agenttesla | e81efea1ee8a5db71fd76af8c8acb4aa734f8a5f5e933ed67f3bee470820dc67

Analysis

max time kernel
131s
max time network
127s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 01:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e81efea1ee8a5db71fd76af8c8acb4aa734f8a5f5e933ed67f3bee470820dc67.exe
Size

858KB
MD5

42cf5b6a353e075197a827020924854a
SHA1

08daf826ddfa2f5f0a611968bc98e8ba7f01016a
SHA256

e81efea1ee8a5db71fd76af8c8acb4aa734f8a5f5e933ed67f3bee470820dc67
SHA512

825bbae160277fb57cdf00d5d206265c6206552d748ff8b9e9c3a9ed4dea974ab79963f038ee1024b587b1d5fde0e767587009063917da4dc7b61b6e6deee72e
SSDEEP

24576:/EN973phvt8tmUdkw1xG8fFjGMaOnO+pwFL9N09PPb:/EN973PvEL2wHBODLcPj

Score

10^/10

agenttesla keylogger spyware stealer trojan upx

Malware Config

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla payload 8 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2116-12-0x0000000000080000-0x00000000000DE000-memory.dmp	family_agenttesla
behavioral1/memory/2116-11-0x0000000000080000-0x00000000000DE000-memory.dmp	family_agenttesla
behavioral1/memory/2116-4-0x0000000000080000-0x00000000000DE000-memory.dmp	family_agenttesla
behavioral1/memory/804-36-0x00000000004F0000-0x000000000054E000-memory.dmp	family_agenttesla
behavioral1/memory/804-35-0x00000000004F0000-0x000000000054E000-memory.dmp	family_agenttesla
behavioral1/memory/804-28-0x00000000004F0000-0x000000000054E000-memory.dmp	family_agenttesla
behavioral1/memory/1980-58-0x0000000000080000-0x00000000000DE000-memory.dmp	family_agenttesla
behavioral1/memory/1980-57-0x0000000000080000-0x00000000000DE000-memory.dmp	family_agenttesla

Executes dropped EXE 4 IoCs

Processes:

mighost.exemighost.exemighost.exemighost.exe

pid process

760 mighost.exe
804 mighost.exe
2144 mighost.exe
1980 mighost.exe

pid	process
760	mighost.exe
804	mighost.exe
2144	mighost.exe
1980	mighost.exe

UPX packed file 13 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2580-0-0x0000000000F20000-0x00000000010BE000-memory.dmp	upx
behavioral1/memory/2116-14-0x0000000000F20000-0x00000000010BE000-memory.dmp	upx
behavioral1/memory/2580-15-0x0000000000F20000-0x00000000010BE000-memory.dmp	upx
behavioral1/memory/2580-18-0x0000000000F20000-0x00000000010BE000-memory.dmp	upx
behavioral1/memory/760-25-0x0000000000DE0000-0x0000000000F7E000-memory.dmp	upx
C:\Users\Admin\cdp\mighost.exe	upx
behavioral1/memory/804-37-0x0000000000DE0000-0x0000000000F7E000-memory.dmp	upx
behavioral1/memory/760-38-0x0000000000DE0000-0x0000000000F7E000-memory.dmp	upx
behavioral1/memory/760-40-0x0000000000DE0000-0x0000000000F7E000-memory.dmp	upx
behavioral1/memory/2144-46-0x0000000001110000-0x00000000012AE000-memory.dmp	upx
behavioral1/memory/1980-56-0x0000000001110000-0x00000000012AE000-memory.dmp	upx
behavioral1/memory/2144-59-0x0000000001110000-0x00000000012AE000-memory.dmp	upx
behavioral1/memory/2144-61-0x0000000001110000-0x00000000012AE000-memory.dmp	upx

AutoIT Executable 7 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
behavioral1/memory/2580-15-0x0000000000F20000-0x00000000010BE000-memory.dmp	autoit_exe
behavioral1/memory/2580-18-0x0000000000F20000-0x00000000010BE000-memory.dmp	autoit_exe
behavioral1/memory/760-38-0x0000000000DE0000-0x0000000000F7E000-memory.dmp	autoit_exe
behavioral1/memory/760-40-0x0000000000DE0000-0x0000000000F7E000-memory.dmp	autoit_exe
behavioral1/memory/2144-46-0x0000000001110000-0x00000000012AE000-memory.dmp	autoit_exe
behavioral1/memory/2144-59-0x0000000001110000-0x00000000012AE000-memory.dmp	autoit_exe
behavioral1/memory/2144-61-0x0000000001110000-0x00000000012AE000-memory.dmp	autoit_exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

