	Order confirmation for PO 7UH2025.exe	30
PID 2552 wrote to memory of 2752	2552	Order confirmation for PO 7UH2025.exe	30
PID 2552 wrote to memory of 2752	2552	Order confirmation for PO 7UH2025.exe	30
PID 2552 wrote to memory of 2752	2552	Order confirmation for PO 7UH2025.exe	30
PID 2552 wrote to memory of 2752	2552	Order confirmation for PO 7UH2025.exe	30
PID 2552 wrote to memory of 2752	2552	Order confirmation for PO 7UH2025.exe	30
PID 2552 wrote to memory of 2752	2552	Order confirmation for PO 7UH2025.exe	30
PID 2552 wrote to memory of 2752	2552	Order confirmation for PO 7UH2025.exe	30
PID 2552 wrote to memory of 2848	2552	Order confirmation for PO 7UH2025.exe	31
PID 2552 wrote to memory of 2848	2552	Order confirmation for PO 7UH2025.exe	31
PID 2552 wrote to memory of 2848	2552	Order confirmation for PO 7UH2025.exe	31
PID 2552 wrote to memory of 2848	2552	Order confirmation for PO 7UH2025.exe	31
PID 2552 wrote to memory of 2848	2552	Order confirmation for PO 7UH2025.exe	31
PID 2552 wrote to memory of 2848	2552	Order confirmation for PO 7UH2025.exe	31
PID 2552 wrote to memory of 2848	2552	Order confirmation for PO 7UH2025.exe	31
PID 2552 wrote to memory of 2848	2552	Order confirmation for PO 7UH2025.exe	31
PID 2552 wrote to memory of 2848	2552	Order confirmation for PO 7UH2025.exe	31
PID 2552 wrote to memory of 2496	2552	Order confirmation for PO 7UH2025.exe	32
PID 2552 wrote to memory of 2496	2552	Order confirmation for PO 7UH2025.exe	32
PID 2552 wrote to memory of 2496	2552	Order confirmation for PO 7UH2025.exe	32
PID 2552 wrote to memory of 2496	2552	Order confirmation for PO 7UH2025.exe	32
PID 2552 wrote to memory of 2496	2552	Order confirmation for PO 7UH2025.exe	32
PID 2552 wrote to memory of 2496	2552	Order confirmation for PO 7UH2025.exe	32
PID 2552 wrote to memory of 2496	2552	Order confirmation for PO 7UH2025.exe	32
PID 2552 wrote to memory of 2496	2552	Order confirmation for PO 7UH2025.exe	32
PID 2552 wrote to memory of 2496	2552	Order confirmation for PO 7UH2025.exe	32
PID 2552 wrote to memory of 1972	2552	Order confirmation for PO 7UH2025.exe	33
PID 2552 wrote to memory of 1972	2552	Order confirmation for PO 7UH2025.exe	33
PID 2552 wrote to memory of 1972	2552	Order confirmation for PO 7UH2025.exe	33
PID 2552 wrote to memory of 1972	2552	Order confirmation for PO 7UH2025.exe	33
PID 2552 wrote to memory of 1972	2552	Order confirmation for PO 7UH2025.exe	33
PID 2552 wrote to memory of 1972	2552	Order confirmation for PO 7UH2025.exe	33
PID 2552 wrote to memory of 1972	2552	Order confirmation for PO 7UH2025.exe	33
PID 2552 wrote to memory of 1972	2552	Order confirmation for PO 7UH2025.exe	33
PID 2552 wrote to memory of 1972	2552	Order confirmation for PO 7UH2025.exe	33
PID 2552 wrote to memory of 2456	2552	Order confirmation for PO 7UH2025.exe	34
PID 2552 wrote to memory of 2456	2552	Order confirmation for PO 7UH2025.exe	34
PID 2552 wrote to memory of 2456	2552	Order confirmation for PO 7UH2025.exe	34
PID 2552 wrote to memory of 2456	2552	Order confirmation for PO 7UH2025.exe	34
PID 2552 wrote to memory of 2456	2552	Order confirmation for PO 7UH2025.exe	34
PID 2552 wrote to memory of 2456	2552	Order confirmation for PO 7UH2025.exe	34
PID 2552 wrote to memory of 2456	2552	Order confirmation for PO 7UH2025.exe	34
PID 2552 wrote to memory of 2456	2552	Order confirmation for PO 7UH2025.exe	34
PID 2552 wrote to memory of 2456	2552	Order confirmation for PO 7UH2025.exe	34
PID 2552 wrote to memory of 2504	2552	Order confirmation for PO 7UH2025.exe	35
PID 2552 wrote to memory of 2504	2552	Order confirmation for PO 7UH2025.exe	35
PID 2552 wrote to memory of 2504	2552	Order confirmation for PO 7UH2025.exe	35
PID 2552 wrote to memory of 2504	2552	Order confirmation for PO 7UH2025.exe	35
PID 2552 wrote to memory of 2504	2552	Order confirmation for PO 7UH2025.exe	35
PID 2552 wrote to memory of 2504	2552	Order confirmation for PO 7UH2025.exe	35
PID 2552 wrote to memory of 2504	2552	Order confirmation for PO 7UH2025.exe	35
PID 2552 wrote to memory of 2504	2552	Order confirmation for PO 7UH2025.exe	35
PID 2552 wrote to memory of 2504	2552	Order confirmation for PO 7UH2025.exe	35
PID 2552 wrote to memory of 344	2552	Order confirmation for PO 7UH2025.exe	36

C:\Users\Admin\AppData\Local\Temp\Order confirmation for PO 7UH2025.exe
"C:\Users\Admin\AppData\Local\Temp\Order confirmation for PO 7UH2025.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2552
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2588
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2752
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2848
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2496
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1972
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2456
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2504
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:344
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2668
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3060
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:356
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1628
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  PID:1716
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2636
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1884
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2352
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2860
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  PID:1524
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1116
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1056
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  PID:1320
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1496
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1736
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1704
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  PID:1192
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  PID:2568
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  PID:2720
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  PID:2948
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  PID:2536
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  PID:1640
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  PID:1412
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  PID:2828
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1920
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1664
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2684
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2152
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1288
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2980
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  PID:1680
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
  2⤵
  PID:752
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
  2⤵
  PID:112
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1692
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1300
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2864
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2404
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2756
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2576
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2772
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2924
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2800
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  PID:2940
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
  2⤵
  PID:1052
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
  2⤵
  PID:2572
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2096
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  PID:2296
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  PID:748
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  PID:772
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  PID:2544
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
  2⤵
  PID:2888
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  PID:2768
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2612
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  PID:2628
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
  2⤵
  PID:2584
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1016
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1848
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1080
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:348
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:992
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2364
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2676
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2316
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:340
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2136
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:904
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  PID:2476
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  PID:2852
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  PID:2512
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  PID:272
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  PID:2212
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  PID:2140
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  PID:2680
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  PID:2740
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2188
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2024
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2552 -s 888
  2⤵
  PID:1648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2588-1-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2588-10-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2588-0-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2588-8-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2588-15-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2752-13-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2752-11-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2752-9-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download