e81efea1ee8a5db71fd76af8c8acb4aa734f8a5f5e933ed67f3bee470820dc67.exemighost.exemighost.exe

description	pid	process	target process
PID 2580 set thread context of 2116	2580	e81efea1ee8a5db71fd76af8c8acb4aa734f8a5f5e933ed67f3bee470820dc67.exe	e81efea1ee8a5db71fd76af8c8acb4aa734f8a5f5e933ed67f3bee470820dc67.exe
PID 760 set thread context of 804	760	mighost.exe	mighost.exe
PID 2144 set thread context of 1980	2144	mighost.exe	mighost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000fc5bbc9e01e608b29f7c2d97a273fbc6f7925954fc811d9ebf5dd142f1f215b5000000000e80000000020000200000005a0ce2f2e99210a4ca691f278b2be2cf4a8615c4f4bcabbb76e6465601f4af1c20000000cd59485e389fd24b187ad49a5295e687e0c37a44aa361b0bc6969a172416fe5640000000bbd10c4718027d23acd31ba9d98e6381e3064a20cff18cf2fb233a347cc43d6039dd89cdefdba01e4e327fe6ecec19729024eaa77ce2318f36750c9178906003	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425957574"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b049ff5252cbda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{702552A1-3745-11EF-91CF-DEECE6B0C1A4} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000901a0b161b4272356e04ec3b56e281583722357625fe7c810b674d21d8bfd6ff000000000e8000000002000020000000aef4443175f46e9b9c843400867ecb14f303fa99bb858c551701f03bc3a6df8b90000000fd8f83ce17501518d7e581d258e3d5ea620e2ae677318a6094c17baa842a4157b49bf64d5b3e4b3849111ddfae8426f32ed7c349cf0f4f57deb75dfc83e59392101cf3e8422c0d85f2ad0be7872d77c7e7f7f303294575173e37f10656352683d26093646c15456f0dc4298107eecef9453b3b3af6d7bbcfb40fd2b6bf121b002bb1c45741d2d755744653ddb6d8f2b84000000085078b9a60cbe9ca43528b5af5ac10a002caa98da38b6531aa6eca645e6f4a0a5636b7472947a443e160840130f8291a831a8a0b6f5390d97ec1f3a3c96613f4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exeschtasks.exeschtasks.exe

pid process

2352 schtasks.exe
2908 schtasks.exe
2164 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

iexplore.exe

pid process

2592 iexplore.exe
2592 iexplore.exe

pid	process
2352	schtasks.exe
2908	schtasks.exe
2164	schtasks.exe

Suspicious use of FindShellTrayWindow 10 IoCs

Processes:

e81efea1ee8a5db71fd76af8c8acb4aa734f8a5f5e933ed67f3bee470820dc67.exeiexplore.exemighost.exemighost.exe

pid	process
2580	e81efea1ee8a5db71fd76af8c8acb4aa734f8a5f5e933ed67f3bee470820dc67.exe
2580	e81efea1ee8a5db71fd76af8c8acb4aa734f8a5f5e933ed67f3bee470820dc67.exe
2580	e81efea1ee8a5db71fd76af8c8acb4aa734f8a5f5e933ed67f3bee470820dc67.exe
2592	iexplore.exe
760	mighost.exe
760	mighost.exe
760	mighost.exe
2144	mighost.exe
2144	mighost.exe
2144	mighost.exe

Suspicious use of SendNotifyMessage 9 IoCs

Processes:

e81efea1ee8a5db71fd76af8c8acb4aa734f8a5f5e933ed67f3bee470820dc67.exemighost.exemighost.exe

pid	process
2580	e81efea1ee8a5db71fd76af8c8acb4aa734f8a5f5e933ed67f3bee470820dc67.exe
2580	e81efea1ee8a5db71fd76af8c8acb4aa734f8a5f5e933ed67f3bee470820dc67.exe
2580	e81efea1ee8a5db71fd76af8c8acb4aa734f8a5f5e933ed67f3bee470820dc67.exe
760	mighost.exe
760	mighost.exe
760	mighost.exe
2144	mighost.exe
2144	mighost.exe
2144	mighost.exe

Suspicious use of SetWindowsHookEx 14 IoCs

Processes:

iexplore.exeIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXE

pid	process
2592	iexplore.exe
2592	iexplore.exe
2276	IEXPLORE.EXE
2276	IEXPLORE.EXE
2276	IEXPLORE.EXE
2276	IEXPLORE.EXE
2476	IEXPLORE.EXE
2476	IEXPLORE.EXE
2476	IEXPLORE.EXE
2476	IEXPLORE.EXE
688	IEXPLORE.EXE
688	IEXPLORE.EXE
688	IEXPLORE.EXE
688	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 54 IoCs

Processes:

e81efea1ee8a5db71fd76af8c8acb4aa734f8a5f5e933ed67f3bee470820dc67.exee81efea1ee8a5db71fd76af8c8acb4aa734f8a5f5e933ed67f3bee470820dc67.exeiexplore.exetaskeng.exemighost.exemighost.exe

description	pid	process	target process
PID 2580 wrote to memory of 2116	2580	e81efea1ee8a5db71fd76af8c8acb4aa734f8a5f5e933ed67f3bee470820dc67.exe	e81efea1ee8a5db71fd76af8c8acb4aa734f8a5f5e933ed67f3bee470820dc67.exe
PID 2580 wrote to memory of 2116	2580	e81efea1ee8a5db71fd76af8c8acb4aa734f8a5f5e933ed67f3bee470820dc67.exe	e81efea1ee8a5db71fd76af8c8acb4aa734f8a5f5e933ed67f3bee470820dc67.exe
PID 2580 wrote to memory of 2116	2580	e81efea1ee8a5db71fd76af8c8acb4aa734f8a5f5e933ed67f3bee470820dc67.exe	e81efea1ee8a5db71fd76af8c8acb4aa734f8a5f5e933ed67f3bee470820dc67.exe
PID 2580 wrote to memory of 2116	2580	e81efea1ee8a5db71fd76af8c8acb4aa734f8a5f5e933ed67f3bee470820dc67.exe	e81efea1ee8a5db71fd76af8c8acb4aa734f8a5f5e933ed67f3bee470820dc67.exe
PID 2580 wrote to memory of 2116	2580	e81efea1ee8a5db71fd76af8c8acb4aa734f8a5f5e933ed67f3bee470820dc67.exe	e81efea1ee8a5db71fd76af8c8acb4aa734f8a5f5e933ed67f3bee470820dc67.exe
PID 2580 wrote to memory of 2116	2580	e81efea1ee8a5db71fd76af8c8acb4aa734f8a5f5e933ed67f3bee470820dc67.exe	e81efea1ee8a5db71fd76af8c8acb4aa734f8a5f5e933ed67f3bee470820dc67.exe
PID 2116 wrote to memory of 2592	2116	e81efea1ee8a5db71fd76af8c8acb4aa734f8a5f5e933ed67f3bee470820dc67.exe	iexplore.exe
PID 2116 wrote to memory of 2592	2116	e81efea1ee8a5db71fd76af8c8acb4aa734f8a5f5e933ed67f3bee470820dc67.exe	iexplore.exe
PID 2116 wrote to memory of 2592	2116	e81efea1ee8a5db71fd76af8c8acb4aa734f8a5f5e933ed67f3bee470820dc67.exe	iexplore.exe
PID 2116 wrote to memory of 2592	2116	e81efea1ee8a5db71fd76af8c8acb4aa734f8a5f5e933ed67f3bee470820dc67.exe	iexplore.exe
PID 2592 wrote to memory of 2276	2592	iexplore.exe	IEXPLORE.EXE
PID 2592 wrote to memory of 2276	2592	iexplore.exe	IEXPLORE.EXE
PID 2592 wrote to memory of 2276	2592	iexplore.exe	IEXPLORE.EXE
PID 2592 wrote to memory of 2276	2592	iexplore.exe	IEXPLORE.EXE
PID 2580 wrote to memory of 2352	2580	e81efea1ee8a5db71fd76af8c8acb4aa734f8a5f5e933ed67f3bee470820dc67.exe	schtasks.exe
PID 2580 wrote to memory of 2352	2580	e81efea1ee8a5db71fd76af8c8acb4aa734f8a5f5e933ed67f3bee470820dc67.exe	schtasks.exe
PID 2580 wrote to memory of 2352	2580	e81efea1ee8a5db71fd76af8c8acb4aa734f8a5f5e933ed67f3bee470820dc67.exe	schtasks.exe
PID 2580 wrote to memory of 2352	2580	e81efea1ee8a5db71fd76af8c8acb4aa734f8a5f5e933ed67f3bee470820dc67.exe	schtasks.exe
PID 1952 wrote to memory of 760	1952	taskeng.exe	mighost.exe
PID 1952 wrote to memory of 760	1952	taskeng.exe	mighost.exe
PID 1952 wrote to memory of 760	1952	taskeng.exe	mighost.exe
PID 1952 wrote to memory of 760	1952	taskeng.exe	mighost.exe
PID 760 wrote to memory of 804	760	mighost.exe	mighost.exe
PID 760 wrote to memory of 804	760	mighost.exe	mighost.exe
PID 760 wrote to memory of 804	760	mighost.exe	mighost.exe
PID 760 wrote to memory of 804	760	mighost.exe	mighost.exe
PID 760 wrote to memory of 804	760	mighost.exe	mighost.exe
PID 760 wrote to memory of 804	760	mighost.exe	mighost.exe
PID 2592 wrote to memory of 2476	2592	iexplore.exe	IEXPLORE.EXE
PID 2592 wrote to memory of 2476	2592	iexplore.exe	IEXPLORE.EXE
PID 2592 wrote to memory of 2476	2592	iexplore.exe	IEXPLORE.EXE
PID 2592 wrote to memory of 2476	2592	iexplore.exe	IEXPLORE.EXE
PID 760 wrote to memory of 2908	760	mighost.exe	schtasks.exe
PID 760 wrote to memory of 2908	760	mighost.exe	schtasks.exe
PID 760 wrote to memory of 2908	760	mighost.exe	schtasks.exe
PID 760 wrote to memory of 2908	760	mighost.exe	schtasks.exe
PID 1952 wrote to memory of 2144	1952	taskeng.exe	mighost.exe
PID 1952 wrote to memory of 2144	1952	taskeng.exe	mighost.exe
PID 1952 wrote to memory of 2144	1952	taskeng.exe	mighost.exe
PID 1952 wrote to memory of 2144	1952	taskeng.exe	mighost.exe
PID 2144 wrote to memory of 1980	2144	mighost.exe	mighost.exe
PID 2144 wrote to memory of 1980	2144	mighost.exe	mighost.exe
PID 2144 wrote to memory of 1980	2144	mighost.exe	mighost.exe
PID 2144 wrote to memory of 1980	2144	mighost.exe	mighost.exe
PID 2144 wrote to memory of 1980	2144	mighost.exe	mighost.exe
PID 2144 wrote to memory of 1980	2144	mighost.exe	mighost.exe
PID 2592 wrote to memory of 688	2592	iexplore.exe	IEXPLORE.EXE
PID 2592 wrote to memory of 688	2592	iexplore.exe	IEXPLORE.EXE
PID 2592 wrote to memory of 688	2592	iexplore.exe	IEXPLORE.EXE
PID 2592 wrote to memory of 688	2592	iexplore.exe	IEXPLORE.EXE
PID 2144 wrote to memory of 2164	2144	mighost.exe	schtasks.exe
PID 2144 wrote to memory of 2164	2144	mighost.exe	schtasks.exe
PID 2144 wrote to memory of 2164	2144	mighost.exe	schtasks.exe
PID 2144 wrote to memory of 2164	2144	mighost.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\e81efea1ee8a5db71fd76af8c8acb4aa734f8a5f5e933ed67f3bee470820dc67.exe
"C:\Users\Admin\AppData\Local\Temp\e81efea1ee8a5db71fd76af8c8acb4aa734f8a5f5e933ed67f3bee470820dc67.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2580

C:\Users\Admin\AppData\Local\Temp\e81efea1ee8a5db71fd76af8c8acb4aa734f8a5f5e933ed67f3bee470820dc67.exe
"C:\Users\Admin\AppData\Local\Temp\e81efea1ee8a5db71fd76af8c8acb4aa734f8a5f5e933ed67f3bee470820dc67.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:2116

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=e81efea1ee8a5db71fd76af8c8acb4aa734f8a5f5e933ed67f3bee470820dc67.exe&platform=0009&osver=5&isServer=0&shimver=4.0.30319.0
3⤵
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2592

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2592 CREDAT:275457 /prefetch:2
4⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2276

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2592 CREDAT:275477 /prefetch:2
4⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2476

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2592 CREDAT:275502 /prefetch:2
4⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:688

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\SysWOW64\schtasks.exe" /create /tn TRACERT /tr "C:\Users\Admin\cdp\mighost.exe" /sc minute /mo 1 /F
2⤵
- Scheduled Task/Job: Scheduled Task
PID:2352

C:\Windows\system32\taskeng.exe
taskeng.exe {BBFC35CA-70A9-46E7-8039-C03AA28AB73B} S-1-5-21-2737914667-933161113-3798636211-1000:PUMARTNR\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:1952

C:\Users\Admin\cdp\mighost.exe
C:\Users\Admin\cdp\mighost.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:760

C:\Users\Admin\cdp\mighost.exe
"C:\Users\Admin\cdp\mighost.exe"
3⤵
- Executes dropped EXE
PID:804

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\SysWOW64\schtasks.exe" /create /tn TRACERT /tr "C:\Users\Admin\cdp\mighost.exe" /sc minute /mo 1 /F
3⤵
- Scheduled Task/Job: Scheduled Task
PID:2908

C:\Users\Admin\cdp\mighost.exe
C:\Users\Admin\cdp\mighost.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2144

C:\Users\Admin\cdp\mighost.exe
"C:\Users\Admin\cdp\mighost.exe"
3⤵
- Executes dropped EXE
PID:1980

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\SysWOW64\schtasks.exe" /create /tn TRACERT /tr "C:\Users\Admin\cdp\mighost.exe" /sc minute /mo 1 /F
3⤵
- Scheduled Task/Job: Scheduled Task
PID:2164

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\cdp\mighost.exe
Filesize
858KB

MD5
62ce02f1a73ea0c83475abd1d49a7199

SHA1
fbb4160d795beb58976473db951ebfdd0c1aeb8a

SHA256
90798fcd4a680fda23c92cc27dd8bd4cb277cf2f148a9399b9b8017d0198355a

SHA512
409e9eb18f051de6271f66427a9721b96dcfce5c47c092245cf0377b90612d3bbb9e4ec8694db965c88863c9fc3256263bd16b60ce49ef0f098d7a8ec6da4856

Download Submit
memory/760-38-0x0000000000DE0000-0x0000000000F7E000-memory.dmp

Filesize
1.6MB

Download
memory/760-40-0x0000000000DE0000-0x0000000000F7E000-memory.dmp

Filesize
1.6MB

Download
memory/760-25-0x0000000000DE0000-0x0000000000F7E000-memory.dmp

Filesize
1.6MB

Download
memory/804-36-0x00000000004F0000-0x000000000054E000-memory.dmp

Filesize
376KB

Download
memory/804-35-0x00000000004F0000-0x000000000054E000-memory.dmp

Filesize
376KB

Download
memory/804-37-0x0000000000DE0000-0x0000000000F7E000-memory.dmp

Filesize
1.6MB

Download
memory/804-28-0x00000000004F0000-0x000000000054E000-memory.dmp

Filesize
376KB

Download
memory/804-32-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/1980-57-0x0000000000080000-0x00000000000DE000-memory.dmp

Filesize
376KB

Download
memory/1980-53-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/1980-56-0x0000000001110000-0x00000000012AE000-memory.dmp

Filesize
1.6MB

Download
memory/1980-58-0x0000000000080000-0x00000000000DE000-memory.dmp

Filesize
376KB

Download
memory/2116-4-0x0000000000080000-0x00000000000DE000-memory.dmp

Filesize
376KB

Download
memory/2116-12-0x0000000000080000-0x00000000000DE000-memory.dmp

Filesize
376KB

Download
memory/2116-1-0x0000000000080000-0x00000000000DE000-memory.dmp

Filesize
376KB

Download
memory/2116-14-0x0000000000F20000-0x00000000010BE000-memory.dmp

Filesize
1.6MB

Download
memory/2116-8-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2116-11-0x0000000000080000-0x00000000000DE000-memory.dmp

Filesize
376KB

Download
memory/2144-61-0x0000000001110000-0x00000000012AE000-memory.dmp

Filesize
1.6MB

Download
memory/2144-59-0x0000000001110000-0x00000000012AE000-memory.dmp

Filesize
1.6MB

Download
memory/2144-46-0x0000000001110000-0x00000000012AE000-memory.dmp

Filesize
1.6MB

Download
memory/2580-2-0x00000000001A0000-0x00000000001A1000-memory.dmp

Filesize
4KB

Download
memory/2580-0-0x0000000000F20000-0x00000000010BE000-memory.dmp

Filesize
1.6MB

Download
memory/2580-13-0x0000000002E60000-0x0000000002FFE000-memory.dmp

Filesize
1.6MB

Download
memory/2580-18-0x0000000000F20000-0x00000000010BE000-memory.dmp

Filesize
1.6MB

Download
memory/2580-15-0x0000000000F20000-0x00000000010BE000-memory.dmp

Filesize
1.6MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads